Short answer: AlphaBay was the largest darknet market of its era when the FBI and DEA took it offline in July 2017. What made Operation Bayonet historic was the second move: Dutch police had secretly controlled the smaller Hansa market for weeks and watched AlphaBay refugees arrive — with their passwords and addresses.
AlphaBay at its peak
AlphaBay launched in late 2014, a year after Silk Road fell, and grew far larger than its predecessor. At the July 2017 takedown, US authorities described it as the largest criminal marketplace on the internet at the time: by Justice Department figures, over 200,000 users, 40,000 vendors, roughly 250,000 listings for illegal drugs, and another 100,000 for stolen identities, malware, and fraud tools.
Its founder, Alexandre Cazes — a 25-year-old Canadian living in Thailand — was arrested on July 5, 2017. Investigators said a string of operational security errors, including a personal email address in welcome messages, led them to him. On July 12, Cazes was found dead in his Bangkok cell; Thai authorities ruled it a suicide. The US case against him ended there, which is one reason the AlphaBay file is taught as an OPSEC failure story rather than a courtroom one.
The Hansa trap
The second half of the operation stayed secret for weeks. Dutch police, tipped off by security researchers in 2016, had located Hansa’s servers, arrested its two German administrators, and on June 20, 2017 quietly took over the site — running it as a honeypot with the operators’ own infrastructure.
When AlphaBay went dark on July 4, users did exactly what the planners expected: they fled to Hansa. Europol reported an eight-fold increase in new Hansa registrations in the days after. Police logged messages, delivery addresses, and credentials; Dutch prosecutors said they obtained around 10,000 addresses of buyers outside the Netherlands. On July 20, 2017, both takedowns were announced together.
Why Bayonet still matters
- Migration is the most dangerous moment. Every later collapse — Dream, Empire, Abacus — triggered the same scramble, and Bayonet proved the destination can already be compromised.
- Escrow balances are evidence. Seized escrow wallets and order histories became prosecution material years later.
- A brand can outlive its operators. An “AlphaBay 2.0” appeared in 2021 under a former moderator’s handle; whether or not the claim was genuine, revivals trade on a name whose original ended in a cell. Any market wearing the AlphaBay or Hansa name today is a clone.
See also the takedown timeline and the market catalog for how later shops inherited this history.