Cartel-linked money couriers have funneled at least $5.5 million in stablecoins like USDT to Chinese fentanyl precursor suppliers, according to a March report from Chainalysis, which revealed what the firm dubbed an “on-chain fentanyl economy.” Established in 2018, J-CODE seeks to detect, disrupt, and dismantle the most prolific criminal enterprises that rely on the internet or advanced technology to facilitate the trafficking of opioids. McDonald directed and helped these accomplices package and ship the narcotics. An additional 30 kilograms of suspected counterfeit Adderall pills were seized on May 2, 2024, in New York. Additionally, two vehicles and several pieces of property were seized during the search warrants.
Auction House Sotheby's Finds Its Data On The Block After Cyberattack
In practice, no market in the past decade has survived indefinitely. When you buy or sell illegal goods online, you are not hidden from law enforcement, Europol’s director emphasized after a Dream Market bust. Modern darknet investigations rely on a mix of technology and teamwork. Some in the underground forums were fooled by fake posts from a released admin, a likely law enforcement ruse to sow confusion. With Archetyp offline announced by Europol on June 23, 2025, Europe lost one of its major fentanyl pipelines just as overdose deaths were surging. According to Europol, the operation froze about €7.8 million in assets.
More From The Los Angeles Times
Operation Deep Sentinel is the latest international law enforcement collaboration against cybercrime, shutting down Archetyp – one of the largest dark web drug marketplaces. “This arrest underscores the dedicated, ongoing efforts of law enforcement to identify and dismantle illicit drug networks operating from every shadowy recess of the marketplace,” said New York Police Department Commissioner Edward A. Caban. “As alleged, Rui-Siang Lin’s brazen operation resulted in the illicit sale of over $100 million in narcotics, including those that were mislabeled and later found to include deadly fentanyl. Europol said a large-scale operation saw it dismantle Archetyp Market, described as a “drug marketplace” that allowed, among other things, the sale of fentanyl, one of the most dangerous synthetic opioids out there. A massive international law enforcement operation has seen one of the longest-standing dark web marketplaces finally taken offline. The marketplace sold a variety of content, including drugs, stolen data, and counterfeit consumer goods, all using cryptocurrency.
From Silk Road To RapTor: The Evolution Of Darknet Markets
At the time of seizure, there was a total of 17,000 listings on the website sold by 3,200 vendors. They were however American vendors and consumers, as well as distributors from China and Mexico. It did not host other black market listings such as those for firearms or prostitution. The onion site and the clearnet site were both replaced with a seizure banner that links to the investigative operation's website. The server infrastructure was hosted in a data center in the Netherlands and was also seized.
- Incognito Market sold illegal narcotics and misbranded prescription medication, including, heroin, cocaine, LSD, MDMA, oxycodone, methamphetamines, ketamine and alprazolam.
- Simultaneously, Dutch police quietly took over Hansa Market, a Tor site popular in Europe in June 2017.
- The Monopoly Market takedown was one of the largest law enforcement actions taken against a darknet marketplace.
- In furtherance of Operation RapTor and in its first action as a JCODE member agency, the Office of Foreign Assets Control (OFAC) additionally sanctioned Iranian national Behrouz Parsarad for his role as the founder and operator of Nemesis Market following seizure of the market.
- Domains for Archetyp have since been replaced with a seizure notice, which indicates law enforcement groups across Europe, in addition to the FBI and US Homeland Security, participated in the investigation.
Best VPN Friendly Crypto Casinos & Gambling Sites: Top Picks
Building on the successes of prior years’ operations, Operation RapTOR furthered global efforts to dismantle darknet marketplaces, resulting in the seizure of darknet infrastructure from Nemesis, Tor2Door, Bohemia, and Kingdom Markets. The seizures, to which ICE Homeland Security Investigations significantly contributed, include more than $200 million in currency and digital assets, over two metric tons of drugs, comprised of 144 kilograms of fentanyl or fentanyl-laced narcotics, and over 180 firearms. In 2022, Abacus was used by 10% of the users on Western darknet markets. Archetyp Market, a site on the dark web that sold illegal drugs, has been shut down after police in Europe arrested its administrator. This also means that Operation Dark HunTor likely isn’t the final word on dark web arrests and that illicit marketplace vendors may have to proceed with a little more caution. When German police took down the dark web marketplace DarkMarket in January, they did more than shutter the largest underground online drug bazaar operating at that time.
