Short answer: Between October 2013 and June 2025, every major darknet market ended in one of four ways: seizure, covert control, an exit by its own operators, or mass arrests built on previously seized data. This page is the factual chronology of those endings — dates, lead agencies, jurisdictions, and primary sources. It is not a history of the Tor network itself, which has never been “taken down”: every action below targeted a single hidden service running on top of it. For the network’s technical history, see History of the Tor network.
How to read this timeline
Each entry records four things:
- Date — when enforcement acted or went public, not when the investigation began. Investigations typically ran one to three years before any announcement.
- Agency and jurisdiction — who led and who supported. Every case after 2014 was transnational.
- Ending type — seizure (infrastructure taken, usually with a banner and a press release), covert control (police secretly operated the market before announcing), exit (operators disappeared with escrowed funds and no agency claimed a takedown), or coordinated arrests (data from an earlier seizure seeded arrests of vendors and buyers across countries).
- Primary source — the official press release. Figures such as user counts are the announcing agency’s claims at announcement time, not independent measurements.
One market can end twice. Wall Street Market’s operators attempted an exit scam while police were already closing in; Incognito’s operator exit-scammed and was arrested two months later.
The chronology
| Date | Market (operation) | Lead agency (jurisdiction) | Ending type |
|---|---|---|---|
| Oct 2013 | Silk Road | FBI / SDNY (US) | Seizure + arrest |
| Nov 2014 | Silk Road 2.0 — Operation Onymous | FBI, HSI / Europol EC3 (US + ~16 states) | Coordinated seizures |
| Jul 2017 | AlphaBay + Hansa — Operation Bayonet | FBI, DEA (US) + Dutch National Police (NL) | Seizure + covert control |
| May 2019 | Wall Street Market + Valhalla | BKA (DE) + Finnish Customs (FI) | Seizure + arrests, after exit attempt |
| Jan 2021 | DarkMarket | Koblenz prosecutors, BKA (DE) | Seizure + arrest |
| Apr 2022 | Hydra | BKA, ZIT Frankfurt (DE) | Seizure |
| May 2023 | Monopoly — Operation SpecTor | DOJ JCODE (US) + Europol, 9 states | Coordinated arrests |
| Mar 2024 | Nemesis | BKA, ZIT Frankfurt (DE) | Seizure |
| Mar–May 2024 | Incognito | HSI / SDNY (US) | Exit, then arrest |
| Jun–Jul 2025 | Archetyp — Deep Sentinel; Abacus | Eurojust, Europol (5 EU states + US) | Seizure + arrests; silence |
October 2013 — Silk Road
FBI agents arrested Ross Ulbricht in a San Francisco public library on October 1, 2013; the site was seized the same week under a civil forfeiture complaint filed in Manhattan federal court. Court papers put two and a half years of turnover above $1 billion, and the government ultimately seized roughly 174,000 bitcoins from the server and Ulbricht’s hardware. The case established the template: locate the server, identify the operator through ordinary investigative errors, replace the site with a banner. Ulbricht was sentenced to life in 2015 and pardoned in January 2025. Full assessment: Silk Road.
November 2014 — Silk Road 2.0 and Operation Onymous
Silk Road 2.0 launched five weeks after the original fell and, by FBI figures, reached about 150,000 active users and $8 million in monthly sales by September 2014. On November 5, 2014, the FBI arrested its operator Blake Benthall (“Defcon”) in San Francisco — an undercover Homeland Security Investigations agent had infiltrated the site’s support staff. The same week, agencies from roughly 16 countries working through Europol’s EC3 and Eurojust seized dozens of additional dark-market sites in Operation Onymous, then the largest action against Tor hidden services to date.
July 2017 — AlphaBay and Hansa, Operation Bayonet
AlphaBay, then the largest market ever run (per the Justice Department: over 200,000 users, 40,000 vendors, roughly 250,000 drug listings), went offline on July 4, 2017; its founder Alexandre Cazes was arrested in Thailand on July 5 and found dead in his Bangkok cell on July 12. The second move stayed secret for weeks: Dutch police had arrested Hansa’s two administrators and covertly operated the smaller market themselves from June 20, logging an eight-fold surge in registrations as AlphaBay refugees arrived. Both takedowns were announced together on July 20, 2017. Full narrative: AlphaBay and Hansa.
