How Law Enforcement Tracks Dark Web Criminals: Five Methods and the Cases Behind Them

Law enforcement almost never breaks Tor. Agencies catch dark web criminals in five repeatable ways: exploits and relay attacks that expose a real IP address, the operator's own opsec mistakes, blockchain tracing to exchanges that hold identity records, data from captured marketplaces, and server seizures coordinated across borders. The method now runs at scale: in May 2025 Operation RapTor arrested 270 dark web vendors, buyers and administrators in 10 countries using intelligence from four marketplaces seized earlier, according to Europol and the US Department of Justice.

The 2017 AlphaBay and Hansa operation shows the pattern in one story. The Dutch National Police took covert control of Hansa, then the third-largest dark web market, on 20 June 2017. When the FBI- and DEA-led Operation Bayonet took AlphaBay down on 5 July, its users moved to Hansa, which recorded an eight-fold increase in new members while the police watched. By the time Hansa was shut on 20 July, more than 38,000 transactions had been identified, some 10,000 foreign buyer addresses had been passed to Europol, and intelligence packages had gone to partners in 37 countries, per Europol's statement. Nobody broke Tor. The police were running the market.

This explainer is for CISOs, security teams, journalists and lawyers who need an accurate model of how these cases are built. Each method below is tied to the court filings and agency releases behind it, and every figure links to the agency, court or research publisher that reported it.

Key takeaways

• Tor's cryptography is rarely the weak point. Documented cases turn on browser exploits, relay-level attacks, server mistakes and the operator's own habits. The Tor Project itself could only list candidate explanations after the 2014 Operation Onymous seizures.

• Seized marketplace data produces the biggest arrest counts. Playpen led to at least 350 arrests in the US and 520 more through the international investigation, Welcome to Video to 337, Operation SpecTor to 288 and Operation RapTor to 270, each built on data from a seized site.

• Blockchain tracing turns pseudonymous payments into names. Welcome to Video, Hydra, Helix and Bitcoin Fog all depended on it. A federal judge ruled Chainalysis's analytics reliable and admissible in the 2024 Bitcoin Fog trial, and in January 2026 the government took final title to more than US$400 million in Helix-linked assets.

• Cooperation is the slow part. Operation Cronos against LockBit involved law enforcement from 10 countries in its first phase and 12 in its third; Genesis Market involved 17; the Phobos and 8Base arrests involved 14; Operation Alice in 2026 involved 23.

• Ransomware money leaves a trail, but not always an arrest. Chainalysis tracked about US$820 million in on-chain ransomware payments in 2025, with a median payment near US$60,000. LockBit's alleged administrator was named and sanctioned in May 2024, when the US offered up to US$10 million for information leading to his arrest.

Figure 1: The five methods, each anchored to one case that can be checked against court filings or agency releases. Sources: DOJ, Schneier on Security, Chainalysis, Europol, NCA.

The dark web in plain terms

The "dark web" in everyday use mostly means Tor onion services (formerly hidden services), with smaller networks such as I2P. Tor wraps traffic in layers of encryption and routes it through relays so that no single relay sees both who is talking and to what, and an onion service is reached through a rendezvous point, so in principle no relay learns the server's IP address. Stingrai's guide to Tor's real anonymity limits covers the protocol in depth, and Dark Web Myths Debunked separates it from the Hollywood version.

That design protects journalists, activists and privacy-conscious users, and it protects criminal markets in the same way. The difference is that a market operator runs a server full of evidence and has to stay disciplined for years: no IP leak from the application, no reused identity, no traceable cash-out, and no trusted insider who turns out to be police. Real operators rarely manage all four. The five methods below exploit those gaps.

Method 1: exploits, relay attacks and server leaks

Breaking Tor at the protocol level is rare, contested and expensive, but research shows it is possible in principle. Murdoch and Danezis showed in 2005 that an adversary with only a partial view of the network could infer which relays carried a stream, and an NDSS 2024 paper presented a flow-correlation attack on onion-service sessions that a group of colluding ISPs could run.

The best-documented real-world case is the 2014 "relay early" attack. On 4 July 2014 the Tor Project found and removed a group of relays that had joined the network on 30 January and were running traffic-confirmation attacks against people who operated or visited hidden services (Tor Project advisory). The Tor Project later attributed that attack to Carnegie Mellon researchers (Tor Project). In February 2016, a court order in the Silk Road 2.0 case against Brian Farrell recorded that his IP address was identified by Carnegie Mellon's Software Engineering Institute "when SEI was conducting research on the Tor network which was funded by the Department of Defense", and that police obtained it with a subpoena (Motherboard, quoting the order).

