AlphaBay Takedown: How a Single Hotmail Account Toppled a Dark Web Empire

AlphaBay collapsed after investigators connected the operation to a personal Hotmail account that appeared in the marketplace’s email headers. The Hotmail account was in the header of all of AlphaBay’s welcome messages starting from December 2014. The address gave investigators an important lead in identifying the marketplace’s founder, Alexandre Cazes, and contributed to the investigation that culminated in the 2017 Operation Bayonet takedown.

At its peak, AlphaBay operated as a large illicit marketplace where users bought and sold illegal drugs, stolen data, malware, and other prohibited goods and services. This article examines AlphaBay’s origins, its founder, the investigative trail involving a personal email address, the 2017 takedown, and what happened to the name afterward.

AlphaBay at a Quick Glance

What Actually was AlphaBay?

AlphaBay emerged in late 2014, following the previous year’s law-enforcement action against Silk Road. It became another major illicit marketplace and adopted features designed to support transactions between vendors and buyers. For a similar deeper look at the marketplace that pioneered the dark web economy and set the stage for AlphaBay, see our full guide on Silk Road: the underground marketplace that changed cybercrime.

After only two years, it grew beyond its predecessor. When the authorities took action, AlphaBay had reportedly amassed over 200,000 users and 40,000 vendors. That’s not just all. It hosted over 250,000 illegal drug and toxic chemical listings. Plus, there were an additional 100,000+ listings for stolen identities, malware, weapons, and fraud (according to the FBI). That is approximately twenty times more than the Silk Road could handle. For a broader look at the darknet marketplace landscape, see our guide to the best darknet marketplaces.

However, it was not just larger, but felt more legitimate, which sounds odd for an illegal operation. AlphaBay used a multi-signature escrow system. It offered vendor bonds to filter out scammers, implemented a ticketing system, and accepted Bitcoin and Monero payments. Silk Road demonstrated that an illicit marketplace could operate at scale, while AlphaBay expanded that model to a substantially larger user base and volume of listings.

The legacy of Silk Road’s cryptocurrency holdings recently resurfaced when over 300 wallets linked to the marketplace moved approximately $3.1 million in Bitcoin after more than a decade of dormancy.

Who Founded AlphaBay?

The kingpin behind AlphaBay was a Canadian man, Alexandre Cazes from Quebec. He used the handle ‘Alpha02’ until he later shortened it to ‘Admin.’ When police caught him, Cazes was just 25. He’d settled in Bangkok, where he was really living it up; his lifestyle was anything but modest.

According to court documents, Cazes accumulated around $23 million worth of real estate and cars in Thailand, Cyprus, and Antigua. Plus an additional amount of cash and cryptocurrency. Prosecutors said he raised these funds by taking a tiny commission (from 2% to 4%) on every transaction in the marketplace. That transaction volume generated substantial revenue, according to prosecutors, who alleged that Cazes collected commissions ranging from 2% to 5% on marketplace transactions.

A second man, called DeSnake, was supposedly the security administrator and co-founder of the AlphaBay marketplace. Unlike Cazes, investigators were never able to identify or catch DeSnake. This point is significant for further consideration.

What should make you stop and think is whether an obsolete email address would be enough to take down one of the most advanced criminal infrastructures on the internet. Well, it is true in Cazes’ case.

How One Hotmail Account Exposed AlphaBay

This is part of the story cybersecurity researchers still talk about years after AlphaBay’s demise. The case remains notable because a seemingly minor digital trace became an important part of the investigative trail surrounding a large criminal operation.

In December 2014, right after opening its doors to new members, the forum software sent a welcome email to each new member. Within the header of that email was hidden an email address: [email protected]. Every password recovery email the forum sent contained the same address in the header. This header info remained unnoticed for two years until December 2016, when investigators discovered it.

They quickly followed the trail. One quick search pulled up a 2008 post on some French tech forum; the user (Alexandre Cazes) who made the post called himself Alpha02. Interestingly, the “91” in his email matched his birthday: October 19, 1991. Those details gave investigators additional information for connecting the online identities to Cazes. They pulled his LinkedIn, which conveniently listed him as an employee at a company called EBX Technologies. The authorities believed this firm to be a front for laundering profits from AlphaBay.

Cazes established a marketplace with a full range of escrow mechanisms, vendor authentication, Tor hidden services, and real infrastructure. However, it failed because of his habit of reusing an old Hotmail account that he probably never bothered to deactivate. This is the same mistake that took down Ross Ulbricht of the Silk Road, a remarkably similar case of identity slip. Old accounts don’t forget who you are, even when you’d rather they did.

Operation Bayonet: The Takedown

By July 2017, U.S. authorities had coordinated with law-enforcement agencies in several other countries as part of Operation Bayonet. This operation brought together authorities from:

• The USA 
• Thailand
• Canada
• The Netherlands
• Lithuania
• The UK
• France
• Europol

On July 5, 2017, Thai police raided Cazes’ home in Bangkok, and at that moment he was already signed into AlphaBay’s admin panel. This gave investigators live access to the marketplace’s backend. Also, his computer, apparently not protected by any encryption mechanisms, was right there.

Following this, the Justice Department released a statement. “It is one of the most important criminal investigations of the year,” declared Attorney General Jeff Sessions. “The dark web is not a place to hide,” he added.

The Justice Department also alleged that AlphaBay facilitated the distribution of illegal drugs, including fentanyl and heroin, and linked some overdose cases to purchases made through the marketplace.