May 2019 — Wall Street Market and Valhalla
Wall Street Market, then the world’s second-largest market with 1.15 million customer accounts and 5,400 vendors, began unraveling in mid-April 2019 when vendors lost access to escrowed funds — an exit attempt by its administrators, executed as German investigators closed in. The BKA arrested the three German administrators on April 23–24 and seized the infrastructure; Finnish Customs had separately seized Valhalla (Silkkitie), one of the oldest Tor markets, earlier that year in cooperation with French police. Europol announced both on May 3, 2019, alongside over €550,000 in cash and six-figure cryptocurrency seizures; two high-volume vendors were arrested in the US.
January 2021 — DarkMarket
The cybercrime unit of the Koblenz Public Prosecutor’s Office, supported by the BKA, located DarkMarket’s infrastructure and arrested a 34-year-old Australian, the alleged operator, near the German-Danish border over the weekend of January 9–10, 2021. More than 20 servers in Moldova and Ukraine were switched off. Announcing the takedown on January 12, Europol put the market at almost 500,000 users, over 2,400 vendors, and 320,000 transactions moving more than 4,650 bitcoins (about €140 million at the time).
April 2022 — Hydra
The BKA and Frankfurt’s ZIT seized Hydra’s Germany-hosted servers on April 5, 2022, along with 543 bitcoins worth about €23 million, after an investigation running since August 2021 with US agencies. Hydra was likely the highest-revenue market ever operated: the BKA put its 2020 turnover at €1.23 billion, with 17 million customer accounts and 19,000 vendor accounts. No arrests were announced that day. Full profile: Hydra Market.
May 2023 — Monopoly and Operation SpecTor
German authorities had quietly taken Monopoly Market’s criminal infrastructure down in 2021; the seized data, including vendors’ buyer lists, became what Europol called the basis for hundreds of national investigations. On May 2, 2023, the Justice Department’s JCODE team and Europol announced the harvest: 288 arrests across nine countries, $53.4 million in cash and virtual currencies, 850 kilograms of drugs including 64 kilograms of fentanyl, and 117 firearms — the most arrests of any JCODE operation to that point. SpecTor is the clearest example of the data-driven model: the market died in 2021, and the coordinated arrests came some 17 months later.
March 2024 — Nemesis
On March 20, 2024, the BKA and ZIT Frankfurt secured Nemesis Market’s server infrastructure in Germany and Lithuania and closed the site, seizing about €94,000 in cryptocurrency; the action was announced on March 21. Nemesis, founded in 2021, had grown to over 150,000 user and 1,100 seller accounts, with nearly a fifth of sellers in Germany. The investigation had run since October 2022 with the FBI, DEA, and IRS-CI. No operator arrests were announced — the seized data was preserved for follow-on cases, the SpecTor pattern repeated.
March–May 2024 — Incognito
Incognito’s ending unfolded in two acts. In March 2024 its operator shut the market down, kept vendor and customer funds, and threatened to publish users’ transaction histories unless they paid — an exit scam with an extortion coda. On May 18, 2024, Homeland Security Investigations arrested Rui-Siang Lin (“Pharaoh”), a 23-year-old Taiwanese national, at JFK Airport; SDNY prosecutors charged him with running a market that had facilitated over $100 million in narcotics sales since October 2020. In February 2026, Lin was sentenced to 30 years in federal prison. Catalog entry: Incognito.
June–July 2025 — Archetyp (Operation Deep Sentinel) and the Abacus silence
Between June 11 and 13, 2025, around 300 officers across Germany, the Netherlands, Romania, Spain, and Sweden executed coordinated actions against Archetyp, with Europol and Eurojust coordinating and US authorities supporting. Per the Eurojust press release of June 16: the alleged administrator, a 30-year-old German national, was arrested in Barcelona; eight arrests in total; €7.8 million in assets seized; the Netherlands-hosted infrastructure taken offline. Eurojust put the market at roughly 3,200 vendors, more than 600,000 users, and at least €250 million in Monero transactions since its May 2020 launch. There was no covert phase — the site went to a seizure banner and stayed there.
