Freshtools was established in 2019 and offers various stolen credentials, accounts, and host protocols like RDP. It is considered a go-to site for malware purchasing, providing keyloggers, trojans, and other Malware as a Service products. Established in 2022, Torzon market is one of the biggest and most diverse marketplaces on the dark web. It is considered very secure thanks to strict user validations and transparent payment and vendor review procedures. STYX Market focuses specifically on financial fraud, making it a go-to destination for cybercriminals engaged in this activity.
Chainalysis’ blockchain-based measurements, by contrast, found that AlphaBay was generating as much as $2 million a day in average sales just before its shutdown—revenue that no other dark-web market of its kind has ever rivaled. Each time, Christin points out, the dark web’s overall business took a temporary dive, but came roaring back more quickly after those setbacks and continued to grow as a whole. AlphaBay, for example, had more than 20 times as many product listings as the original Silk Road. (Some research has found that even bad news about the dark web markets only attracts more users to them.) And AlphaBay’s buyers and customers will eventually find a new home. AlphaBay’s takedown “may give people pause. But will it scare people away? I doubt it.”
$1 Billion Of Silk Road Bitcoins Are On The Move
- He communicated with WIRED via encrypted text messages, from a frequently changing series of pseudonymous accounts, after proving his identity by signing a public message with DeSnake’s original PGP key, which multiple security researchers verified.
- “When it comes to the money making this is investment in the future of AlphaBay,” DeSnake writes.
- Also, unlike most competitors, the new version of AlphaBay only allows users to buy and sell in the privacy-focused cryptocurrency Monero, not Bitcoin, transactions of which can often be tracked through blockchain surveillance.
- DeSnake was one of the original moderators of AlphaBay along with Cazes, who committed suicide while imprisoned in Thailand.
- “The biggest reason I am returning is to make the AlphaBay name be remembered as more than the marketplace which got busted and the founder made out to have committed suicide,” DeSnake writes.
While DeSnake very well could be legitimate, the sheer fact the authorities confiscated the market’s servers and Cazes’s unencrypted laptop should bring significant suspicion whether this new darknet marketplace is legitimate, or simply another covert law enforcement operation. This includes drugs, fake documents, hacked accounts, weapons, hacking software, stolen data and more. AlphaBay requires its customers to use Monero to conduct transactions—the original marketplace implemented support for Monero in 2016—due to “higher security and anonymity” than Bitcoin. Notably, several other illicit marketplaces accept Monero and Bitcoin because the adoption of Monero exclusively could push users to conduct business elsewhere.
Cryptocurrency: Monero Only
Operation Bayonet, which would ultimately lead to the shutdown of several prominent marketplaces, began with Dutch police seizing another lesser-known market called Hansa Market. After compromising Hansa, authorities secretly operated the market for almost a month. While the Dutch focussed their efforts on Hansa, United States FBI operatives coordinated with international police to DDoS AlphaBay and seize its assets, enabling the Royal Thai Police to locate and arrest its administrator, Alexander Cazes (a.k.a. alpha02). Its vast scale and the comprehensive services it offered made it the largest criminal marketplace of its time. Law enforcement’s success in shutting down AlphaBay highlighted the risks and challenges of participating in illegal online activities, but its revival also demonstrates the persistence of these underground markets. The “new” AlphaBay announced its return on the centralized underground messaging platform Dread.
Cyble Partner Network (CPN) Join Us
AlphaBay was the largest criminal marketplace on the dark web from 2015 to 2017. It operated on the Tor network and allowed users to buy and sell illegal goods, counterfeit documents, computer hacking tools, and stolen data. Other users noted that it still wasn’t clear how AlphaBay had been seized, given that its use of Tor and Bitcoin were meant to shield buyers, sellers, and admins from identification. For months, an extortionist had reportedly threatened to reveal the identity of one AlphaBay administrator, and even released identifying information about him after AlphaBay’s proctors sent him or her a hush-money payment. But dark web practitioners still have vague fears that law enforcement agencies found a method of breaking AlphaBay’s Tor protection–which potentially means sites like Dream Market and Hansa are vulnerable too.
Agentic AI In Cybersecurity: Transforming Threat Detection And Defense
Known for its publicity stunt releasing millions of stolen card details for free, BidenCash specializes in credit card fraud and identity theft. With advanced dark web monitoring, threat intelligence, and brand protection services, we help you uncover hidden dangers, prevent data breaches, and safeguard your reputation. Our platform ensures that your brand stays one step ahead of cybercriminals, giving you peace of mind in an increasingly complex digital landscape. In May 2024, Ticketmaster faced a significant data breach affecting millions of customers. Dark web listings surfaced almost immediately after the breach, advertising this information for sale to cybercriminals. Kingdom Market is a newer darknet market that has been around since April 2021 but was only recently vetted for listing on Dread, the pre-eminent forum for markets on the dark web.
Security firm Flashpoint says it has seen evidence and descriptions of DeSnake operating under the same pseudonym—first as a credit-card-focused cybercriminal on sites like Evolution and Tor Carder Forum before becoming a market administrator himself—since at least 2013. AlphaBay has long been rumored to have some sort of connections to Russia or Russians. Its rules have always banned the sale of data stolen from victims in former USSR countries, a common prohibition among Russian hackers intended to shield them from Russian law enforcement scrutiny. And when Alexandre Cazes wrote under the Alpha02 moniker on the site, he sometimes signed off with a Russian phrase for “stay safe.” But when Cazes was later tracked down in Thailand, many assumed AlphaBay’s Russian fingerprints had been designed to mislead investigators. It will take some time to see if markets like Empire will gain traction, and if new markets will come online.