Missing The Wider Landscape Of Digital Harms
Operation RapTor involves law enforcement actions taken by JCODE member agencies, including the DEA, FBI, FDA OCI, HSI, IRS-CI, and USPIS. McDonald purchased bulk quantities of fentanyl and cocaine and then directed others to complete hundreds of drug sales involving large quantities of both fentanyl and cocaine. McDonald recruited and hired accomplices to help package and ship the narcotics they sold on the darknet. While executing search warrants in New Jersey and New York, federal law enforcement officers seized more than $330,000, close to 80,000 counterfeit Adderall pills, one firearm, and two industrial pill press machines. Both defendants further admitted to distributing fentanyl-laced pills to two additional victims, both of whom suffered fatal drug overdoses shortly after they received the pills from Ta and Srinivasan. Srinivasan received virtual currency as payment for the drugs and then routed that virtual currency through cryptocurrency exchanges.
According to the indictment, financial transactions on Empire Market used cryptocurrency to conceal the nature of the transactions and the identities of Empire Market administrators, moderators, vendors, and buyers. The controlled substances sold by vendors on Empire Market included heroin, methamphetamine, cocaine, LSD, opioids, and others. According to the indictment, unnamed customers, including one who lived in Northern Illinois, placed multiple orders for counterfeit money.
Just as Incognito built on the playbook of its predecessors, future markets will learn from RapTor. They often sell across multiple markets or operate standalone storefronts via encrypted apps like Telegram and Signal. That extortion threat, combined with increased tracing and investigative pressure, led many users to flee the platform, dramatically reducing deposits and facilitating law enforcement’s final takedown. One particularly revealing moment came in February 2024, when Incognito users reported that BTC withdrawals were disabled—likely part of a deliberate “exit scam.” Lin, or others acting on his behalf, threatened to leak vendor identities to law enforcement unless paid. While Monero obscures transaction details, Bitcoin’s traceable blockchain provided law enforcement with critical leads, particularly at the point of off-ramp—when vendors converted crypto into fiat or moved assets through centralized exchanges.
Financial Markets, Financial Institutions, And Fiscal Service
Unlike overt seizures, Dream’s shutdown was an exit by administrators, a pattern sometimes seen when market owners bail out. Dozens of Dream Market drug dealers were nabbed e.g. a U.S. heroin syndicate. This announcement coincided with Operation SaboTor, a multinational effort targeting opioid vendors. It specialized in narcotics, stolen data credit cards, credentials and contraband. As Europol’s Rob Wainwright noted, users flocked to Hansa expecting refuge, only to be swept up in a trap.
- The Federal Criminal Police Office in Germany (BKA) and the Frankfurt cybercrime combating unit (ZIT) conducted the action on Wednesday, March 20, 2024, with law enforcement taking down the website and confiscating approximately $100,000 in cash.
- The other emerging issue is that current policing efforts treat dark web markets as the core threat, which might miss the wider landscape of digital harms.
- These black markets have unveiled what Elliptic describes as a “China-based underground banking system” built around stablecoins and crypto payments, which is being used for money laundering on a large scale.
- Operation Bayonet was the 2017 joint law enforcement effort that took down AlphaBay and Hansa.
- “The FDA is committed to continuing its work to disrupt and dismantle the illegal sales of drugs on the dark web, where such sales far too often have tragic consequences,” said Deputy Director Chad Menster of the Food and Drug Administration’s Office of Criminal Investigations (FDA OCI).
