RapTor
Dark Web Takedowns: The Ledger of What Law Enforcement Has Actually Done
Most coverage of dark web takedowns is a rewrite of a single press release, republished three or four times with the same numbers and none of the context. This page is a ledger instead: one row per operation, the primary government or blockchain-intelligence document behind it, and the two things that determine whether a takedown actually mattered — what happened to the money users had sitting in escrow, and where those users went next. Checked as of 13 September 2026, against sources published within days of that date on the most recent row — this page is the investigations record behind every darknet market shutdown covered on RapTor's directory.
The operations, in order
| Operation / target | Date | Agencies | What was seized or restrained | Arrests |
|---|---|---|---|---|
| Xinbi Guarantee | 9 Sept 2026 | US Secret Service, DOJ Scam Center Strike Force, Treasury/OFAC, with Elliptic's tracingSecret Service, 9 Sept 2026 | $52.8 million in USDT frozen across 52 wallets; OFAC sanctioned Xinbi and two supporting firmsElliptic, 9 Sept 2026 | None announced in this specific action; part of a Strike Force that has restrained ~$938M cumulativelySecret Service, 9 Sept 2026 |
| Archetyp Market | June 2025 | Europol, Eurojust, and national police in Germany, the Netherlands, Romania, Spain, SwedenEuropol IOCTA 2026 | Platform infrastructure (hosted in the Netherlands); administrator's identity established | Administrator (30-year-old German national) arrested in Barcelona; one moderator and six vendors targetedEuropol IOCTA 2026 |
| Operation RapTor | 22 May 2025 | DOJ's JCODE team with Europol and partners across 10 countriesDOJ, 22 May 2025 | $200M+ in cash and crypto, over two metric tons of drugs, 144kg of fentanyl, 180+ firearmsDOJ, 22 May 2025 | 270 vendors, buyers, and administrators across Austria, Brazil, France, Germany, the Netherlands, South Korea, Spain, Switzerland, the UK, and the USDOJ, 22 May 2025 |
| Incognito Market | Shut down Mar 2024; administrator arrested May 2024 | FBI, HSI, DEA, FDA OCI, USPISDOJ | Case evidence; administrator Rui-Siang Lin pleaded guilty to narcotics conspiracy and money launderingDOJ | Lin arrested transiting JFK Airport; pleaded guilty, sentencing pending as of the DOJ's accountTRM Labs, 24 May 2025 |
Operation RapTor's own announcement names four predecessor market takedowns it built on — Nemesis, Tor2Door, Bohemia, and Kingdom Markets — and states that OFAC separately sanctioned Nemesis founder Behrouz Parsarad, an Iranian national, who was also indicted on drug trafficking charges following his market's seizure.DOJ, 22 May 2025
The most recent action, as of this check
As of 13 September 2026, the most recent action in this ledger is the 9 September 2026 freezing of Xinbi Guarantee's wallets, announced jointly by the Secret Service, Treasury's OFAC, and blockchain-intelligence firm Elliptic. It's worth flagging that Xinbi isn't a classic Tor darknet market in the mold of the others on this page — it's a Telegram-based marketplace serving scam-center operators, sanctioned as a transnational criminal organization rather than seized as a Tor hidden service.Treasury, 9 Sept 2026 It belongs on this ledger because it shows the same enforcement playbook — trace on-chain, freeze at the wallet level, sanction the entity — applied to adjacent dark-web-adjacent infrastructure, and because Elliptic reports Telegram itself forced Xinbi offline within hours of the sanctions announcement, deleting its channels.Elliptic, 9 Sept 2026
How to tell a seizure from an exit scam from a covert seizure
Often you can't, for weeks or months, and the people best positioned to know — the darknet community itself — get it wrong regularly. When Abacus Market went dark in July 2025, TRM Labs' own assessment stated plainly that operators "likely conducted an exit scam" while adding in the same sentence that "law enforcement may also have covertly seized the marketplace"TRM Labs, 14 July 2025 — a genuine, stated ambiguity from the analysts closest to the data, not a hedge for legal reasons. Dread's own administrator, in close contact with the Abacus team, believed it wasn't law enforcement;TRM Labs, 14 July 2025 a commenter on the contemporary news coverage raised the opposite read — that a real seizure could deliberately look like an exit scam to keep vendors nervous and cooperative.BleepingComputer, 15 July 2025 TRM Labs names the reason this ambiguity is often permanent rather than temporary: law enforcement has deliberately shifted toward silent takedowns specifically so vendors under investigation don't scatter — Nemesis Market's official seizure notice appeared months after the market itself went offline, and the same silent-takedown approach was first proven in the 2017 Hansa operation, where Dutch police secretly ran the seized market for 27 days to harvest buyer and vendor data before announcing anything.TRM Labs, 14 July 2025 Practically, that means a market going dark with no announcement should be treated as ambiguous by default, not confidently labeled either way from outside — see exit scams for the specific behavioral signals that lean one direction or the other.