Popular Series
In 2021, the infamous marketplace reappeared under the management of a figure known as “DeSnake.” Some welcomed the return of the marketplace, while others feared it would repeat its previous security lapses. After its relaunch, AlphaBay operated under new leadership but faced heightened scrutiny from law enforcement agencies. The site launched in 2014 and quickly attracted hundreds of thousands of users before law enforcement authorities shut it down in July 2017. Despite its shutdown, AlphaBay made a brief reappearance in 2021 before being permanently taken down in 2023. According to another complaint affidavit filed in the Middle District of Florida against Jeremy Achey, an investigation into a fentanyl overdose death in Orange County, Florida, on February 27, 2017, revealed that the lethal substance was purchased on AlphaBay from Achey.
AlphaBay: Global Authorities Shut Down Dark Net Market 10 Times The Size Of 2013’s Silk Road
According to our historical darknet records, DeSnake had connections in Russia although his true identity and location was not publicly known. In cooperation with the FBI, the Royal Thai Police took steps to organize the extradition of the 24-year old Canadian administrator back to the United States. However, after Cazes was held for exactly a week at the Narcotics Suppression Bureau in Bangkok, reports of his apparent suicide surfaced. Bangkok vowed to conduct an autopsy, while US authorities had no interest in verifying the legitimacy of the suspect’s death. Attorney’s Office for the Eastern District of California filed a civil forfeiture complaint against Alexandre Cazes and his wife’s assets located throughout the world, including in Thailand, Cyprus, Lichtenstein, and Antigua & Barbuda.
Darknet Markets Explained
The very same Reddit user who had posted to the site’s dark-net market forum that they would be “sober for a while” ended their message with a note of stubborn persistence. The Dutch police pointed out that they did ban the especially deadly opiate fentanyl from Hansa while it was under their control, in an effort to minimize the harm they might be responsible for—a move Hansa’s users actually applauded. In truth, however, that ban had come just a few days before the end of their undercover operation. Until then, for more than three weeks, that highly dangerous opioid had continued to be offered on the site, with no guarantee that all of its orders would be intercepted. So, a few weeks into their takeover, the police wiped every image from the site.
AlphaBay Marketplace Returns
Maria Gershuni, a Flashpoint analyst, said that cybercriminals are increasingly aware that they need to steer clear of taboo subjects like ransomware and fentanyl. “The takedown of AlphaBay is significant, but it’s a bit of a whack-a-mole,” said Frank Cilluffo, director of the Centre for Cyber and Homeland Security at George Washington University. Dozens of new marketplaces opened up immediately after its fall to fill the void — AlphaBay opened in December 2014. FBI acting director Andrew McCabe said AlphaBay was 10 times as large as Silk Road, a dark website the agency had shut down in 2013.
In addition to the marketplace feature, DeSnake said AlphaBay will also have a forum section. The forum will include the return of a private malware sub-community, in which DeSnake claims they will post an updated source code for a famous banking trojan to promote the re-launch. DeSnake counters that if law enforcement had gotten to him and launched the new AlphaBay as a honeypot, they would have simply reused the original AlphaBay’s code. And he points out that the Monero-only restriction for the site would make it far less effective for trapping unsuspecting dark web buyers than a site that simply accepts Bitcoin. In the meantime, DeSnake wants to attract users with promises of a still-unproven system he calls AlphaGuard, designed to let users withdraw their funds even if authorities once again seize the servers that run AlphaBay’s infrastructure.
Threat Actor Profiles
The paperwork of tracking and sending those order records to Europol—not to mention attempting to intercept every order shipped to the Netherlands—became so massive that the police were briefly overwhelmed. “Due to the influx of Alphabay refugees we are dealing with technical issues,” read a message they posted to the site. Those refugees, however, remained so eager to join that some Hansa users began selling their accounts on web forums, like scalpers selling tickets to a concert. Past takedowns have led to more market sites going permanently offline in a ripple effect, as they’re overwhelmed by new users and unexpected visibility. But the anonymous market for addictive drugs and other contraband isn’t slackening, says Christin, and so neither will the dark web’s brisk business. “Seasoned users expected this,” adds Isak Ladegaard, a sociological researcher at Boston College.
The operation was the result of cooperative efforts among multiple countries, including the Dutch national police, Royal Thai police, and the Drug Enforcement Agency (DEA). According to posts on dark web forums and Reddit’s discussion pages devoted to darknet markets, most of AlphaBay’s users seemed to initially seek a new home at Hansa, a black market site with more than 24,000 drug listings. “Due to the influx of Alphabay refugees we are dealing with technical issues,” read a message on the site. When AlphaBay became inaccessible as a result, thousands of its buyers and vendors flocked to the then law enforcement-ran Hansa market to continue their operations.
An alleged administrator of AlphaBay, 26-year-old Canadian Alexandre Cazes, was arrested in Thailand on 5 July following a joint operation between US, Canadian and Thai authorities. “We recorded an eight times increase in the number of human users on Hansa immediately following the takedown of AlphaBay,” said Mr Wainwright. The Dutch National Police took over the Hansa marketplace on 20 June after two men in Germany were arrested and servers in Germany, The Netherlands and Lithuania were seized. According to several sources AlphaBay 2.0 was shutdown in 2023 as the result of AlphaGuard being deployed. The administrator, DeSnake, for unknown reasons, was unable to sign off in time, leading to the end of AlphaBay 2.0. After the arrest, while waiting for extradition to the United States, Cazes apparently died by suicide while in custody in Thailand.
