50:26
Daniel just bought ecstasy on Hansa. It's one of the largest darknet markets offering drugs, weapons, malware, stolen credit card info, and more. Unfortunately, Daniel's order doesn't go as planned. He gets into an argument with the vendor, Dutch Candy Shop. It goes nowhere. So, Daniel does what any frustrated customer would do. He contacts customer support. A moderator steps in to help, but the dispute escalates. So, the mod calls for an admin. The admin replies quickly, calms the situation down, and solves the problem within minutes.
Hansa's service is smooth, professional, and efficient. The admin in particular is good at his job, but he's even better at his real job, working undercover for the Dutch police's high-tech crime unit. They've successfully infiltrated Hansa's servers and taken over operations. Unbeknownst to anybody in the digital underworld, they're dismantling the site's promises of anonymity, identifying vendors, reading supposedly encrypted chats, and tracking their home addresses. But all it takes is one wrong message, one small mistake, and they could realize he's a fraud. This is the story of one of the boldest international police investigations of all time, likely the largest trap in darknet history.
This is Operation Bayonet. Dark match, we keep walking, take care of drying hurt. Some lines are crossed for a reason, and some are crossed for good. Storms brewing straight faces, but late now to resist. Squint your eyes, what's coming through? Large shadows in the mist.
This story is largely based on Wired's reporting on the operation. You'll find links in the description. It's 2017 and law enforcement is having a tough time. Darknet markets are on the rise. They offer a completely new ways for criminals to sell their goods and services. And tracking down who's behind them is hard. The operators hide behind layers of anonymity and encryption. After years of investigation, in 2013, law enforcement in the United States finally caught their first darknet king, Ross Ulbricht, the mastermind behind the infamous Silk Road.
The black market bazaar known as the Silk Road is now offline and the founder behind bars. But the victory was short-lived. Just 35 days later, former Silk Road moderators launched Silk Road 2.0. When old kings fall, new ones rise. The number of darknet markets exploded. Alphabay appeared in 2014 and it grew exponentially. About a year after its launch, the site claimed it had over 200,000 registered users and 40,000 vendors.
Now, it processes more than half a million dollars in transactions every single day. Alphabay is bigger than Silk Road ever was. Its operator, Alpha02, is crowned the new king of the darknet. A global manhunt ensues to bring him down. We covered that story in one of our first videos on this channel. How time flies. May 2017. A team of US investigators arrives at Europol headquarters in The Hague. They're here to meet with other law enforcement agencies.
They share updates on their investigations and make sure no toes get stepped on. The Americans kick things off. They're in a good mood. The team believes they've found Alphabay's server and its operator. All clues point to Thailand. Now, they're about to make their move. You might have noticed, we got reenactments now. Just to step it up a notch. Organizing shoots like these is pretty complicated, and there's so many moving parts because of the sliders. Get it? Sorry. Where was I? Oh, yeah. A smooth segue into an ad. There are many moving parts, just like in business. Today's sponsor, Odoo, bundles all that complexity into a single suite of over 45 interconnected apps. Accounting,
boom. Sales, boom. HR, boom. And they all talk to each other. Make a sale and it's instantly reflected in your accounting. Ship a product and your inventory updates automatically. The interface is easy to use, even if you're not particularly tech savvy. It grows with your business, and you can add new apps as your needs expand. It's an all-in-one management software for everybody from just starting out to nine figures and counting. Odoo even adapts to where you do business, adjusting taxes and regulations to keep you compliant. Your first application is free for life with unlimited hosting and support included. Starting at $24.90 a month, you get access to all applications. Scan this QR code
or click on the link in the description to get started. After a short coffee break, the technical advisor to the Dutch prosecutor's office takes the stage. He starts with an update on their current investigations into Hansa. As he shares more and more details, the room begins to buzz with excitement. And then he suggests something truly insane. Every device that connects with the internet has an IP address. This unique address allows it to be identified so it can send and receive data.
An IP address can also give away rough location details like the city your laptop is in and who your internet provider is. That's why Daniel likes to use the Tor browser. Tor works with layered encryption. Before Daniel's data enters the network, it's encrypted multiple times, wrapped in layers like an onion. Then Tor routes Daniel's traffic through three random servers in the Tor network, so-called relays. Daniel's traffic hops from one relay to the next. Each relay peels away a layer of encryption, revealing only where Daniel's traffic should go next.