The Hansa Honeypot Trap

The Hansa operation added another dimension to the investigation because Dutch authorities had already taken control of a smaller rival marketplace before AlphaBay’s takedown became public. The Dutch authorities had already covertly taken control of a smaller rival marketplace called Hansa before the public exposure of AlphaBay’s takedown.

As soon as AlphaBay became history, their displaced members simply did what displaced members always do: they panicked, and they moved on elsewhere. This is exactly how many of these AlphaBay members ended up in Hansa without even knowing that Dutch authorities had now assumed full control of the site.

In the span of almost a month, the authorities quietly logged their users’ usernames, passwords, private communications, and shipping addresses on Hansa while they continued to believe that they had found a secure spot. Researchers studying the dark web always reference this strategy: take down one market, and take charge of the next obvious destination.

The Dutch police’s expertise in targeting dark web infrastructure extended beyond the Hansa honeypot. In November 2025, they dismantled a bulletproof hosting provider that had been used by cybercriminals for ransomware, phishing, and malware operations across more than 80 investigations worldwide since 2022.

Security warning: The closure of one illicit marketplace does not establish that another marketplace is safe, private, or secure. Users should treat claims of anonymity and security on such platforms with caution.

Why the AlphaBay Takedown Mattered

AlphaBay became a major piece of the dark-web marketplace infrastructure. The vendors who were spread out across smaller sites converged there because that was where the buyers were. That concentration created a network effect: a larger buyer base could attract more vendors, while more vendors could attract additional buyers.

That concentration, while beneficial, had its own negative consequences as well. When all your eggs are in one basket, and that market goes down, the impact is enormous. The authorities realized this and made their strategy based on the idea that people would not just leave; they would move somewhere else.

Silk Road, Hansa, and AlphaBay: A Side-by-Side Comparison

Below, we are going to compare the top three major marketplaces of the dark web that went down. Let’s look at it:

What Happened to Alexandre Cazes

Cazes never made it to its trial. The US Officials were working out his extradition, and about a week after his arrest, Cazes was found dead in his Thai jail cell. Authorities said it looked like an apparent suicide, as he was just 25 years old.

His father reportedly questioned whether their son was really the criminal mastermind behind the AlphaBay case. He didn’t get into details, saying he’d wait for the autopsy results. But investigators pulled together a pretty detailed financial and digital trail.

While Cazes was captured and charged, his supposed partner DeSnake vanished without even a trace. So he never faced any charges nor caught.

AlphaBay’s Legacy

The death of Cazes wasn’t really the end of AlphaBay. The case remains relevant to cybercrime and cybersecurity research because it illustrates how investigators combined digital evidence, financial information, and international cooperation.

Operation Bayonet introduced a new strategy to deal with cybercrime. They captured the main platform and secretly operated it. They created another dark web marketplace to track the users moving in to track and capture cybercriminals. However, years later, in 2021, the AlphaBay name appeared online again.

Someone using the handle ‘DeSnake’ and claiming to be the original site’s security administrator announced the relaunch. He was supposedly honoring what he called a promise he made to Cazes. The new AlphaBay accepted Monero only. It prohibited the sale of fentanyl and firearms, and offered a new escrow alternative system named AlphaGuard. The purpose of the alternative escrow was to help vendors to recover their money in case any server confiscation happens.

According to Flashpoint’s study, the new version gained some traction before eventually losing steam as more recent platforms attracted attention. The relaunched AlphaBay also went off the radar without any explanations. There was no announcement from DeSnake nor any statement from law enforcement. To date, no one knows what happened to the new version of the website.

The AlphaBay name has also appeared in phishing pages designed to impersonate the former marketplace. For broader context on the types of sites found on the dark web, see our guide to dark web sites.

Security warning: Treat unsolicited links claiming to provide access to AlphaBay or another illicit marketplace as potentially malicious. Criminals can use familiar names and copied login pages to steal credentials, cryptocurrency, or other sensitive information. Do not enter credentials or send funds simply because a site uses the AlphaBay name.

Online Anonymity and Digital Traces

The story is equally applicable to all internet users, whether you work in cybersecurity, manage an online service, or simply use the internet. A simple error, like reusing an old, personal identifier anywhere it could lead back to you, is the same one that trips average users on a daily basis, just with less dire consequences.

A few lessons we should all learn from the downfall of Cazes (crime aside):

• Never use your personal email account for anything that does not belong in your private life, whether business, projects, or online persona.
• The metadata (headers, time stamps, file properties) should be treated as seriously as your emails. Sometimes, that background data gives away just as much as the content itself.
• One single old post or social networking account is enough to put together all sorts of information that may not have even been considered as part of the investigation.
• Do not assume that old online activity becomes irrelevant simply because time has passed. Archived posts and account information can remain accessible and may still provide useful context during an investigation.

Conclusion

AlphaBay became one of the largest known dark-web marketplaces before authorities shut it down in 2017. The marketplace incorporated features that resembled those used by conventional online marketplaces, including escrow and vendor-management systems. The investigation ultimately connected the marketplace to its administrator through a combination of digital evidence, including the personal email address found in its communications.

AlphaBay’s story is a prime example of the dark web, a portion of the internet that is intentionally hidden from standard search engines and typically requires specialized software, such as Tor, to access. For a broader understanding of the hidden internet layers, read: what is deep web.

Reader safety note: This article discusses historical criminal activity and illicit online marketplaces for educational and cybersecurity context. The information should not be interpreted as an endorsement of these services or as guidance for accessing them.

FAQs