More often, agencies attack the browser rather than the network. After arresting the creator of Playpen, a Tor child-exploitation site, on 19 February 2015, the FBI kept the site running for about two weeks, until 4 March (Operation Pacifier). With court approval it deployed a Network Investigative Technique (NIT), code delivered through the site that sent visitors' IP addresses and basic computer information back to the FBI. The Justice Department said in May 2017 that the investigation had produced at least 350 arrests in the United States and at least 520 through the international investigation coordinated with Europol (DOJ).

Playpen produced years of litigation. The warrant was issued in the Eastern District of Virginia, but the NIT reached computers everywhere. Federal Rule of Criminal Procedure 41 was amended in 2016 to allow remote-access warrants when a computer's location "has been concealed through technological means" (Rule 41). In 2019 the Eleventh Circuit held the warrant invalid but declined to exclude the evidence under the good-faith exception, and in 2017 the government dropped charges against one defendant rather than disclose details of the NIT (Operation Pacifier).

Server-side mistakes are the more common path. After Operation Onymous took down more than 410 hidden services in November 2014, the Tor Project wrote that it did not know how the sites had been located and listed the candidates: poor operational security, ordinary web bugs such as SQL injection, Bitcoin deanonymization, and attacks on the Tor network itself (Tor Project). The lesson for defenders is ordinary: the protocol is robust, and the infrastructure around it usually is not.

Method 2: operator opsec failures

Most named takedowns trace back to something the operator did under their own name. Ross Ulbricht is the textbook case. An IRS investigator traced the handle "altoid", which had posted some of the first promotions of Silk Road on Shroomery and Bitcoin Talk. In October 2011 the same handle posted a job ad on Bitcoin Talk asking applicants to write to "rossulbricht at gmail dot com". The criminal complaint also described a Stack Overflow account opened in March 2012 under Ulbricht's name and Gmail address that was renamed "frosty" less than a minute after it asked how to connect to a Tor hidden service, and said a July 2013 forensic analysis of a Silk Road server found PHP code identical to the code in that question (Schneier on Security, quoting the complaint). The FBI arrested Ulbricht at the Glen Park branch of the San Francisco Public Library on 1 October 2013 (Wikipedia).

How the FBI found the Silk Road server in Iceland is still disputed. FBI agent Christopher Tarbell's September 2014 declaration said agents located the server through an IP address leak from the site's login page, which included a CAPTCHA prompt, and security experts have doubted that account (Wikipedia).

AlphaBay fell to a similar slip. The Justice Department's July 2017 forfeiture complaint says that in December 2016 investigators learned that Alexandre Cazes's personal Hotmail address had appeared in the header of AlphaBay's welcome email to new users in December 2014, and in its password-reset emails, and the address led to his name and business. Cazes was arrested in Thailand on 5 July 2017 and died in custody on 12 July (DOJ).

The pattern repeats: handles reused from cleartext forums, personal email addresses, photos and payment accounts that link back to a real identity. An operator needs perfect discipline across thousands of small interactions for years. Investigators need one mistake.

Method 3: following the money on the blockchain

Bitcoin is pseudonymous, not anonymous: every transaction sits on a public ledger. What changed in the last decade is tooling. Analytics firms such as Chainalysis, TRM Labs and Elliptic group addresses controlled by the same entity and label them by service (exchange, mixer, market, ransomware operator), so investigators can follow funds until they reach an exchange that holds identity records.

Welcome to Video is the case agencies cite most. Starting from the bitcoin address the site listed, IRS Criminal Investigation (IRS-CI) and Homeland Security Investigations (HSI) used Chainalysis Reactor to graph money flowing in and out, saw that payments came from several exchanges, and asked those exchanges for the Know-Your-Customer (KYC) records behind the paying accounts (Chainalysis). The operator was arrested and the site shut down by March 2018. When the Justice Department announced the charges on 16 October 2019, it reported 337 arrests in 38 countries and at least 23 minors rescued. Andy Greenberg's book Tracers in the Dark (2022) tells the investigators' side of the story.