The final server in the chain is the exit relay. It sends the request to the public internet. The site Daniel connects to will only see the IP of that exit relay, not Daniel's real one. Tor also stops websites from tracking and building a profile on the user by making it more difficult to see who they are and what they're looking at. When he closes the browser, its cookies and history are automatically wiped. Sites can also be hosted within the Tor network. They use special.onion domains and are only accessible over secure Tor connections.
The anonymity Tor offers is crucial for journalists, activists living in authoritarian regimes, and whistleblowers. But it's also great for users like Daniel who want to buy drugs or other illicit goods and for the people selling them. Darknet markets usually take even more precautions. Along with Tor, users and vendors communicate via encrypted chats and use relatively anonymous payment methods like crypto. These layers of protection make it hard for law enforcement to track down the real location of a darknet market server, its operator, or individual vendors and buyers.
Hard, but not impossible. If law enforcement identifies where chunks of Tor infrastructure are located, they can monitor these relays, sometimes for years. They measure the timing and size of traffic as it exits a Tor node. Then they correlate this with data provided by internet service providers. ISP data, the info connected to your IP address, is often available to law enforcement. For example, a user keeps connecting to the Tor network at certain times.
Very briefly afterward, traffic of the same size exits a specific node. Chances are that traffic belongs to that user. This is how German authorities were able to track down one of the people behind a pedophile darknet platform. Tor explicitly warns users about traffic correlation and timing analysis, as it does not defend against such a threat model. But well, none of that was even necessary in Hansa's case. The operators simply done goofed. It's the fall of 2016, roughly 9 months before the FBI starts to close in on Alpha02. Researchers from Bitdefender, a private cybersecurity company working with Europol, discover something in a Dutch data center.
A weird server. It looks like it's used for staging. Staging servers are essentially test labs. Developers use them to try out new features before pushing them live. This server contains code, configs, and backups. They all link to a Tor front end. It seems to be used for a darknet market. But unlike the darknet market it appears to belong to, it isn't concealed. The server isn't hidden in the Tor network. The operators seem to have just left it here, out in the open clearnet, vulnerable and unprotected. And as the researchers dig in, they even find clues about which darknet market the staging server belongs to.
Hansa. To this day, Bitdefender has never disclosed how exactly they found the server in the first place. We asked them, but they didn't respond. Back in 2016, Bitdefender's researchers report the server to Europol, who in turn informed the Dutch authorities. For the police, it's a golden opportunity. After receiving the server's IP, they move quickly. They contact the web host, the company that provides the staging server to the Hansa admins. Then they visit the data center and install network monitoring equipment. This tech monitors all traffic going in and out of the staging server.
In this way, they find out that the staging server is connected to another server in the same location. And this one is protected by Tor. And it's running Hansa's live site. They also identify other servers, four machines located in Germany. The investigators create bit-for-bit copies of the server drives and find a trove of evidence. It's basically the entire digital history of the darknet market. They find its source code and a key database. They gain access to the marketplace's transaction history.
They find a collection of usernames and password hashes and almost every encrypted message users have sent through its anonymous system. Then the investigators hit the jackpot. On one of the German servers, they stumble upon logs of an internet relay chat between the two Hansa admins. They go by HL and Ron Swanson. 17,000 messages dating back years. In them, the investigators find both admins' full names and one home address. HL and Ron Swanson are Germans. On the servers, the Dutch also find the admins' private PGP keys. Pretty good privacy is an encryption method used to secure messages and files. And PGP keys are powerful, not something to be left lying around.
They can be used to decrypt and read messages the admins receive and also verify their identities to others. With them, police could impersonate the admins. But then, the Hansa servers suddenly go silent. It seems like the admins suspect something is off. They move their site to another Tor protected server in an unknown data center. It's a real setback for the investigation. For a while, the trail goes cold. The investigators know who run Swanson and HLR. But now, arresting them isn't enough. They want the keys to the kingdom back.
They want the site itself. In their old chats, the two admins mention a Bitcoin address. They used it for paying the Dutch web host. And suddenly, there's activity on that exact address. The admins have sent Bitcoin somewhere. Using a tool called Reactor, Dutch police trace the transaction to a Bitcoin payment processor called BitPay. The company lets users spend crypto on regular goods and services. And it has an office in the Netherlands. Bingo. Dutch police send BitPay a legal demand to disclose more information about the transaction.
