Hansa covert takeover and shutdown
Verified core entry, last reviewed August 21, 2026
What was taken down?
Full covert takeover of the marketplace; servers seized in the Netherlands, Germany, and Lithuania; user credentials and transaction data collected; site replaced with seizure notice.[1][2][3]
See what happenedWhat happened to the people?
Officials reported 2 apprehended.
Group accounted for: Likely complete
Did it stay down?
Not established in the public record. No later activity is recorded against this entry.
See what happened afterwardDutch National Police covertly assumed control of Hansa Market under Dutch judicial authorization and operated it for approximately one month to collect intelligence on vendors and buyers before shutting it down.[1][2][3]
Announced July 20, 2017.
- Date
- June 20 to July 20, 2017
- Target
- Hansa Market, tor hidden service marketplace
- Activity
- Darknet market, Fraud and stolen data
- Operational lead
- Dutch National Police
- Partners
- Europol, Dutch Public Prosecution Service, and 1 more[1][2][3]
- European Union Agency for Law Enforcement Cooperation , coordinator
- Openbaar Ministerie (Netherlands Public Prosecution Service) , judicial cooperation
- Bitdefender , technical partner
- Jurisdiction
- Netherlands, Germany, Lithuania, and European Union
- Outcome
- Full covert takeover of the marketplace; servers seized in the Netherlands, Germany, and Lithuania; user credentials and transaction data collected; site replaced with seizure notice.
- Status
- Completed
- Legal mechanism
- Dutch judicial authorization for covert continuation of a criminal service; German arrest warrants
- Group accounted for
- Likely complete
Infrastructure
1 onion service taken over. Servers seized, with no count in the record.
- 1
- onion service taken over
| Identifier | Recorded as | Status | Notes |
|---|---|---|---|
| Not published | 1 onion service | Taken over, Netherlands | Marketplace covertly operated by Dutch police for approximately one month before shutdown.[2] |
| Not published | Server | Seized | Servers seized in the Netherlands, Germany, and Lithuania.[2] |
Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.
No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.
Group accounted for: Likely complete
Both publicly described administrators were arrested in Germany and the infrastructure was under police control. Names were not released by Dutch or German authorities.
Two German-national administrators publicly described as running the market.
Two German administrators prosecuted in Germany; follow-on vendor arrests in multiple countries.[1][2][3]
Not established in the public record. No later activity is recorded against this entry.
Return class F. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.
Numbered markers throughout this entry link to the source that supports the claim beside them.
Official sources
-
[1]
Massive blow to criminal dark web activities after globally coordinated operation
Joint AlphaBay and Hansa operation structure and coordination roles
-
[2]
Dutch National Police statement on the takeover and shutdown of Hansa Market
Covert takeover of Hansa, duration of covert operation, server seizures, administrator arrests
Additional reporting and technical analysis
-
[3]
Bitdefender account of technical support to Europol EC3 on Hansa
Technical partner role in locating the Hansa infrastructure
- This is one of the clearest documented cases of covert law-enforcement operation of a seized criminal service.
- Administrators were not publicly named, so no person records were created despite an official apprehension count of two.