The Bitcoin Fog case settled the evidence question. On 12 March 2024 a jury convicted Roman Sterlingov of money laundering conspiracy and related charges for running a mixer that moved more than 1.2 million bitcoin, worth about US$400 million at the time (DOJ). During the trial, Judge Randolph Moss ruled in a Daubert order that Chainalysis's analytics were reliable and admissible as substantive evidence, rejecting the defense claim that attribution was a "black box algorithm" (Chainalysis). Sterlingov was sentenced in November 2024 to 12 years and six months (DOJ).

Helix shows how long the tail runs. Larry Dean Harmon pleaded guilty in August 2021 to a money laundering conspiracy for running a mixer that moved more than 350,000 bitcoin, worth over US$300 million when transacted, for customers of darknet markets including AlphaBay, and FinCEN separately assessed a US$60 million civil penalty (DOJ). He was sentenced to three years in November 2024. On 21 January 2026 a judge entered a final forfeiture order giving the government title to more than US$400 million in cryptocurrency, real estate and other assets (DOJ).

Hydra Market shows the scale. When German police seized Hydra's servers on 5 April 2022 they also seized bitcoin worth about US$25 million. The Justice Department said Hydra had received about US$5.2 billion in cryptocurrency since 2015 and accounted for an estimated 80% of darknet-market crypto transactions in 2021, and it charged Dmitry Pavlov, a resident of Russia, over the hosting company that ran Hydra's servers (DOJ). Treasury sanctioned Hydra the same day (OFAC).

Laundering services are now targets in their own right. In late November 2025 Swiss and German authorities shut down Cryptomixer, a mixer that had moved over EUR 1.3 billion in bitcoin since 2016, seizing three servers, more than 12 terabytes of data and over EUR 25 million in bitcoin (Europol). In June 2026 an operation built on devices seized in a 2025 Polish arrest took down AudiA6, a service suspected of laundering more than EUR 336 million between 2022 and 2025, and arrested two alleged administrators in Georgia (Europol).

The macro numbers keep growing. Chainalysis estimates that illicit cryptocurrency addresses received at least US$154 billion in 2025, up 162% year over year and driven mainly by sanctioned entities. For corporate defenders the ransomware trail matters most: on-chain ransomware payments fell about 8% to roughly US$820 million in 2025 (likely to approach US$900 million as more payments are attributed), while the median payment rose 368% to nearly US$60,000 (Chainalysis). Stingrai's ransomware payout statistics break those numbers down.

Mixers built as code are harder to reach. Treasury's OFAC sanctioned Tornado Cash on 8 August 2022, saying it had laundered more than US$7 billion since 2019, including over US$455 million stolen by North Korea's Lazarus Group (Treasury). On 26 November 2024 the Fifth Circuit held that Tornado Cash's immutable smart contracts cannot be blocked and that OFAC "overstepped its congressionally defined authority" (Van Loon v. Treasury), and Treasury removed the sanctions on 21 March 2025 (Treasury). The criminal case went on: on 6 August 2025 a jury convicted co-founder Roman Storm of conspiring to operate an unlicensed money transmitting business (DOJ).

Figure 2: How a bitcoin flow is followed in a typical dark web investigation, as Chainalysis described it for Welcome to Video. Sources: Chainalysis, DOJ.

Method 4: captured marketplaces and undercover work

Dark web markets run on trust between strangers, and undercover work attacks that trust. Controlled buys, intercepted parcels and cooperating defendants still matter. An HSI agent on the US Joint Criminal Opioid and Darknet Enforcement (JCODE) team put the buyer's problem simply: "you have to open that mailbox. You have to touch that package." JCODE, created in 2018, brings together the FBI, DEA, Postal Inspection Service, HSI and other agencies (FBI).

The biggest arrest counts, though, come from a seized market's own data. The pattern has repeated almost every year since 2020:

• Operation DisrupTor (September 2020) followed the May 2019 Wall Street Market takedown and arrested 179 people: 121 in the United States (including two in Canada at US request), 42 in Germany, 8 in the Netherlands, 4 in the UK, 3 in Austria and 1 in Sweden (DEA).

• Operation Dark HunTor (October 2021) used evidence from the takedown of DarkMarket earlier that year to arrest 150 people in an operation involving nine countries (Europol).

• Operation SpecTor (May 2023) built intelligence packages from Monopoly Market, whose infrastructure German authorities seized in December 2021, then arrested 288 people in nine countries and seized EUR 50.8 million (US$53.4 million) (Europol).