The company has no choice but to reveal the recipient. Turns out the Hansa admins used BitPay to pay for servers in Lithuania. Everyone in the Europol meeting room listens anxiously as the Dutch technical advisor presents their findings. He says they're ready to arrest the two Hansa admins with the help of German police. But why just shut the market down? Instead, they propose something else. Something far riskier. After the arrests in Germany and with the help of the Lithuanian authorities, the Dutch police want to take over Hansa. Then, they want to run the site themselves.
First, the Americans would take down AlphaBay. As usual, users and vendors would jump to another major market, such as Hansa. They would simply continue buying and selling their drugs, weapons, hacking tools, etc. Believing everything was business as usual. But now the cops would control the market. A giant honeypot. The meeting room fills with chatter and doubt. Is this ethically okay? Law enforcement would run a darknet market. They would watch as people buy guns, stolen credit card data to steal from innocent people, and tools to hack
more people and steal even more. They wouldn't stop any of it. They'd just let it happen. And what if anybody caught wind of the operation? It could turn into an enormous scandal. Still, it's a unique opportunity. This could fundamentally shake users' trust in these markets. Are you really messaging a moderator? Or are you talking to the police? Are you dealing with a trusted vendor? Or are you being tricked by the cops? In the end, the FBI, the DEA, Europol, and the Dutch police collectively decide it's worth the risk. Time for Operation Bayonet. Step one, arrest Alpha02. On July 5th, 2017, Alpha02's time has come.
Authorities have hunted him for years, ultimately identifying him as Alexandre Cazes. They've tracked him to his villa in Bangkok, where he and his wife live a life of luxury. And, crucially, the laptop he uses to log into AlphaBay is here. So, they come up with a plan. A gray Toyota Camry enters a dead-end street and heads toward Kossa's house. Behind the wheel is a Royal Thai police agent in civilian disguise. She tells the security guard she took a wrong turn. Then she tries to back up, deliberately causing a minor accident. Kossa hears the bang in front of his house. He grabs
his phone and rushes out. It's a mistake. He's swarmed by several officers. He tries to dash back inside, but it's too late. They find his laptop in the bedroom. It's on and unlocked. And Alpha02 is still logged into the server hosting AlphaBay. They dig through the laptop and uncover multiple passwords for the AlphaBay website and its servers. Then they silently shut down the marketplace. No one knows why it suddenly goes offline. The FBI wants everyone in the community to believe that Alpha02 ran off with all the crypto the site keeps in escrow. That he pulled an exit scam.
Step two, take over Hansa. First, the Dutch need to take out the real admins without anybody noticing. The two German Hansa admins are already under investigation in their home country. Along with operating one of the largest darknet markets, they're suspected of running a site for pirated ebooks and audiobooks called lol.to. The ongoing investigation into lol.to provides the perfect cover. German authorities carry out the arrests. Ron Swanson and HL are taken into custody. Hoping for reduced sentences, they hand over their passwords for Tox, a peer-to-peer chat system they used to communicate with their four moderators.
While the two admins are taken into custody, Dutch agents arrive at the Hansa servers in Lithuania. They remove a hard drive from the machine. Now they can access a full backup of the Hansa database. The agents duplicate everything on their own computers, every digital component of the market. Then they begin to construct an exact clone of the site on a Dutch server. Wired describes how for the next two days, the investigators code their Hansa copy barely sleeping. From early morning until well past midnight, they sit at their keyboards in a conference room in Driebergen.
Pizza boxes stack up. There are chocolate and chip wrappers everywhere. Energy cans pile higher and higher. It smells so bad that the head of investigation flees from the room after only 10 minutes. Someone brings in an air freshener, but it doesn't help. The pressure is massive. At one point, someone knocks over a soda. It spills across the conference table heading straight for the laptop that holds all of the Hansa data. One of the agents lunges for it and saves it just in time. Later, a single typo in a command brings the site down. For a few long terrifying minutes, panic fills the room. If they can't bring the site back up, the whole operation could collapse. But, they manage to fix it. Then, finally, the Dutch have a fully
operational copy of Hansa. It runs smoothly. The market is now live on servers in the Netherlands. Meanwhile, on Reddit, several users encourage other Redditors to migrate their business to Hansa. One post says, As a forum moderator, I have tested most of the biggest marketplaces, and I think Hansa Market is the best option for AlphaBay refugees. An editor at Reason Magazine later suggests posts like these may have been written by the Dutch police. We can't know for sure.
