Skip to main content
Back to the takedown index

Operation Cookie Monster

April 2023, Fraud and stolen data
Led by Federal Bureau of Investigation, Politie (Netherlands National Police)

Verified core entry, last reviewed August 21, 2026

What was taken down?

Eleven domains seized under a US warrant; US-based servers seized; marketplace clearnet access replaced with seizure notice.[1][2][3]

See what happened

What happened to the people?

Officials reported 119 apprehended.
Group accounted for: Partial

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

FBI and Dutch National Police led a 17-country action seizing the clearnet domains and infrastructure of Genesis Market, which sold stolen credentials packaged with browser fingerprints and cookies.[1][2][3]

Announced April 5, 2023.

Date
April 4 to April 5, 2023
Target
Genesis Market, criminal marketplace
Activity
Fraud and stolen data, Phishing, Malware and botnets
Operational lead
FBI and Dutch National Police
Partners
Europol, Qintel, and 1 more[1][2][3]
Jurisdiction
United States, Netherlands, United Kingdom, and European Union
Outcome
Eleven domains seized under a US warrant; US-based servers seized; marketplace clearnet access replaced with seizure notice.
Status
Completed
Legal mechanism
US seizure warrant (Eastern District of Wisconsin); parallel Dutch and partner judicial process; Europol and Eurojust coordination
Group accounted for
Partial

Infrastructure

11 domains seized. Servers seized, with no count in the record.

11
domains seized
Identifier Recorded as Status Notes
Not published 11 domains Seized, United States Eleven domains seized under a warrant issued in the Eastern District of Wisconsin. Some reporting cites approximately 24 domains; CONFLICTING and not harmonized. Resolved to the official DOJ figure of 11 domains (E.D. Wisconsin warrant); a commonly repeated ~24 figure is not a DOJ number.[1]
Not published Server Seized, United States US-based servers supporting the marketplace.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

Infrastructure was seized and a large number of users arrested, but no core administrator was publicly identified, charged, or apprehended.

Core administrators were never publicly identified. The 119 arrests were predominantly users and customers.

See the organizations and roles behind this action

Follow-on arrests continued in multiple countries after the action date.[1][2][3]

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    Genesis Market, a major initial access broker, seized in international operation

    United States Department of Justice, April 5, 2023, Source grade P1

    Domain seizures under an EDWI warrant, US server seizures

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  2. [2]
    Takedown of Genesis Market, the largest online marketplace for stolen credentials

    Europol, April 5, 2023, Source grade P2

    17-country coordination, 119 arrests, 208 property searches

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  3. [3]
    NCA statement on Operation Cookie Monster

    National Crime Agency, April 5, 2023, Source grade P2

    UK arrests and searches

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
  • 119 arrests and 208 property searches are official aggregate figures across 13 countries and are not converted into person records.
  • Approximately 1.5 million compromised devices and 80 million credentials are victim-side figures, not operator counts.
  • Reporting indicates the Tor mirror was not immediately affected by the clearnet seizure. Recorded as a partial technical outcome.
  • OFAC sanctioned Genesis Market separately. Sanctions are not treated as charges.