• Operation RapTor (May 2025) arrested 270 vendors, buyers and administrators in 10 countries using intelligence from the takedowns of Nemesis, Tor2Door, Bohemia and Kingdom Markets, and seized more than EUR 184 million in cash and cryptocurrency (Europol).

Europol describes the model plainly: taking down a platform is the beginning of follow-up investigations to identify and arrest its high-value vendors, not the end of the story. The 2017 Hansa operation described above is the purest form, because the police ran the market themselves.

Genesis Market shows the same approach against a credential shop. Since March 2018 it had sold access to data from more than 1.5 million compromised computers holding over 80 million account credentials. On 4 April 2023, in an operation led by the FBI and the Dutch National Police with 17 countries involved, police shut the market and arrested 119 users (Europol); the FBI seized 11 domains under a warrant from the Eastern District of Wisconsin (DOJ), and Treasury sanctioned Genesis Market on 5 April (OFAC).

The 2026 operations pushed the model further. When the FBI, Europol and partners in 14 countries took down the LeakBase forum on 3 and 4 March 2026, Europol said seizing its database "enabled the deanonymisation of multiple users who believed they were operating anonymously", and enforcement actions included measures against 37 of its most active users (Europol; DOJ). In May 2026 an operation built on a French and Dutch joint investigation team dismantled First VPN, a VPN service advertised on Russian-speaking forums as a way to stay beyond the reach of law enforcement; its users were told they had been identified, and information on 506 of them was shared internationally (Europol).

Method 5: server seizures and cross-border cooperation

Most major operations end at a server. Seizing the hardware lets investigators read the database, private messages and payment records, and post a seizure banner that tells the market's users the site is gone. The technical work is rarely the slow part. The legal path to the server is, because evidence held abroad normally moves through Mutual Legal Assistance Treaty (MLAT) requests, so European cases increasingly run through Joint Investigation Teams supported by Eurojust, with Europol hosting coordination.

Operation Cronos against LockBit is the model case. On 20 February 2024 the NCA-led taskforce, working with the FBI and coordinated by Europol, took control of LockBit's infrastructure, took down 34 servers in eight countries, froze more than 200 cryptocurrency accounts and identified more than 14,000 rogue accounts for removal. Two LockBit actors were arrested in Poland and Ukraine, and the NCA obtained over 1,000 decryption keys (Europol; NCA). The US unsealed charges against two Russian nationals, Artur Sungatov and Ivan Kondratyev (DOJ). In May 2024 the NCA named LockBit's administrator "LockBitSupp" as Dmitry Khoroshev; the UK, US and Australia sanctioned him, and the US offered a reward of up to US$10 million (NCA). A third phase in October 2024, involving 12 countries, produced four arrests: a suspected developer arrested at France's request, two people in the UK, and the administrator of a bulletproof hosting service in Spain, where police also seized nine servers (Europol).

Operation Endgame applies the same model to the malware that gets attackers in. Its first phase, from 27 to 29 May 2024, took down or disrupted more than 100 servers, put more than 2,000 domains under law enforcement control and made four arrests, against droppers including IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot (Europol). Later phases kept going after the successors: about 300 servers, 650 domains and 20 international arrest warrants in May 2025 (Europol); more than 1,025 servers against the Rhadamanthys infostealer, VenomRAT and Elysium in November 2025 (Europol); and 326 servers and 142 domains against SocGholish, Amadey and StealC in June 2026, when 27 million stolen login credentials were recovered (Europol).

Forums and markets fall the same way:

• Operation Talent (28 to 30 January 2025), led by German authorities with eight countries, seized the Cracked and Nulled forums, which had more than 10 million users between them, along with 17 servers, 12 domains and about EUR 300,000 in cash and crypto; two suspects were arrested (Europol), and the US charged a Nulled administrator (DOJ).

• Phobos and 8Base (February 2025): an operation involving 14 countries arrested four Russian nationals suspected of leading the 8Base ransomware group, took down 27 servers and warned more than 400 companies of attacks (Europol). The US charged Roman Berezhnoy and Egor Glebov, alleging that their group victimized more than 1,000 organizations and received over US$16 million in ransom payments (DOJ).

• Archetyp Market (June 2025): a six-country operation took the market's infrastructure in the Netherlands offline, arrested its administrator, a 30-year-old German national, in Barcelona, and seized EUR 7.8 million in assets from a market with more than 600,000 users (Europol).