A whole team of Dutch undercover agents takes turns impersonating the Hansa admins. No one on Hansa appears to have realized what's happened in the background. Users connecting to the same onion address are no longer directed to the original Hansa servers in Lithuania. Instead, they're connecting to the version the Dutch have constructed on their own network. From the users' perspective, nothing appears to have changed. The site's onion address remains identical. But, behind the scenes, the Dutch police are retrofitting the market. While it was initially designed to protect users' privacy, the agents now work to make it do the exact opposite.
They rewrite the site's code. Usernames and passwords are now logged in plain text. They archive every message before it's encrypted with PGP. Investigators can see real shipping addresses. They also save uploaded product photos along with their metadata. Metadata looks like this and can contain info such as where a picture was taken. Useful clues to pin down vendors' real-life locations. The Dutch include boxes for shipping tracking numbers, shipping addresses, and other information. They advise vendors to keep these updated. But even with these tricks, they only identify some of the vendors.
They want more. So they hold evil plan meetings, brainstorming sessions to figure out how to unmask even more vendors. Yeah, we actually did that. Each idea is ranked by how effective it is and how likely it is to blow their cover. At one point, the Dutch delete every image on Hansa. They claim that a server failed due to a technical glitch. Vendors need to re-upload all the images for their listings. Through the new images' metadata, they're able to identify the locations of over 50 more vendors. In the final phase of Operation Bayonet, they send vendors an Excel spreadsheet
containing codes. These supposedly allow vendors to retrieve the Bitcoins they have stored in escrow on the market, even if the site is taken down. At first, only a few take the bait. To make it more tempting, the police add features like buyer statistics, allowing vendors to track and rank their best customers. In the top left corner of the Excel spreadsheet, the Dutch agents integrate an image of the Hansa logo. It loads from Dutch police servers. The moment someone opens the file, the server logs the requesting computer's IP address. Using this tactic, they identify another 64 vendors.
Next, the investigators start recruiting. They look for new moderators. After reviewing experience and qualifications, they ask applicants for their home addresses, supposedly to receive a two-factor authentication token. And some actually send their home address. One applicant even jokes, "Please don't send the cops to this address. Ha, just kidding." In a particularly inventive move, they send packages with stuffed pandas to moderator applicants who've only provided a drop-off address. They hope the recipients will bring these cute stuffed toys home. A GPS tracker hidden inside will then reveal where they live.
The Dutch team has been running Hansa for 27 days now, and they still have more ideas, more tricks up their sleeve. They're hyped, but they've been operating on the dark side long enough, and prosecutors decide it's time to call it quits. Daniel is annoyed. He's been buying his drugs on AlphaBay for a long time, but Alpha02 apparently pulled an exit scam a few weeks ago. Luckily, there are alternatives. This time it's Hansa, recommended by people on Reddit. A vendor messes up Daniel's order, but Hansa customer service is great. The problem is fixed quickly.
A short time later, Daniel wants to check his order again. On his screen, the Hansa logo appears, but it's no longer a ship proudly sailing. Instead, it's sunk. Dutch police are shutting Hansa down. For this pivotal moment, they gather in a conference room in the Dutch police's national headquarters in The Hague. The head of the agency leans forward and presses a big red plastic button, but it's just for show. The real action is happening here.
This agent takes the darknet market offline. During their investigation, Dutch police claim they monitored 27,000 transactions. They collected data on 420,000 Hansa users, and obtained more than 10,000 addresses. They seized 1,200 Bitcoins, which were worth around 2.3 million dollars at the time. And they arrested several top vendors. With the seizure notice, Dutch authorities redirect visitors to a second website. Here, they've published a list of Hansa vendors using their pseudonyms and sorted into two categories. Active and arrested, plus identified buyers. A warning runs across the top. Active at dark markets, you have our attention.
Dutch Candy Shop is among the vendors identified. We can only imagine what that must feel like. This is the largest dark market web place takedown in world history. Operation Bayonet landed a serious blow to trust among darknet users. Just as the authorities had hoped. When Hansa suddenly went offline, panic rippled through the community. But after a while, things went back to normal. New darknet markets rose. They still collectively process billions of dollars per year. Meanwhile, encrypted messaging apps became popular for selling drugs.
Users already have those on their phone, so no Tor browser required. Authorities continue to struggle in the war on drugs, with no end in sight.