What happens to escrowed funds after a seizure
Cryptocurrency seized in an enforcement action goes into the government's own forfeiture process, not back to individual buyers or vendors who had a balance sitting in the market at the time. Operation RapTor's own accounting frames the more than $200 million in seized cash and crypto as an enforcement result to be reported, not as funds earmarked for return to usersDOJ, 22 May 2025 — standard practice across every operation in this ledger, and no different in outcome for the buyer than an exit scam: the money in escrow at the moment of collapse is simply gone from their control either way. The Xinbi action states outright that the seized funds are "blocked" pending OFAC's own process rather than returned to defrauded parties.Treasury, 9 Sept 2026
Whether takedowns actually reduce activity
The on-chain evidence says no, not in aggregate. Chainalysis's own 2026 Crypto Crime Report tracked darknet market flows rising to nearly $2.6 billion in 2025Chainalysis, 19 Feb 2026 — the same year Operation RapTor, Archetyp's seizure, and Abacus's collapse all happened. TRM Labs' own account of the Hydra Market seizure in 2022 makes the pattern explicit across a longer horizon: new Russian-language markets absorbed the gap so completely that by 2024 they accounted for more than 97% of global darknet drug revenue.TRM Labs, 14 July 2025 A takedown demonstrably ends one specific platform and, in cases like Incognito, produces real prosecutions of the people who ran it — but it has not, in any operation covered on this page, produced a lasting drop in overall market activity. TRM's own read of the strategic shift is candid about this: enforcement has moved from trying to end the ecosystem toward "continuously disrupting operations, degrading trust between market participants, and raising the operational security cost for market operators," which is a different and more modest goal than eliminating darknet commerce.
Where users go, and how fast
Fast, and usually to whichever market is already positioned to absorb them. ASAP Market's 2023 closure drove a measurable 20% volume increase to Abacus within a month; Archetyp's June 2025 seizure sent so many displaced users to Abacus that Abacus recorded its own largest-ever monthly sales volume, $6.3 million, that same June — one month before Abacus itself collapsed.TRM Labs, 14 July 2025 When Abacus followed Archetyp offline weeks later, TorZon absorbed the bulk of that second migration and has held the largest Western-facing position since.Chainalysis, 19 Feb 2026 Migration this fast is itself informative: a market that can absorb a rival's entire user base within a single month either already had significant spare capacity or grew its infrastructure explosively in response, and either way it's worth remembering that "biggest" on any of RapTor's market pages is frequently a title held for a matter of months, not years.
Buyers, not only vendors and administrators
Operation RapTor's own DOJ announcement is explicit that its 270 arrests spanned "dark web vendors, buyers, and administrators" together, not vendors and operators alone.DOJ, 22 May 2025 That's a meaningful, specific answer to a question a lot of readers arrive with hoping the answer is no: buying is prosecuted here, not merely selling, and the case examples DOJ published alongside the numbers name sentenced individuals — a 12-year sentence, a 10-year sentence, a 20-plus-year sentence in a separate case — for narcotics and money-laundering conspiracy tied directly to darknet purchases and sales.DOJ, 22 May 2025
How operators were actually identified
Not through breaking Tor's encryption or Monero's privacy math directly — every documented case in this ledger turns on a mistake at a chokepoint outside the anonymity network itself. Incognito's administrator, Rui-Siang Lin, was arrested transiting a physical airport — JFK — a location decision that had nothing to do with the cryptographic strength of anything he'd built.TRM Labs, 24 May 2025 More broadly, TRM Labs' own account of the RapTor-era cases describes investigators "cracking the code of so-called 'safe spaces'" specifically by targeting the point where cryptocurrency converts to fiat — a centralized exchange, a peer-to-peer broker — rather than trying to de-anonymize traffic on the network itself.TRM Labs, 24 May 2025 This is the same lesson cryptocurrency privacy covers in full: the blockchain's own permanent record, not a flaw in Tor, is what eventually connects an on-chain identity to a real one.
Announcements versus actual convictions
Some of this ledger's biggest numbers are arrest counts and seizure totals on the day of an announcement, which is not the same claim as a finished prosecution. Incognito's case is the clearest counter-example where the record runs all the way through: Lin pleaded guilty in the Southern District of New York to narcotics conspiracy, money laundering, and conspiracy to sell adulterated and misbranded medication.DOJ, 22 May 2025 DOJ's own RapTor release names two more darknet vendor cases with sentences already delivered rather than pending — a counterfeit-Adderall ring resulting in 10-to-12-year sentences for its members, and a separate fentanyl-trafficking case resulting in a sentence of more than 20 years.DOJ, 22 May 2025 Every indictment named in this ledger, by DOJ's own standard disclaimer, is merely an allegation until proven in court — a caveat worth taking at face value for cases still working through the system, even as the ones above show the pipeline does reach real sentences.
For the mechanism behind the ambiguous cases — the wind-down sequence, the named historical losses, and whether recovery is ever possible — exit scams picks up exactly where this ledger's ambiguity leaves off. For what to do with that uncertainty before you're the one holding a balance on a market that's gone quiet, the OPSEC guide and cryptocurrency privacy cover the habits that matter regardless of which way a given disappearance turns out to break. RapTor's news hub carries newer enforcement actions as they're confirmed, dated and sourced the same way as everything above.