• XSS (July 2025): French police and Ukrainian authorities arrested the suspected administrator of the Russian-language XSS forum in Kyiv on 22 July, after an investigation the French police opened in 2021. Europol says he made more than EUR 7 million in fees from a forum with more than 50,000 registered users (Europol).

• Operation Alice (March 2026): 23 countries shut down more than 373,000 onion sites run by a single operator whose sites advertised abuse material and cybercrime services that were never delivered, seized 105 servers and identified 440 customers (Europol).

• KillSec (October 2026): a German-led operation with 10 countries brought five of the ransomware group's central servers and its dark web leak site under police control and provisionally arrested three suspects; investigators believe a 16-year-old was the main operator (Europol).

None of this removes demand. After each takedown, listings move to successor markets, forums and private channels; Stingrai's dark web marketplaces report tracks which venues are active and which have died. What takedowns reduce is the number of people willing to run the infrastructure, through arrests, sanctions, rewards and seized funds.

Figure 3: Major operations from the Silk Road arrest in October 2013 to the KillSec takedown in October 2026, each coloured by the method that broke the case. Sources: DOJ, Europol, NCA, FBI.

Notable takedowns, 2013 to 2026, and how each one broke

The table pairs each major operation with the method the primary record points to. The marketplaces report covers which markets replaced them.

Figure 4: Cash, crypto and assets seized or forfeited, in US dollars as each release states them. Amounts are at the time of seizure; Helix includes real estate. Sources: DOJ, DOJ, DOJ, Europol, DEA.

Figure 5: Confirmed arrests by named operation. Operations that captured a site's user data lead by a wide margin; operations aimed at operators and infrastructure arrest far fewer people. Sources: agency releases linked in the table above.

Limits, legal fights and what comes next

Remote hacking warrants. Playpen forced the 2016 Rule 41 change described above, but searching computers whose location is unknown, including computers abroad, still raises legal questions every time an agency deploys an exploit.

Jurisdiction. Agencies can name operators they cannot reach. LockBit's alleged administrator was identified and sanctioned in May 2024, when US authorities offered up to US$10 million for information leading to his arrest. Cronos's later phases show the workaround: sanctions, infrastructure takeovers, control of the leak site and public naming that damages the brand.

Attribution is not proof. Blockchain analysis can tie a wallet cluster to a ransomware affiliate without proving who controls it. The Bitcoin Fog Daubert ruling helps, but investigators still need exchange records, seized servers or undercover evidence to charge a person.

Sanctions on code. The Tornado Cash ruling limits sanctions against immutable smart contracts. It does not protect custodial services run by identifiable people, as Helix, Bitcoin Fog, Cryptomixer and AudiA6 show.

Running the market. The Electronic Frontier Foundation criticized the FBI for operating Playpen for nearly two weeks, arguing that the bureau allowed the distribution of the material it was investigating (Operation Pacifier). Hansa drew less criticism, but every operation in which police run a market raises questions about evidence integrity and limits that courts keep working through.

The protocol keeps hardening. Tor fixed the relay-early flaw in 2014, and version 3 onion services, first supported in Tor 0.3.2.9 on 9 January 2018, replaced the original hidden-service design (Tor Project). That keeps pushing investigators toward the layers above the protocol: people, payments and servers.

What this means for defenders

The ransomware affiliates, initial access brokers and credential sellers your team is most likely to face are the same people these operations target, and the same evidence trails apply to your incidents.

1. Preserve and report. Ransom payments and stolen data end up in the on-chain records and seized servers investigators use. Preserve logs and volatile evidence, and report incidents to your national channel, such as the FBI's IC3 in the US or Action Fraud in the UK.

2. Assume your access is for sale. Genesis Market sold access to data from more than 1.5 million compromised computers, LeakBase traded stolen credential archives, and the June 2026 Endgame phase recovered 27 million stolen login credentials. Rotate exposed credentials, enforce phishing-resistant MFA on remote access, and watch for infostealer infections on unmanaged devices. Stingrai's compromised credential statistics and dark web price index show what that access sells for.

3. Test the paths brokers sell. Exposed remote access, VPN gateways, Active Directory and help-desk processes are what access brokers monetize. An external network penetration test and an assumed-breach red team test them the way an affiliate would.

4. Treat identity links as a two-way lesson. The handle reuse and personal accounts that exposed Ulbricht and Cazes are the same kinds of signals your threat intelligence and incident responders can use against intruders, and the kind attackers use against your staff through phishing and pretexting, which social engineering testing measures.

