Darknet & Illicit Markets

Raheim Hamilton, co-creator of the $430M darknet market Empire Market, was sentenced to 40 years on October 5, 2026. The case ties his 'ZeroAngel' AlphaBay counterfeiting past to the Tor and crypto machinery of a 4-million-transaction market — and to ~1,230 BTC seized despite coin tumbling.

A threat actor advertised ~800,000 TCS employee-directory records from a wider Azure/Entra data-theft campaign; TCS told Indian exchanges on 10 August 2026 it found no credible evidence of a breach.

On May 19-20, 2026, Europol and Eurojust's Operation Saffron took down First VPN — a bulletproof service running since 2014 and used by 25+ ransomware groups. Investigators infiltrated it, seized 33+ servers and unmasked ~506 users. The Ukrainian admin was searched and interviewed, not arrested.

ShinyHunters defaced the Clop ransomware gang's Tor leak site with its Umbreon logo and claims it stole the source code, /var/log, and Clop's onion private keys — retaliation over the 2025 Oracle EBS exploit dispute. Only the defacement is independently confirmed; the theft claims are not.

A dark-web service called Nexus sold infrared and ultraviolet scans of 153 million North American driver's licences, traced by Krebs to identity-verification vendor IDScan.net. The vendor's own documentation shows its cloud retained every scan indefinitely by default.

A market that took only Monero ran for five years and €330 million. The playbook that broke Silk Road and AlphaBay did not apply — and the authorities who dismantled it have not said what did.

In mid-2025, the Narcotics Control Bureau (NCB) Cochin Zonal Unit executed Operation MELON, dismantling India's premier Level-4 darknet narcotics syndicate operating under the vendor moniker...