Operation Bayonet
Operation NameOperation Bayonet
TypeDrug Enforcement
Roster
Executed byCanada, Germany, Lithuania, Netherlands, Thailand, United States
# of Countries Participated7+
Mission
TargetDark Markets: Alpha Bay Onion Service and Hansa Onion Service
Timeline
Date begin2016?
Date end2017?
Results
Accounting

Operation Bayonet was a multinational law enforcement operation culminating in 2017 targeting the AlphaBay and Hansa darknet markets.[1][2][3] Many other darknet markets were also shut down.[4]

Methodology

Investigators from several law enforcement agencies including the FBI, DEA, and Europol located Canadian Alexandre Cazes, the alleged founder of AlphaBay, due to a series of operational security errors:

AlphaBay target

Law enforcement took at least one month to obtain a US warrant, then over one month to obtain foreign warrants, prepare for and execute searches and seizures in Canada and Thailand:[5]

Hansa target

Hansa Investigation

Dutch police discovered the true location of the Hansa onion service after a 2016 tip from security researchers who had discovered a development version.[15] The police quickly began monitoring all actions on the site, and discovered that the administrators had left behind old IRC chat logs including their full names and even a home address, and they began to monitor them. Although the administrators soon moved the site to another unknown host, they got another break in April 2017 by tracing bitcoin transactions, which allowed them to identify the new hosting company, in Lithuania.

Hansa Seizure

On June 20, 2017, German police arrested the administrators (two German men) and the Dutch police were able to take complete control of the Hansa site and to impersonate the administrators. Their plan, in coordination with the FBI, was to absorb users coming over from the upcoming AlphaBay website shutdown. The following changes were made to the Hansa website to learn about careless users:

Service Shutdowns

Per the plan, AlphaBay was shut down on July 4, 2017, and as expected a flood of users substituted to the Hansa marketplace, until its subsequent shutdown on July 19/20 2017. During this time, law enforcement allowed the Hansa userbase (then growing rapidly from 1000 to 8000 vendors per day[18]) to make 27000 illegal transactions in order to collect evidence for future prosecution of users.[15][19] Dutch local cybercrime prosecutor Martijn Egberts claimed to have obtained around 10,000 addresses of Hansa buyers outside of the Netherlands.[20]

After the shut down of Hansa, the site displayed a seizure notice and directed users to the Operation's onion service[21] to find more information about the operation.

Participating law enforcement agencies

Most of the involved countries are part of the Virtual Global Taskforce (VGT), however additional law enforcement agencies played a role.

List

See also

References

  1. ^ McMillan, Robert; Viswanatha, Aruna (13 July 2017). "Illegal-Goods Website AlphaBay Shut Following Law-Enforcement Action". Wall Street Journal. Retrieved 11 March 2018.
  2. ^ Statt, Nick (14 July 2017). "Dark Web drug marketplace AlphaBay was shut down by law enforcement". The Verge. Retrieved 11 March 2018.
  3. ^ Greenberg, Andy (20 July 2017). "Global Police Spring a Trap on Thousands of Dark Web Users". WIRED. Retrieved 3 March 2018.
  4. ^ "Massive blow to criminal Dark Web activities after globally coordinated operation". 20 July 2017. Retrieved 20 July 2017.
  5. ^ a b c d e f g h i j k l m n "Forfeiture Complaint". Justice.gov. 20 July 2017. p. 27. Archived from the original on 23 September 2020. Retrieved 23 July 2017.
  6. ^ Cox, Joseph (July 20, 2017). "Alleged Dark Web Kingpin Doxed Himself With His Personal Hotmail Address". Vice. Vice Media. Archived from the original on November 9, 2020.
  7. ^ McCarthy, Kieren (July 20, 2017). "Alphabay shutdown: Bad boys, bad boys, what you gonna do? Not use your Hotmail..." The Register. Situation Publishing. Archived from the original on July 20, 2017.
  8. ^ a b c "Dead Canadian fugitive lived in Thai luxury". Bangkok Post. July 14, 2017. Archived from the original on July 14, 2023. Retrieved October 15, 2021.
  9. ^ Ngamkham, Wassayos (July 12, 2017). "Canadian drug suspect found hanged in cell". Bangkok Post. Archived from the original on July 14, 2023. Retrieved October 15, 2021.
  10. ^ "RCMP's 'Dark Web' investigation leads to searches in Montreal, Trois-Rivières". Montreal Gazette. Postmedia Network. July 5, 2017. Archived from the original on July 5, 2017.
  11. ^ Swenson, Kyle (July 18, 2017). "Suspected AlphaBay founder dies in Bangkok jail after shutdown of online black market". The Washington Post. Archived from the original on July 20, 2017.
  12. ^ "Thailand seizes $21 million in assets from dead founder of dark net marketplace AlphaBay". Reuters. Thomson Reuters. July 24, 2017. Archived from the original on June 9, 2018.
  13. ^ "Sessions on dark web Alphabay and Hansa shut down". BBC News. BBC. July 20, 2017. Archived from the original on July 23, 2017.
  14. ^ "9 nations join probe into 'darknet' site". Bangkok Post. July 24, 2017. Archived from the original on July 14, 2023. Retrieved July 24, 2017. NSB poised to pounce on more suspects
  15. ^ a b c d e f g h "Operation Bayonet: Inside the Sting That Hijacked an Entire Dark Web Drug Market". Wired. 2018-03-08.
  16. ^ Cox, Joseph (August 25, 2017). "This Is How Cops Trick Dark-Web Criminals Into Unmasking Themselves". The Daily Beast.
  17. ^ pxx51092 (July 25, 2017). "DON'T open the xlsx locktime file, beacon image confirmed in it with Hansa's server IP address". reddit. Archived from the original on October 9, 2017.((cite news)): CS1 maint: numeric names: authors list (link)
  18. ^ "Underground Hansa Market taken over and shut down". Politie (Dutch Police). 20 July 2017. Archived from the original on 21 July 2017. Retrieved 21 July 2017.
  19. ^ Riggs, Mike (2017-07-26). "Five Lessons from the Hansa and AlphaBay Busts". Reason Hit&Run. Retrieved 2017-07-26.
  20. ^ Satter, Raphael; Bajak, Frank (2017-07-21). "Dutch 'darknet' drug marketplace shut down". Portland Press Herald. Retrieved 2017-07-22.
  21. ^ DeepDotWeb (31 October 2016). "Dutch National Prosecution Service and police launch Hidden Service in global Darknet enforcement operation". Archived from the original on 1 November 2016. Retrieved 26 July 2017.
Categories