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified penetration testers, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements. For the threats in this post, that means external and internal network tests of the VPN, remote access and Active Directory paths that access brokers sell, assumed-breach and threat intelligence-led red team engagements, phishing and vishing campaigns, and dark web credential leakage monitoring on Enterprise plans. Engagements run as one-time (annual) tests or as continuous programs, and packages are listed on the pricing page.

Frequently Asked Questions

How does law enforcement track dark web criminals?

Rarely by breaking Tor. Agencies use five methods: exploits and relay attacks that expose a real IP address (the FBI's Playpen NIT in 2015), the operator's own opsec mistakes (Ross Ulbricht's "altoid" handle and Gmail address), blockchain tracing to exchanges that hold identity records (Welcome to Video, 337 arrests in 38 countries), data from captured marketplaces (Operation RapTor's 270 arrests in 2025), and server seizures coordinated across borders (Operation Cronos against LockBit in 2024). Most cases combine several of them.

Can the FBI break Tor encryption?

There is no public evidence that the FBI or any other agency has broken Tor's cryptography. Documented cases rely on browser exploits such as the Playpen NIT, relay-level traffic-confirmation attacks such as the 2014 "relay early" attack that the Tor Project later attributed to Carnegie Mellon researchers, server mistakes, or the operator's own habits. Tor protects the connection, not a person who leaks their identity through the application, a reused account or a payment trail.

What is a Network Investigative Technique (NIT)?

A NIT is the FBI's term for code delivered to a suspect's computer, typically through a browser exploit, that sends identifying information such as the real IP address back to investigators. The best-known use is Operation Pacifier: after taking over the Playpen site in February 2015, the FBI deployed a court-approved NIT to identify visitors, and the Justice Department reported at least 350 arrests in the US and 520 through the international investigation by May 2017. The case led to the 2016 amendment of Federal Rule of Criminal Procedure 41 on remote-access warrants.

How do investigators trace bitcoin from a dark web market to a real person?

They start from an address the market lists or a seized server reveals, use analytics tools such as Chainalysis Reactor, TRM Labs or Elliptic to group addresses controlled by the same entity, and follow the funds until they reach an exchange or other service that keeps Know-Your-Customer records. A legal request to that exchange then identifies the account holder. In Welcome to Video, IRS-CI and HSI followed payments from several exchanges into the site's bitcoin address, and in the 2024 Bitcoin Fog trial a federal judge ruled Chainalysis's analytics reliable and admissible.

Which dark web takedowns led to the most arrests?

Operations that captured a site's user data lead by a wide margin. Playpen produced at least 350 arrests in the US and 520 more through the international investigation by May 2017, Welcome to Video 337 in 38 countries, Operation SpecTor 288 in nine countries in 2023, Operation RapTor 270 in 10 countries in 2025 and Operation DisrupTor 179 in 2020. Operations aimed at operators and infrastructure arrest far fewer people: Operation Cronos made two arrests in its first phase and four in its third.

What is Operation Cronos?

Operation Cronos is the international operation against the LockBit ransomware group, led by the UK's National Crime Agency with the FBI and coordinated by Europol. In February 2024 it took over LockBit's infrastructure, took down 34 servers, froze more than 200 cryptocurrency accounts and obtained over 1,000 decryption keys, with two arrests in Poland and Ukraine. In May 2024 the NCA named LockBit's administrator as Dmitry Khoroshev, who was sanctioned by the UK, US and Australia, and a third phase in October 2024 produced four more arrests.

Are crypto mixers like Tornado Cash illegal?

It depends on how the mixer is run. Custodial services run by identifiable people have been prosecuted successfully: Helix's operator was sentenced in 2024 and the government took title to more than US$400 million in linked assets in January 2026, Bitcoin Fog's operator received 12 years and six months, and Cryptomixer was seized in 2025. Tornado Cash, built as immutable smart contracts, was sanctioned in 2022, but the Fifth Circuit held in November 2024 that OFAC had exceeded its authority and Treasury lifted the sanctions in March 2025. Co-founder Roman Storm was still convicted in August 2025 of conspiring to operate an unlicensed money transmitting business.

What should a CISO take from these takedowns?

Three things. The ransomware affiliates and access brokers your team faces are the people these operations target, so preserving evidence and reporting incidents feeds real investigations. The access they trade, such as stolen credentials, exposed remote access and weak Active Directory, is what Genesis Market, LeakBase and the Operation Endgame targets dealt in, so test those paths before a broker lists them. And identity links cut both ways: the habits that exposed Ulbricht and Cazes are the same kinds of signals your threat intelligence team can use.

