what happened to whom, reported straight: takedowns, vanishing acts and orderly goodbyes across the hidden service scene.
Darknet markets ask sellers for a refundable deposit before the first listing goes up. The bond filters scam accounts and floats the operator's treasury - and it is only as refundable as the market itself.
Sheep Marketplace opened in March 2013 and announced its closure in late November 2013, blaming a vendor who stole 5,400 BTC. Users traced far larger sums across the blockchain, and the case became the template for every darknet exit scam since.
Raheim Hamilton, co-creator of the Empire Market darknet market, has been sentenced to 40 years in federal prison and ordered to forfeit approximately 1,230 BTC, valued at roughly $100 million, plus several Virginia properties. The market moved about $430 million in illegal transactions before its abrupt 2020 exit.
The third version of the German-language fraud forum Crimenetwork ended like its predecessors: with a seizure banner on its domain. The BKA's August action against c-network.to follows a May arrest on Mallorca and a March prison sentence, and fits a pattern in which every relaunch of the brand has collapsed faster than the last.
Two alleged leaders of the ShinyHunters data-theft and extortion group have been taken into custody weeks apart: a 24-year-old in the Netherlands and an 18-year-old detained in Jordan. Reports that the detainee in Jordan is cooperating with the FBI remain unverified.
Police in Greece, Romania, Spain and the United Kingdom seized the KillSec ransomware group's leak site and five servers on 30 September 2026 and arrested three suspects. Europol says the suspected administrator is a 16-year-old from Romania and links the group to around 1,000 attacks and an estimated EUR 4 million in damages.
Former NCA investigator Paul Chowles stole 50 bitcoins from a 2017 seizure that were then worth about GBP 60,000 and about GBP 4.4 million by sentencing. On 30 September 2026 he was ordered to repay GBP 1,810,678.93. The case is a study in insider risk within a seizure chain.
Interpol's Operation Serengeti III brought together investigators from 20 African countries and the United States. Two months of coordinated enforcement produced 1,462 arrests, 10,909 disrupted networks and more than USD 105 million recovered.
A joint operation by North Macedonia's cybercrime unit and the FBI has led to the arrest of a 20-year-old alleged operator of the OLVX cybercrime marketplace, which reportedly generated more than $500,000 in illicit sales of stolen data and login credentials. Investigators also examined evidence tied to his Telegram activity, including a refund-fraud group he allegedly ran.
LockBit 5.0 threatens to publish identity documents tied to more than 100,000 job candidates from French staffing group Actua, spread across ten storage locations at once. What the claim-versus-reality gap looks like, and why scattered leaks change the takedown math.
A hacker using the alias ZeroBytes advertised a stolen DGFiP database on PwnForums, claiming live access to French tax systems. France's economy ministry confirmed illegitimate access affecting about 678,000 individuals and organizations; the seller's larger claims remain unverified.
After Abacus went offline in July 2025 amid withdrawal failures and exit-scam suspicions, its buyers scattered toward Torzon and Black Ops Market - while newer platforms rebuilt the payment stack around built-in coin swapping.
