[Back to the takedown index](https://takedownindex.org/takedowns) [Operation Bayonet](https://takedownindex.org/takedowns/operation-bayonet) # Hansa covert takeover and shutdown June 2017, Darknet market Led by [Politie (Netherlands National Police)](https://takedownindex.org/organizations/politie-netherlands-national-police) Verified core entry, last reviewed August 21, 2026 What was taken down? Full covert takeover of the marketplace; servers seized in the Netherlands, Germany, and Lithuania; user credentials and transaction data collected; site replaced with seizure notice.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) [See what happened](#what-happened) What happened to the people? Officials reported 2 apprehended. Group accounted for: Likely complete [See people and accountability](#people) Did it stay down? Not established in the public record. No later activity is recorded against this entry. [See what happened afterward](#afterward) ## What happened Dutch National Police covertly assumed control of Hansa Market under Dutch judicial authorization and operated it for approximately one month to collect intelligence on vendors and buyers before shutting it down.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) Announced July 20, 2017. **Date:** June 20 to July 20, 2017 **Target:** Hansa Market, tor hidden service marketplace **Activity:** Darknet market, Fraud and stolen data **Operational lead:** Dutch National Police **Partners** Europol, Dutch Public Prosecution Service, and 1 more[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) - [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), coordinator - [Openbaar Ministerie (Netherlands Public Prosecution Service)](https://takedownindex.org/organizations/openbaar-ministerie-netherlands-public-prosecution-service), judicial cooperation - [Bitdefender](https://takedownindex.org/organizations/bitdefender), technical partner **Jurisdiction:** Netherlands, Germany, Lithuania, and European Union **Outcome:** Full covert takeover of the marketplace; servers seized in the Netherlands, Germany, and Lithuania; user credentials and transaction data collected; site replaced with seizure notice. **Status:** Completed **Legal mechanism:** Dutch judicial authorization for covert continuation of a criminal service; German arrest warrants **Group accounted for:** Likely complete ### Infrastructure 1 onion service taken over. Servers seized, with no count in the record. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | Not published | 1 onion service | Taken over, Netherlands | Marketplace covertly operated by Dutch police for approximately one month before shutdown.[[2]](#source-2) | | Not published | Server | Seized | Servers seized in the Netherlands, Germany, and Lithuania.[[2]](#source-2) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Likely complete Both publicly described administrators were arrested in Germany and the infrastructure was under police control. Names were not released by Dutch or German authorities. Two German-national administrators publicly described as running the market. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/hansa-covert-takeover-and-shutdown/organizations) ## What happened afterward Two German administrators prosecuted in Germany; follow-on vendor arrests in multiple countries.[[1]](#source-1)[[2]](#source-2)[[3]](#source-3) Not established in the public record. No later activity is recorded against this entry. Return class F. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [Massive blow to criminal dark web activities after globally coordinated operation](https://takedownindex.org/sources/europol-massive-blow-to-criminal-dark-web-activities-after-globally-coordinated-) Europol, July 20, 2017, Source grade P2 Joint AlphaBay and Hansa operation structure and coordination roles No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [Dutch National Police statement on the takeover and shutdown of Hansa Market](https://takedownindex.org/sources/politie-netherlands-dutch-national-police-statement-on-the-takeover-and-shutdown) Politie (Netherlands), July 20, 2017, Source grade P1 Covert takeover of Hansa, duration of covert operation, server seizures, administrator arrests No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. ### Additional reporting and technical analysis 1. [Bitdefender account of technical support to Europol EC3 on Hansa](https://takedownindex.org/sources/bitdefender-bitdefender-account-of-technical-support-to-europol-ec3-on-hansa) Bitdefender, July 20, 2017, Source grade T1 Technical partner role in locating the Hansa infrastructure No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. - This is one of the clearest documented cases of covert law-enforcement operation of a seized criminal service. - Administrators were not publicly named, so no person records were created despite an official apprehension count of two. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 3 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [Webstresser.org takedown](https://takedownindex.org/takedowns/webstresser-org-takedown) - [Operation Source / Beebone botnet disruption](https://takedownindex.org/takedowns/operation-source-beebone-botnet-disruption) - [EncroChat interception and shutdown](https://takedownindex.org/takedowns/encrochat-interception-and-shutdown) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)