Related reading

• Top Dark Web Marketplaces 2026: What's Active, What Died

• Dark Web Price Index 2026: What Your Data Sells For

• How Anonymous Is the Dark Web? Tor's Real Anonymity Limits in 2026

• Dark Web Myths Debunked: What's Actually There vs Hollywood

• Compromised Credential Statistics 2026: Stealer Logs, ATO, and Credential Stuffing

• Ransomware Payout Statistics 2026: The Verified Numbers

References

New operations appear first in the newsrooms of the Department of Justice, FBI, Europol, the National Crime Agency and Treasury OFAC.

1. Europol. Massive blow to criminal Dark Web activities after globally coordinated operation. 20 July 2017. AlphaBay and Hansa.

2. US Department of Justice. AlphaBay, the Largest Online "Dark Market," Shut Down. 20 July 2017.

3. US Department of Justice. Verified complaint for forfeiture in rem, United States v. Alexandre Cazes assets. Filed 19 July 2017, Eastern District of California. AlphaBay welcome-email header.

4. The Tor Project. Tor security advisory: "relay early" traffic confirmation attack. 30 July 2014.

5. The Tor Project. Did the FBI Pay a University to Attack Tor Users?. 11 November 2015.

6. Motherboard (Joseph Cox). Carnegie Mellon University Attacked Tor, Was Subpoenaed By Feds. 24 February 2016. Quotes the United States v. Farrell order.

7. The Tor Project. Thoughts and Concerns about Operation Onymous. 9 November 2014.

8. The Tor Project. Onion Service version 2 deprecation timeline. 2 July 2020.

9. Steven J. Murdoch and George Danezis. Low-Cost Traffic Analysis of Tor. IEEE Symposium on Security and Privacy, 2005.

10. Lopes et al. Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum. NDSS 2024.

11. US Department of Justice. Florida Man Sentenced to Prison for Engaging in a Child Exploitation Enterprise. 1 May 2017. Playpen and the NIT.

12. Cornell Legal Information Institute. Federal Rule of Criminal Procedure 41. Includes the 2016 amendment.

13. Wikipedia. Operation Pacifier. Operating window, litigation and criticism.

14. Schneier on Security. Silk Road Author Arrested Due to Bad Operational Security. 7 October 2013. Quotes the Ulbricht complaint.

15. National Security Archive. Declaration of Christopher Tarbell, United States v. Ross Ulbricht. 5 September 2014.

16. US Department of Justice, Office of the Pardon Attorney. Clemency grants by President Donald J. Trump (2025-present).

17. US Attorney's Office, SDNY. U.S. Attorney Announces Historic $3.36 Billion Cryptocurrency Seizure And Conviction In Connection With Silk Road Dark Web Fraud. 7 November 2022.

18. US Department of Justice. South Korean National and Hundreds of Others Charged Worldwide in the Takedown of the Largest Darknet Child Pornography Website. 16 October 2019.

19. Chainalysis. Chainalysis in Action: DOJ Announces Shutdown of Largest Child Pornography Website. 16 October 2019.

20. US Department of Justice. Bitcoin Fog Operator Convicted of Money Laundering Conspiracy. 12 March 2024.

21. Chainalysis. Bitcoin Fog Case Confirms Chainalysis Analytics is Reliable and Admissible in Court. 8 April 2024.

22. US Department of Justice. Bitcoin Fog Operator Sentenced for Money Laundering Conspiracy. 8 November 2024.

23. US Department of Justice. Ohio Resident Pleads Guilty to Operating Darknet-Based Bitcoin "Mixer" That Laundered Over $300 Million. 18 August 2021.

24. US Department of Justice. Government Forfeits Over $400M in Assets Tied to Helix Darknet Cryptocurrency Mixer. 29 January 2026.

25. US Department of Justice. Justice Department Investigation Leads to Shutdown of Largest Online Darknet Marketplace. 5 April 2022. Hydra.

26. US Department of the Treasury. Treasury Sanctions Russia-Based Hydra, World's Largest Darknet Market, and Ransomware-Enabling Virtual Currency Exchange Garantex. JY0701, 5 April 2022.