Malicious Infrastructure Finds Stability With Aurologic GmbH
“Our coalition of law enforcement authorities across three continents proves that we all do better when we work together,” Europol’s executive director, Catherine De Bolle, said in a statement. The largest number of arrests — 153 — were made in the United States, followed by the United Kingdom with 55 and Germany with 52, according to the European Union law enforcement agency Europol, which coordinated the worldwide operation. For the first time, FBI agents from all the bureau’s field offices also visited buyers to tell them about the overdose danger of pills sold online, which are often disguised to look like prescription drugs.
German Police On A Roll
Five defendants were arrested today on a 10-count federal superseding indictment alleging their participation in a multimillion-dollar drug trafficking organization (DTO) that used luxury private shipping companies to ship via… In addition to Wednesday’s arrests, agents served multiple federal search warrants and found evidence to include large amounts of cash, distribution amounts of suspected drugs. An example of vendor JoyInc on the Drughub marketplace selling ketamine, MDMA, and bulk options of cocaine on September 4, 2024, is depicted below. The defendants fulfilled drug orders through the various vendor accounts by packaging the drugs into parcels and by delivering those parcels to post offices and mailboxes in Los Angeles County and elsewhere.
As large platforms face disruption from law enforcement action, dark web infighting, and an influx of users from Telegram, there’s a growing shift toward smaller, more specialized marketplaces. A smart play in the operation involved using intelligence gathered from previous darknet marketplace shutdowns. The operation targeted Archetyp Market, a platform with over 600,000 users and transactions totaling at least 250 million euros, underscoring the scale and ongoing challenge of illicit drug sales facilitated by anonymizing technologies. Authorities from multiple countries, including Germany, the Netherlands, Spain, Sweden and the United States, worked together to investigate and take down a major online criminal marketplace, demonstrating the need for cross-border efforts to combat cyber-enabled crime. Europol also said the market allowed the sale of fentanyl and “other highly potent synthetic opioids.”Authorities seized the site’s online infrastructure, which was hosted in the Netherlands, and arrested its 30-year-old German administrator in Barcelona, Spain.
Major Police Operation Takes Down Notorious Dark Web Marketplace Archetyp Market
The US Department of Justice announced the results of a darknet market bust. Leading up to the operation announced Tuesday, German and U.S. authorities took down the “ Hydra ” dark web market in April last year. “As law enforcement authorities gained access to the vendors’ extensive buyer lists, thousands of customers across the globe are now at risk of prosecution as well.”
By 2025, agencies also use dark web search Engines and honeypots to infiltrate markets. It’s a big blow to the criminal ecosystem that will take a long time to recover from.” If Telegram maintains its crackdown, he suggests the market operators might migrate to other messaging services with less oversight or even to decentralized platforms where they can’t be effectively banned. According to Robinson, Tudou Guarantee has seen “a major surge in new users” following the Haowang shutdown. FinCEN listed Huione Group, the parent company of Haowang Guarantee, as a money laundering operation that would be cut off from the US banking system.
The Monopoly Market takedown was one of the largest law enforcement actions taken against a darknet marketplace. Archetyp had more than 17,000 listings at the time of its takedown from around 3,200 registered vendors, and was one of the few marketplaces of its kind that allowed the sale of fentanyl. As Pharoah — the leader of Incognito market — Lin supervised all of its operations, including its employees, vendors and customers, and had ultimate decision-making authority over every aspect of the multimillion-dollar operation. Shortly after the recent seizures of other markets, the accounts of a number of Dream Market vendors came under the control of Dutch law enforcement. Following the seizures and shutdowns of the AlphaBay and Hansa markets in July 2017 as part of Operation Bayonet, there was much speculation that Dream Market would become the predominant darknet marketplace.
In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. The agency did not detail what these “measures” were, but added that it seized $9 million in assets. A 30-year-old German national was found in Barcelona, Spain, and arrested. Archetyp Market operated for more than five years, numbering more than 600,000 users, and amassing a total transaction volume of more than $280 million. In a post to the market's news page, staff later confirmed that a hard drive loss caused the issue and promised to refund the lost funds.
