AlphaBay & Hansa: The Honeypot Waiting on the Other Side

By 2017, AlphaBay had become what Silk Road once was: the largest marketplace on the dark web, a sprawling bazaar of drugs, stolen data, and weapons that dwarfed its predecessor many times over. Behind the admin account sat a young Canadian, Alexandre Cazes, who signed his work as "Alpha02" and, later, simply "admin."

A signature in the headers

Cazes was undone, in part, by ordinary carelessness. Early welcome emails sent to new AlphaBay users carried his personal Hotmail address in the header. From that thread, investigators across several countries pulled together the identity of the man running one of the world's busiest criminal storefronts. In July 2017, in a coordinated international action led by the United States, AlphaBay went dark. Cazes was arrested in Bangkok and, days later, was found dead in his Thai cell.

The market that was already a trap

What the fleeing crowd did not know was that the obvious refuge had been compromised first. A month earlier, the Dutch national police had quietly seized control of Hansa, AlphaBay's chief rival, and kept it running as a honeypot. When AlphaBay collapsed, tens of thousands of disoriented buyers and vendors poured into Hansa — straight into a marketplace whose every login, message, and address was now being logged by police. Operation Bayonet had turned the migration itself into evidence.

What the chronicle remembers

The lesson of Bayonet was patience. Rather than seizing both markets at once, investigators let one fall loudly and ran the other silently, harvesting the panic. It reframed the takedown as theater with a hidden second act — and it taught the darknet that the safest-looking door might be the one the police were holding open.