A marketplace disappears, but the demand that sustained it does not necessarily disappear with it. In July 2017, users and vendors leaving AlphaBay moved towards Hansa, another dark-web marketplace. The FBI’s account describes that movement as part of a story involving two coordinated investigations. The relationship between these cases is documented; it is not a connection inferred simply because both involved online crime.
AlphaBay had operated for more than two years when the US Justice Department announced its seizure on 20 July 2017. Authorities described a marketplace carrying illegal drugs alongside stolen identity material, malicious software and other prohibited goods and services. Its importance lay partly in bringing different types of illicit trade onto the same platform. A single marketplace could sit at the intersection of several crime categories.
The operation crossed national boundaries. The Justice Department named cooperation involving Thailand, the Netherlands, Lithuania, Canada, the United Kingdom and France, alongside Europol. On 5 July, Thai authorities arrested Alexandre Cazes, whom US prosecutors accused of creating and administering AlphaBay. The department reported that he died in custody on 12 July. Its announcement describes charges, not a conviction; this account does not turn those allegations into a trial verdict.
Meanwhile, Dutch investigators were pursuing Hansa. The FBI reported that AlphaBay users and vendors flocked there after the shutdown. That movement is the hinge of the story: taking one platform offline can change where activity happens, rather than immediately ending the activity itself. Here, the second marketplace was already the subject of a coordinated law-enforcement effort.
The FBI described months of preparation and an information-sharing command post hosted by Europol. These details matter because the visible moment—a website becoming unavailable—is only one part of a wider investigation. Coordinating agencies, evidence and action across jurisdictions was central to the operation described in the official accounts.
This historical case illustrates a distinction worth carrying into newer crime stories. Two operations may be demonstrably linked by coordination and movement between platforms. Two unrelated cases may merely share a method. Both comparisons can help readers understand events, but only the first establishes an operational connection. The reading trail below makes that distinction explicit. This is a retrospective based on the linked 2017 announcements, not a claim about today’s dark-web markets or the outcome of every subsequent prosecution.