By the summer of 2017, AlphaBay was the largest criminal marketplace in history. Ten times the size of Silk Road at its peak, it processed an estimated $800,000 in daily transactions: drugs, weapons, stolen card data, fake documents, exploit kits, and access credentials for compromised corporate networks. Over 200,000 users. 40,000 vendors. A waiting list for new registrations.
Its founder, Alexandre Cazes, was 26 years old and living in Bangkok, where he had accumulated a portfolio of luxury cars, hotel investments, and beachside properties. He was known to associates as Alpha02. In the forums, he was a respected figure - one of the administrators who had kept the market stable through multiple crises, including the chaos that followed Silk Road's closure. He was careful, his supporters believed.
He wasn't careful enough. And by the time the FBI finished what became known as Operation Bayonet, they wouldn't just take down AlphaBay - they would run its largest competitor for a month first.
//The Hotmail Address
The investigation into AlphaBay began, as many do, with something small. When new users registered on the site, they received a welcome email. When they forgot their password, they received a reset email. These were routine, automated messages sent at scale. The email address they came from was: [email protected].
Investigators subpoenaed Microsoft for information on that account. The registration information linked to a Canadian named Alexandre Cazes, born October 19, 1991 - matching the "91" in the address - who was listed as the president of a software company called EBX Technologies.
This single mistake - using a personal email account to send administrative correspondence for an anonymous criminal marketplace - gave law enforcement a name, a nationality, and a corporate registration. From there, financial records, property purchases, and immigration records built the full picture. Cazes had done almost nothing to separate his Alpha02 identity from his legal identity.
//The Hansa Gambit
While the FBI, DEA, and their international partners were building the case against Cazes, a parallel operation was quietly underway in the Netherlands. Hansa Market - then the second-largest dark web marketplace after AlphaBay - had come to the attention of Dutch police. In June 2017, they arrested Hansa's two administrators, a pair of German men who had been operating the site for years.
At this point, most law enforcement agencies would have seized the site and issued a press release. The Dutch National Police - working with Europol and in coordination with the FBI - did something different. They kept the arrests secret. They kept the site running. They became Hansa.
For the next month, Dutch police sat at the administrator consoles of Hansa Market, managing day-to-day operations, approving vendor applications, and processing customer disputes - exactly as the legitimate administrators had done. They logged every transaction. They harvested the personal details vendors entered when requesting payment. They collected shipping addresses from user messages. They gathered cryptocurrency addresses, IP addresses, and login patterns.
Then, on July 5, 2017, the FBI arrested Alexandre Cazes at his Bangkok home. Thai police, acting on a US warrant, approached while he was in the act of logging into his computer. His laptop was open - logged in as the AlphaBay administrator. Cazes was taken into custody. AlphaBay went dark.
//The Flood
The dark web community's reaction was immediate and predictable: AlphaBay is down, move to Hansa. Within 48 hours, Hansa's registration numbers had increased by a factor of eight. Users posted tutorials on migration. Vendors announced their new Hansa shops. The community that had scattered from Silk Road to AlphaBay now scattered from AlphaBay to Hansa. Except this time, the destination was already occupied by Dutch police.
Over the following weeks, investigators gathered data on approximately 10,000 new users who had registered on Hansa after AlphaBay's closure, along with thousands of vendors who had migrated their operations. They collected details on over 50,000 drug transaction shipping addresses. They documented cryptocurrency flows. They built dossiers.
Some investigators have described this phase as the most productive month in the history of dark web law enforcement. Every user who migrated to Hansa believing it was a safe harbour was walking into a monitored environment, providing evidence against themselves.
//The Final Takedown
On July 20, 2017 - exactly fifteen days after AlphaBay's closure - the Dutch police announced Hansa's seizure. The site was replaced with a seizure banner. The announcement included a detail calculated to maximize paranoia: the police had been in control of Hansa since June. Everything users had done in the past two months had been observed.
The psychological impact on the dark web community was significant. The standard playbook after a takedown - assume the replacement site is safer, migrate quickly, resume normal operations - had been exposed as a possible trap. If law enforcement could run Hansa, they could run anything. How would you know? How long had any given market been compromised?
This uncertainty was partially the point. The goal of Operation Bayonet was not just to seize two markets; it was to fundamentally undermine trust in the ecosystem. The operation's architects have described this "trust erosion" as a deliberate strategic objective, not a side effect.
//Alexandre Cazes
Cazes was held in a Thai detention facility while the US prepared extradition paperwork. On July 12, 2017 - seven days after his arrest - he was found dead in his cell. Thai authorities ruled it a suicide by hanging.
The circumstances were disputed. Cazes had reportedly requested a lawyer and was expecting to fight extradition. He was wealthy enough to have financed a lengthy legal battle. Conspiracy theories proliferated in dark web forums - allegations of CIA involvement, questions about whether the death was staged. No evidence supported any of this. The official finding was suicide. It has never been formally challenged.
At the time of his arrest, investigators found Cazes' laptop open and logged in to the AlphaBay admin panel. On it, in unencrypted text files, were the passwords to AlphaBay's servers and a detailed personal asset spreadsheet - listing every property, vehicle, and cryptocurrency holding. The spreadsheet alone contained enough information to seize approximately $23 million in cryptocurrency.
//What Came After
AlphaBay returned in 2021, relaunched by DeSnake, one of its original co-administrators who had evaded the 2017 takedown. The new version positioned itself around Monero rather than Bitcoin, specifically citing the traceability lessons of the original. It has operated since, though at a fraction of the original's scale.
The Hansa model - covert takeover of a criminal platform before public disclosure - has influenced subsequent operations. Law enforcement agencies have become more willing to operate compromised platforms for intelligence collection before seizure. The dark web community has responded by developing increasingly sophisticated warrant canaries, administrator authentication protocols, and decentralised market architectures designed to make covert takeover more difficult.
The arms race continues. But Operation Bayonet set the tempo.