AlphaBay Market — Operation Bayonet 2017 Takedown
Historical profile of AlphaBay darknet market, seized in July 2017 via Operation Bayonet. Covers Alexandre Cazes, 250,000 listings, and the Hansa honeypot.
AlphaBay was the largest darknet market in the world when law enforcement shut it down in July 2017. At its peak it listed over 250,000 product offerings — roughly ten times the count Silk Road carried at its height. Its founder, Alexandre Cazes, was arrested in Bangkok on July 5, 2017, and died in a Thai detention cell four days later in what officials ruled a suicide.
Key Facts
| Detail | Value |
|---|---|
| Launch | December 2014 |
| Closure | July 5, 2017 |
| Cause | Operation Bayonet — FBI, DEA, Dutch National Police, Europol |
| Operator | Alexandre Cazes ("Alpha02") |
| Payments | Bitcoin (BTC), Monero (XMR), Ethereum (ETH) |
| Peak listings | 250,000+ |
| Assets seized | ~$8.8M across cryptocurrency wallets and property |
How AlphaBay Operated
AlphaBay launched in December 2014, filling the void left by Silk Road's October 2013 seizure and the subsequent collapse of Silk Road 2.0 in November 2014. It grew aggressively by absorbing displaced vendors and buyers from every successive market closure.
Several features distinguished it from earlier markets. AlphaBay was one of the first major darknet markets to accept Monero alongside Bitcoin, giving vendors and buyers an alternative with stronger on-chain privacy guarantees. It also accepted Ethereum at various points. This multi-currency approach was later copied across the industry.
The market ran an integrated forum alongside the marketplace itself — a design that built community retention and gave administrators a communication channel to users during outages. Vendor verification and bonding requirements added a barrier to entry for scam accounts. By 2016, it had reportedly processed over $600,000 in transactions daily.
Cazes, a Canadian national operating under the handle "Alpha02," maintained a high operational profile within darknet communities and publicly claimed credit for the market's growth and stability.
Operation Bayonet
Operation Bayonet was a coordinated international law enforcement action involving the FBI, DEA, Dutch National Police, and Europol. The investigation ran in parallel on two continents, targeting AlphaBay's server infrastructure and its operator simultaneously.
Investigators identified Cazes through a single operational security error: AlphaBay's welcome emails — automated messages sent to new users — contained Cazes's personal Gmail address ([email protected]) in the email headers. This was a legacy configuration artifact that had never been cleaned. The address led directly to his real identity and his extensive legitimate business holdings, including several properties in Thailand.
Thai authorities, working with the FBI, arrested Cazes at his Bangkok residence on July 5, 2017. The AlphaBay servers were located in Lithuania and seized the same day. The site went offline without warning.
For a detailed comparison of how similar law enforcement operations used the same investigative pattern, see our dedicated guide.
Cazes's Death and Its Aftermath
On July 12, 2017 — four days after his arrest — Alexandre Cazes was found dead in his cell at a detention facility in Bangkok. Thai officials ruled his death a suicide. He was 25 years old.
The U.S. Department of Justice simultaneously seized approximately $8.8 million in assets — properties in Thailand, Cyprus, and Antigua, along with cryptocurrency wallets holding BTC, ETH, and XMR.
The AlphaBay takedown was deliberately coordinated with a separate Dutch operation against Hansa Market. Dutch National Police had seized Hansa's servers weeks earlier — on June 20, 2017 — but kept the market running covertly for 27 days, collecting vendor credentials, buyer addresses, and transaction data. When AlphaBay went dark and the darknet community flooded to Hansa as a replacement, the Dutch operation captured the surge of new users before publicly announcing the seizure on July 20, 2017.
This double operation — shutting AlphaBay while running Hansa as a honeypot — was one of the more consequential law enforcement tactics in darknet market history, generating prosecution leads across multiple countries.
Legacy
Dream Market briefly became the dominant English-language market following the AlphaBay/Hansa collapse, absorbing the displaced user base. It lasted until March 2019.
The Hansa honeypot tactic established that law enforcement was willing and able to operate darknet markets as investigative tools — a development that fundamentally changed how security-conscious vendors evaluated market trustworthiness.
AlphaBay relaunched in 2021, operated by "DeSnake," the surviving co-administrator. That relaunch is outside the scope of this historical profile but is noted for research completeness. The original AlphaBay, shut down by Operation Bayonet, is the subject of this page.
See the market takedowns timeline for AlphaBay's position in the broader sequence of major seizures.
Frequently Asked Questions
What was Operation Bayonet?
Operation Bayonet was the FBI/DEA-led international operation that shut down AlphaBay on July 5, 2017. It ran in coordination with Dutch National Police, who simultaneously operated Hansa Market as a covert honeypot for 27 days before announcing its seizure.
Who ran AlphaBay?
Alexandre Cazes, a 25-year-old Canadian citizen, founded and operated AlphaBay under the alias "Alpha02." He was arrested in Bangkok on July 5, 2017, and died in detention four days later.
How did the FBI identify AlphaBay's operator?
AlphaBay's automated welcome emails contained Cazes's personal email address in their headers — a configuration error that had never been corrected. This email address linked directly to his real identity and business records.
What was Hansa Market's connection to AlphaBay?
Hansa was a separate darknet market whose servers Dutch National Police had secretly seized on June 20, 2017 — two weeks before AlphaBay went down. Police operated Hansa covertly during that period and through the post-AlphaBay user surge, collecting data on vendors and buyers before publicly announcing the seizure on July 20, 2017.