27. Chainalysis. 2026 Crypto Crime Report: Introduction. 8 January 2026.

28. Chainalysis. Crypto Ransomware: 2026 Crypto Crime Report. 26 February 2026.

29. US Department of the Treasury. U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash. JY0916, 8 August 2022.

30. US Court of Appeals for the Fifth Circuit. Van Loon v. Department of the Treasury, No. 23-50669. 26 November 2024.

31. US Department of the Treasury. Tornado Cash Delisting. SB0057, 21 March 2025.

32. US Attorney's Office, SDNY. Founder Of Tornado Cash Crypto Mixing Service Convicted Of Knowingly Transmitting Criminal Proceeds. 6 August 2025.

33. Europol. Europol and partners shut down "Cryptomixer". 1 December 2025.

34. Europol. Ransomware gangs cut off from EUR 336 million "AudiA6" crypto laundering pipeline. 11 June 2026.

35. FBI. Operation DisrupTor: JCODE Actions in Los Angeles Shut Down Major Darknet Drug Vendor. 22 September 2020.

36. US Drug Enforcement Administration. International law enforcement operation targeting opioid traffickers on the Darknet results in over 170 arrests worldwide. 22 September 2020.

37. Europol. 150 arrested in dark web drug bust as police seize EUR 26 million. 26 October 2021. Operation Dark HunTor.

38. Europol. 288 dark web vendors arrested in major marketplace seizure. 2 May 2023. Operation SpecTor.

39. Europol. 270 arrested in global dark web crackdown targeting online drug and criminal networks. 22 May 2025. Operation RapTor.

40. US Department of Justice. Law Enforcement Seize Record Amounts of Illegal Drugs, Firearms, and Drug Trafficking Proceeds in International Operation Against Darknet Trafficking of Fentanyl and Opioids; 270 Arrested Across Four Continents. 22 May 2025.

41. Europol. Takedown of notorious hacker marketplace selling your identity to criminals. 5 April 2023. Genesis Market.

42. US Department of Justice. Criminal Marketplace Disrupted in International Cyber Operation. 5 April 2023.

43. US Department of the Treasury. Treasury Sanctions Illicit Marketplace Genesis Market. JY1388, 5 April 2023.

44. Europol. Major data leak forum dismantled in global action against cybercrime forum. 4 March 2026. LeakBase.

45. US Department of Justice. United States Leads Dismantlement of One of the World's Largest Hacker Forums. March 2026.

46. Europol. Cybercriminal VPN used by ransomware actors dismantled in global crackdown. 21 May 2026. First VPN.

47. Europol. Law enforcement disrupt world's biggest ransomware operation. 20 February 2024. Operation Cronos, phase one.

48. UK National Crime Agency. International investigation disrupts the world's most harmful cyber crime group. 20 February 2024.

49. US Department of Justice. U.S. and U.K. Disrupt LockBit Ransomware Variant. 20 February 2024.

50. UK National Crime Agency. LockBit leader unmasked and sanctioned. 7 May 2024.

51. Europol. LockBit power cut: four new arrests and financial sanctions against affiliates. 1 October 2024.

52. Europol. Largest ever operation against botnets hits dropper malware ecosystem. 30 May 2024. Operation Endgame.

53. Europol. Operation ENDGAME strikes again: the ransomware kill chain broken at its source. 23 May 2025.

54. Europol. End of the game for cybercrime infrastructure: 1025 servers taken down. 13 November 2025.

55. Europol. Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks. 24 June 2026.

56. Europol. Law enforcement takes down two largest cybercrime forums in the world. 30 January 2025. Operation Talent.

57. US Department of Justice. Cracked and Nulled Marketplaces Disrupted in International Cyber Operation. 30 January 2025.

58. Europol. Key figures behind Phobos and 8Base ransomware arrested in international cybercrime crackdown. 11 February 2025.

59. US Department of Justice. Phobos Ransomware Affiliates Arrested in Coordinated International Disruption. 10 February 2025.

60. Europol. Europe-wide takedown hits longest-standing dark web drug market. 16 June 2025. Archetyp Market.

61. Europol. Key figure behind major Russian-speaking cybercrime forum targeted in Ukraine. 23 July 2025. XSS.

62. Europol. Global cybercrime crackdown: over 373 000 dark web sites shut down. 20 March 2026. Operation Alice.

63. Europol. Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site. 1 October 2026.

64. Europol. Global action against dark markets on Tor network. 7 November 2014. Operation Onymous.

65. Andy Greenberg. Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency. 15 November 2022.