alphabay: a seized market, kept on file as history

The takedown ran alongside the seizure of Hansa, which had quietly been under control for weeks. Users who fled AlphaBay for Hansa walked into a monitored site. That pairing is why torindex treats a sudden new home for a dead market with suspicion rather than relief.

Search demand for a famous name does not stop when the site does. That leftover demand is what phishers feed on. A clear record with the real end date is the cheapest defence: if a link promises the return of AlphaBay, the date on this torindex page is the fastest way to know better. The Electronic Frontier Foundation covers the deanonymization risk of exactly this kind of impersonation attack in its broader digital-security guidance, and the same caution applies whether the lure is a fake AlphaBay revival or any other brand-name clone.

Revival scams follow a script. Someone registers a fresh onion, borrows the old logo, and posts a link on a forum with a story about the team quietly rebuilding. The address looks plausible because nobody remembers the original character by character, which is the whole trick. A little urgency gets added, often a claim that the first wave of invites is closing, so you act before you check.

• The end date on record predates any claimed comeback, so the timeline does not add up.
• The only proof offered is a screenshot or a matching logo, never a signed address.
• The link spreads through comments and chats rather than a source you already trust.

None of those signs are subtle once you look for them. The record on this torindex page exists so the first sign, the date, is always one click away.

Known addresses

There are none, deliberately. Unlike an active torindex market record, a seized-market entry carries no address field to fill in — the empty state above is itself the record, not a placeholder waiting on a future update.

How we verified this AlphaBay record

Confirming a seizure is different from confirming a live onion. This entry rests on the public record of the July 2017 law-enforcement operation and the Hansa pairing that followed, not a probe result. torindex treats a documented, publicly reported takedown as settled fact and does not re-open it every time a revival claim circulates.

Status history for this AlphaBay entry

One status, unchanged since this torindex record was first written: Seized, ended July 2017. If credible evidence of a genuine, verifiable relaunch ever surfaced — which has not happened — that would be a new record with its own address and its own verification trail, not a quiet edit to this historical one.

The lesson from 2017 is worth keeping close. As AlphaBay fell, users poured into Hansa looking for a new home, and Hansa had already been under quiet control for weeks. The safe-looking alternative was the trap itself. That pattern is why a sudden, convenient replacement for a fallen market deserves more suspicion than a market that simply stays gone. Comfort is the feeling a good trap is built to give you.

This torindex record exists because the dates below are matters of public law-enforcement and press record, not because torindex investigated AlphaBay itself. Every date here is drawn from the same kind of public sourcing torindex uses for any seized-market entry: official takedown announcements and corroborated, widely reported journalism, never a single anonymous claim.

2014: launch

AlphaBay opened in late 2014 and grew steadily over the following years, eventually becoming the largest active dark-web marketplace by listing volume and traffic before its seizure — a scale that made its takedown one of the largest coordinated law-enforcement actions against a darknet market up to that point.

July 2017: Operation Bayonet

In July 2017, AlphaBay went offline. It later emerged that this was not an exit scam or a technical failure but a coordinated law-enforcement seizure — publicly named Operation Bayonet — carried out jointly by agencies including the FBI, the DEA, and international partners, with infrastructure and financial records seized as part of the action.

The Hansa pairing: what made this seizure unusual

What distinguished this takedown from most market seizures on this torindex graveyard is what happened next. Dutch police had already covertly taken control of Hansa, a smaller competing market, and kept it running under police control after AlphaBay's seizure specifically to capture the wave of displaced AlphaBay vendors and buyers who migrated there believing it was safe. Hansa was taken fully offline only after that operation concluded.

Why torindex keeps this timeline attached to the record

A reader who only sees "Seized, 2017" on the torindex master index table above gets the status but not the shape of the event. torindex keeps the fuller timeline on this dedicated record specifically because the Hansa pairing is the single most relevant fact for spotting a fake revival: a scammer invoking the AlphaBay name today is invoking a market whose actual operators are a matter of public criminal record, not an active, ongoing project with legitimate continuity.

torindex keeps this AlphaBay record not because AlphaBay itself still matters operationally — it does not — but because the pattern this seizure demonstrates applies to every onion market torindex tracks today. torindex treats the AlphaBay-Hansa sequence as the clearest available case study for why a torindex Checking status is worth reading carefully rather than skimming past.

Every onion market torindex lists could end the same three ways

torindex's graveyard exists because every active onion market on the marketplaces branch will eventually end by one of the same three routes AlphaBay and its contemporaries did: a law-enforcement seizure, an operator exit, or a quiet shutdown. torindex does not treat any currently Checking entry as exempt from that pattern — the AlphaBay record exists specifically so that pattern is not abstract.

Why torindex's own status word is deliberately narrow

AlphaBay's own operators presumably believed their infrastructure was secure until the moment it was not. torindex's Checking status was never designed to predict that kind of failure in advance — it only confirms reachability and identity on the date checked, nothing about an operator's internal security posture. Reading this AlphaBay record alongside any live torindex onion market entry is a useful reminder of exactly how much a Checking status does and does not promise.

How torindex expects a reader to apply this lesson

torindex does not expect a reader to distrust every current onion market entry because AlphaBay eventually fell — that would defeat the purpose of maintaining a directory at all. torindex does expect a reader to treat "last confirmed reachable" as exactly that, a dated fact rather than an ongoing guarantee, the same discipline this AlphaBay record is here to reinforce by example.

Why torindex keeps this specific record instead of a generic warning

torindex could have written a single generic paragraph about revival scams and pointed every graveyard entry at it. torindex chose the more work-intensive path instead: a full, dated record for each seized or defunct project, AlphaBay included, because a generic warning has no specific dates or specific operators to check a claim against. This AlphaBay record gives torindex, and every torindex reader, something concrete — July 2017, Operation Bayonet, the Hansa pairing — to compare any future AlphaBay-branded claim against, rather than a vague reminder to "be careful."