One defendant in California led an organization that bought fentanyl in bulk, pressed it with methamphetamine into pills and sold millions of them to thousands of people on the dark web, he said. The BKA also said 20 additional properties were searched, mainly targeting Archtetyp moderators and vendors. In total, police seized 47 smartphones, 45 computers, as well as narcotics and other assets, which will be analyzed for further investigative leads. The suspected admin of the operations owns property in Hanover and Bucharest too, all of which were searched by domestic law enforcement.
Dark Web Drug Market Busted By European And US Authorities
One defendant, for example, used virtual private networks to access WSM computers, but when a VPN connection would fail, his IP was revealed and authorities were able to identify his specific location. In mid-2024, Telegram confirmed cooperation with European authorities to remove clusters linked to ransomware extortion leaks. While takedowns rarely eliminate operations, they force constant churn and reduce the longevity of large-scale hubs. For defenders, monitoring communication platforms has become as important as tracking marketplaces themselves.
Dutch Police Find Netherlands’ Largest Cocaine Lab
Europol’s statement about the scale of Archetyp Market’s operations and the coordinated international takedown is confirmed by multiple reputable sources. The €250 million transaction volume and the seizure details align with official reports. The arrests and infrastructure seizures substantiate the effectiveness of Operation Deep Sentinel. However, the darknet’s elusive nature means some data on users and exact sales volumes could be underreported.
Administrator Arrested
Analysts noted that Telegram enabled a shift toward decentralised “broker networks,” where smaller groups coordinated sales of Genesis-style data. This decentralised model makes it far more challenging to target with a single operation. In a news conference Tuesday, U.S. officials framed the operation within the Biden administration’s broader effort to crack down on illegal fentanyl distribution. The pills sold on darknet marketplaces are often counterfeit and laced with the powerful opioid, Attorney General Merrick Garland said. From June 11 to 13, the agency said, a series of coordinated law enforcement actions targeting the platform’s administrator, moderators, key vendors and technical infrastructure took place across Germany, the Netherlands, Romania, Spain and Sweden.
More From The Los Angeles Times
During the year-and-a-half-long investigation, they discovered marketplace infrastructure in Germany and Lithuania, the BKA said. The website launched in 2015 selling drugs, hacked materials, forged documents and illegal digital services such as Bitcoin-mixing – which cyber-criminals use to launder stolen or extorted digital coins. This operation marks a critical blow to Europe’s darknet drug trade, yet underscores the evolving challenges of cyber-enabled crime. Europol said German authorities seized Monopoly Market’s infrastructure more than two years ago, allowing the agency to create intelligence packages that were shared with international partners across Europe as well as in the United States and Brazil.
Detection Vectors And Law Enforcement Response
The site was written in Russian, with sellers located in Russia, Ukraine, Belarus, Kazakhstan and surrounding countries. But, after a tip-off, German police seized the site’s servers and confiscated €23m (£16.7m) in Bitcoin. The administrator faces charges under Sections 29a and 30a of Germany’s Narcotics Act, which mandate minimum sentences of 1–5 years for large-scale, gang-linked trafficking. Eurojust and Europol facilitated cross-border cooperation, with 300 officers executing raids during a three-day action week. On June 11, 2025, a special unit of the Spanish National Police arrested the German national at his Barcelona residence.
Wearable Devices Are Sharing Your Private Data: The 5 Worst Offenders Exposed
Between 11 and 13 June, a series of coordinated actions took place across Germany, the Netherlands, Romania, Spain, Sweden, targeting the platform’s administrator, moderators, key vendors, and technical infrastructure. Around 300 officers were deployed to carry out enforcement actions and secure critical evidence. The operation targeted Archetyp Market, a platform with over 600,000 users and transactions totaling at least 250 million euros, underscoring the scale and ongoing challenge of illicit drug sales facilitated by anonymizing technologies. Shortly after launching, the image-heavy darknet marketplace developed a reputation as a one-stop shop for everything including ecstasy, MDMA, speed, cocaine, crystal meth, LSD and marijuana. Attorney’s Office for the Southern District of New York of narcotics conspiracy, money laundering, and conspiracy to sell adulterated and misbranded medication for owning and operating Incognito Market, one of the largest narcotics marketplaces on the internet.
- However, law enforcement appears to have made breakthroughs in crypto-tracking, either through advanced analytics or infiltration of the platform itself.
- Combined with encrypted access via the TOR network, the darknet enables nearly invisible marketplaces for drugs, weapons, data, and much more.
