AlphaBay Market: The Giant That Died Twice

The biggest market the dark web had seen

AlphaBay launched in December 2014 under a Canadian operator who signed himself "Alpha02," and later just "Admin." Reachable over Tor and, at times, the I2P network, it grew within two and a half years into the largest darknet market the ecosystem had produced, with more than $1 billion in transactions. It dwarfed Silk Road in both scale and scope: alongside the heroin and fentanyl that US authorities tied to fatal overdoses, it brokered stolen and fraudulent identity documents, malware and hacking tools, firearms, and toxic chemicals. Hundreds of thousands of buyers and tens of thousands of vendors made it the default destination of its era, and being the default is what made it the target.

Operation Bayonet and the Hotmail that doomed it

AlphaBay fell to investigation, not a broken protocol, and the thread investigators pulled was almost comically ordinary. When the service first launched, its founder used his personal Hotmail address, pimp_alex_91@hotmail.com, as the "from" line on AlphaBay's automated welcome and password-reset emails. That same address sat on his LinkedIn profile and his legitimate computer-repair business in Canada, tying an anonymous empire to a named man, Alexandre Cazes. When the Royal Thai Police arrested him in Bangkok around 5 July 2017, working with the FBI and DEA, he was logged into an unencrypted laptop mid-reboot of an AlphaBay server, a reboot law enforcement had provoked by engineering the outage, leaving the evidence open on screen.

The takedown spanned at least eleven agencies across six countries, with servers seized in the United States, Thailand, the Netherlands, Lithuania, Canada, the UK, and France, coordinated through Europol. Crucially, investigators did not announce it. They let the outage read as ordinary downtime so AlphaBay's frightened users would scatter to Hansa, a market Dutch police had already seized and were running as a honeypot, the second jaw of Operation Bayonet. Cazes died in custody in Thailand around 12 July 2017, an apparent suicide, and the operation was made public at a US Justice Department press conference on 20 July.

The 2021 resurrection, and a second death

AlphaBay's story did not end there. In August 2021, a user posting on Dread, verified by the original site's PGP key as the former second-in-command "DeSnake," relaunched the market and dedicated it to the late Alpha02. This AlphaBay 2.0 was built around the lesson that had killed the first: it banned the categories that drew the heaviest heat, including fentanyl, firearms, and COVID-19 vaccines, and introduced a system called AlphaGuard designed to survive exactly the kind of infrastructure infiltration that had doomed Hansa. For a while it was the rare market run by someone who had studied how the last one died.

It still ended in silence. In February 2023, AlphaBay 2.0 went offline without explanation, DeSnake disappeared, and an automated security canary locked the platform. No agency claimed a seizure and no signed message explained the void, so whether it was a covert bust, a technical failure, or a deliberate exit has never been resolved. The second death repeated the first lesson in a new key: once the signing key goes quiet, even a security-obsessed operator leaves users with nothing left to verify.

So is there an AlphaBay link in 2026?

There is not. The original was seized in 2017; the relaunch died in 2023; nothing genuine carries the AlphaBay name today. That makes it one of the most impersonated brands on the dark web, because a famous dead market is a magnet for fraud. Every "AlphaBay link," mirror, or onion address circulating now is a phishing clone, frequently a polished one, set up to collect credentials and coins from people who never heard that the market died, let alone twice. Treat all of them as hostile, enter nothing, and verify a live market from scratch instead.

If you wanted AlphaBay, start here

What an AlphaBay searcher usually wants is a large, general-purpose market that is actually running. Those are tracked in tordark's verified directory, where the closest matches in breadth are Nexus, a higher-profile general market reported to take Bitcoin, Monero, and Litecoin, and TorZon, which pairs Bitcoin with Monero. Neither is "the new AlphaBay," and treating any market as a guaranteed successor is the exact reflex Operation Bayonet was built to exploit.

One habit is worth inheriting from AlphaBay's own second act. DeSnake's whole pitch was verification, a signed identity and a working canary, and that discipline is what protects you on any market still live. Confirm the current address against a PGP-signed canary, prefer Monero over Bitcoin's readable ledger, and keep nothing in escrow beyond an open trade.

What AlphaBay teaches

AlphaBay is the clearest proof that a market being reachable says nothing about whether it is safe. A site can be seized, cloned, or quietly run by police, and to a user all three look like a normal login screen, which is precisely what turned the AlphaBay-to-Hansa migration into a trap. The numbers that made AlphaBay feel invincible, the hundreds of thousands of users and the billion-plus in turnover, are the same numbers that made it the prize worth the most elaborate sting.

The founder's downfall supplies the other half of the lesson: anonymity protects software, not the person running it, and one reused email address can unravel a billion-dollar operation. Both AlphaBay deaths, the loud one in 2017 and the silent one in 2023, point to the same defence. The only durable check is cryptographic, so learn it in our PGP verification method and apply it to anything in today's directory.

Common questions about AlphaBay