Editorial note: TorBible’s market catalog now lists Archetyp as a Seized historical row, aligned with the Eurojust and Europol announcements. This timeline records what those agencies announced; the catalog status matches that official account.
Days after Archetyp fell, Abacus — then the largest Western market — began stalling withdrawals; its administrator blamed an influx of Archetyp refugees and a DDoS attack. TRM Labs tracked daily deposits collapsing from about $230,000 to roughly $13,000, and in early July all Abacus infrastructure, including its clearnet mirror, went offline. No seizure banner ever appeared, and as of this writing no agency has claimed a takedown; TRM Labs assesses a likely exit scam while noting a covert seizure cannot be ruled out. Full narrative: Archetyp and Abacus 2025.
Patterns: how markets actually end
Seizure is the default. Most entries above follow one mechanics: locate the servers (repeatedly in Germany or the Netherlands), seize them, post a banner, issue a press release. Hosting inside an EU jurisdiction has consistently proven reachable regardless of where operators lived.
Covert control is rare but decisive. Hansa in 2017 is the canonical honeypot: police ran the market for weeks and harvested addresses and credentials from arriving refugees. Monopoly’s 2021 infrastructure seizure quietly seeded the 2023 SpecTor arrests. The value of a market to investigators is its data — order histories, delivery addresses, escrow wallets — which is why the arrests so often lag the takedown by months or years.
Exits outnumber announcements. For every publicized seizure there are unpublicized disappearances — Empire in 2020, Abacus in 2025. The signature is stable: withdrawal delays, official assurances, then silence. A missing seizure banner is the classic sign that no takedown occurred — but it is not proof, since banners have in other cases appeared months late.
The migration window is the most dangerous moment. Bayonet proved that users fleeing a fallen market can land where police already wait. The same scramble followed Dream, Empire, and the Archetyp–Abacus sequence of 2025.
Limits of this record
- Announcements, not investigations. This timeline can only record what agencies chose to publish. Covert phases surfaced weeks later (Hansa) or years later (Monopoly); some may never surface.
- Agency figures. User accounts, vendor counts, and turnover are the announcing agency’s claims at announcement time. Registered accounts are not active users.
- Indeterminate endings. Abacus has no confirmed ending as of this writing. Where the record is ambiguous, this page says so rather than resolving it.
- Selection. The list covers the largest Western markets plus Hydra; hundreds of smaller shops ended unrecorded, and forum or vendor-shop takedowns are out of scope.
- The network is not on this list. No action has ever taken down Tor itself; each case targeted one hidden service. The market catalog tracks the living; this page is the record of the dead.
Sources
Silk Road (2013)
- DOJ / Manhattan U.S. Attorney — Silk Road seizure and Ulbricht arrest (October 2013)
- Reuters — FBI shuts alleged online drug marketplace, Silk Road
Operation Onymous (2014)
- DOJ / Manhattan U.S. Attorney — Operator of Silk Road 2.0 charged (November 6, 2014)
- DOJ / Manhattan U.S. Attorney — Dozens of online dark markets seized (November 7, 2014)
Operation Bayonet (2017)
Wall Street Market / Valhalla (2019)
- Europol — Double blow to dark web marketplaces (May 3, 2019)
- DEA — Global investigation leads to arrest of 3 German nationals (May 3, 2019)
DarkMarket (2021)
Hydra (2022)
Operation SpecTor (2023)
- DOJ — Largest international operation against darknet trafficking of fentanyl and opioids (May 2, 2023)
- FBI — Operation SpecTor targets darknet markets
- Reuters — U.S. announces 288 arrests in sweep (May 2, 2023)
Nemesis (2024)
- BKA — Illegaler Darknet-Marktplatz “Nemesis Market” abgeschaltet (March 21, 2024)
- AP — German authorities shut down online marketplace (March 2024)
Incognito (2024)
- ICE — Incognito Market owner arrested (May 2024)
- DOJ / SDNY — Incognito Market owner sentenced to 30 years (February 2026)
Archetyp / Abacus (2025)