- While the Justice Department has carried out similar investigations in the past, investigators were particularly concerned when they started seeing a surge in opioid sales on the darknet during the pandemic.
- Just as Archetyp filled the void left by the dismantling of other online drug markets that existed before it, its successor may already be taking shape.
- Listings included offerings of prescription medication that was falsely advertised as being authentic.
This multi-pronged strategy creates both psychological and logistical disruptions in darknet supply chains. Archetyp Market sellers provided the market’s customers with access to high volumes of drugs, including cocaine, amphetamines, heroin, cannabis, MDMA, and synthetic opioids like fentanyl through more than 3,200 registered vendors and over 17,000 listings. Groups used password-protected channels to trade exploits, stolen data, and malware kits. But as operations scaled, IRC’s static architecture and lack of mobile adoption left it vulnerable.
Cybersecurity Workforce Trends In 2025 – Skills Gap, Diversity And SOC Readiness
The value of these markets was estimated by the UNODC in September of 2018 to stand at $14 million (£11 million) to $25 million (£20 million) per month – a tiny fraction of overall illicit drug sales. Still, the EU has funded a three-year, €5 million (£4.5 million) project, project, TITANIUM, with the aim of de-anonymising criminal bitcoin users and providing “court-proof” evidence of underground market activity. Market URLs change rapidly nowadays on the dark web, to escape malicious hacking by blackmailers.
Europol said the takedown comes after years of investigation into the platform’s ‘technical architecture’ and the individuals behind it, adding that its findings were achieved by analysing digital forensic evidence. The largest number of arrests were made in the U.S., which is in the grips of an overdose crisis. Synthetic opioids, mostly fentanyl, kill more Americans every year than died in the Vietnam, Iraq and Afghanistan wars combined.
Studies have shown that Darknet drug dealers offer higher product qualities than street dealers. The investigators also noted a high degree of purity in the “Chemical Revolution” products. BKA has not mentioned if the server administrators or any of the platform’s core operators were identified or arrested during the action. On the same day that Dutch police took control of the servers, the two German men running the site – a 30-year-old from Siegen and a 31-year-old from Cologne – were arrested. After their June 20 arrest the men were held in a prison in Bavaria and were only allowed to communicate with their lawyers. Postal Inspection Service, IRS Criminal Investigation, and HSI, and was supported and coordinated by the Department of Justice’s multi-agency Special Operations Division (SOD).
Predicting And Prioritizing Cyber Attacks Using Threat Intelligence
German law enforcement hasn’t responded to Recorded Future News’ request for comment about whether the website’s administrators were arrested. Visitors to the cybercrime website were greeted on Thursday with a red banner announcing the takeover. At the bottom, the police placed an animated spaceship reminiscent of a 1990s video game called Nemesis. Investigators seized the Nemesis Market platform’s server infrastructure in Germany and Lithuania on Wednesday, as well as cryptocurrency worth 94,000 euros ($102,000), Germany’s Federal Criminal Police Office said in a joint statement with Frankfurt prosecutors. However, BBC research earlier this year revealed the most common way for darknet sites to close is via so-called ‘exit scams’ where the administrators voluntarily shut down the sites but steal their customer’s funds in the process. The website was a bastion of cyber-crime, surviving for more than six years selling drugs and illegal goods.
Operation RapTor was a global, coordinated effort by law enforcement in the United States, Europe, South America, and Asia to disrupt fentanyl and opioid trafficking, as well as the sales of other illicit goods and services, on the darknet, or dark web. Operation RapTor builds on the successes of prior years’ operations and takedowns of marketplaces, which resulted in the seizure of darknet infrastructure from Nemesis, Tor2Door, Bohemia, and Kingdom Markets, providing investigators across the world with investigative leads and evidence. JCODE and Europol’s European Cybercrime Centre (EC3) continue to compile intelligence packages to identify entities of interest. These leads allow U.S. and international law enforcement agencies to identify darknet drug vendors and buyers, resulting in a series of coordinated, but separate, law enforcement investigations, reflected in the statistics announced today. In furtherance of Operation RapTor and in its first action as a JCODE member agency, the Office of Foreign Assets Control (OFAC) additionally sanctioned Iranian national Behrouz Parsarad for his role as the founder and operator of Nemesis Market following seizure of the market. Parsarad was also indicted by a federal grand jury in the Northern District of Ohio on drug trafficking charges related to the illegal business he ran on the dark web.
