what happened to whom, reported straight: takedowns, vanishing acts and orderly goodbyes across the hidden service scene.
Nucleus Market rose to second place in Agora's wake and went dark on 13 April 2016 with no statement and no seizure banner. Ten years on, the scam-versus-seizure question remains open, and its wallets sat still until 2025.
The darknet document trade sells two products: cheap generated ID images built for remote checks, and physical forged passports shipped by post. What open research says about prices, templates, KYC-driven demand and the operations against the workshops.
Ransomware brands advertise for affiliates on underground forums and Telegram with revenue splits, rules pages and vetting interviews. The recruitment spam that follows every takedown shows where the real scarcity lies: not in code, but in operators.
In May 2019, the darknet news site DeepDotWeb was seized and its two administrators were charged with laundering the bitcoin kickbacks the site earned for referring buyers to markets. Prihar pleaded guilty in March 2021 and was sentenced to more than eight years in January 2022, a case that drew a line between covering darknet markets and profiting from them.
What stolen card data, bank logins, ID scans and stealer logs list for in 2026, why these indexes measure asking prices rather than completed sales, and what pushes the numbers up or down.
Darknet markets ask sellers for a refundable deposit before the first listing goes up. The bond filters scam accounts and floats the operator's treasury - and it is only as refundable as the market itself.
Sheep Marketplace opened in March 2013 and announced its closure in late November 2013, blaming a vendor who stole 5,400 BTC. Users traced far larger sums across the blockchain, and the case became the template for every darknet exit scam since.
Raheim Hamilton, co-creator of the Empire Market darknet market, has been sentenced to 40 years in federal prison and ordered to forfeit approximately 1,230 BTC, valued at roughly $100 million, plus several Virginia properties. The market moved about $430 million in illegal transactions before its abrupt 2020 exit.
The third version of the German-language fraud forum Crimenetwork ended like its predecessors: with a seizure banner on its domain. The BKA's August action against c-network.to follows a May arrest on Mallorca and a March prison sentence, and fits a pattern in which every relaunch of the brand has collapsed faster than the last.
Two alleged leaders of the ShinyHunters data-theft and extortion group have been taken into custody weeks apart: a 24-year-old in the Netherlands and an 18-year-old detained in Jordan. Reports that the detainee in Jordan is cooperating with the FBI remain unverified.
Police in Greece, Romania, Spain and the United Kingdom seized the KillSec ransomware group's leak site and five servers on 30 September 2026 and arrested three suspects. Europol says the suspected administrator is a 16-year-old from Romania and links the group to around 1,000 attacks and an estimated EUR 4 million in damages.
Former NCA investigator Paul Chowles stole 50 bitcoins from a 2017 seizure that were then worth about GBP 60,000 and about GBP 4.4 million by sentencing. On 30 September 2026 he was ordered to repay GBP 1,810,678.93. The case is a study in insider risk within a seizure chain.
