Hansa (market)

Last updated
Hansa Market
Logo of Hansa market.png
Type of site
Darknet market
Available in English
URLhansamkt2rr6nfg3.onion(defunct) [1]
Current statusOffline

Hansa was an online darknet market which operated on a hidden service of the Tor network.


On July 20, 2017, it was revealed that it had been compromised by law enforcement for several weeks before closing shortly following AlphaBay as a culmination of multinational law enforcement cooperation in Operation Bayonet. [2] [3]


Dutch police discovered the true location of the site after a 2016 tip from security researchers who had discovered a development version. [4] The police quickly began monitoring all actions on the site, and discovered that the administrators had left behind old IRC chat logs including their full names and even a home address, and they began to monitor them. Although the administrators soon moved the site to another unknown host, they got another break in April 2017 by tracing bitcoin transactions, which allowed them to identify the new hosting company, in Lithuania.

On June 20, 2017, German police arrested the administrators (two German men) and the Dutch police were able to take complete control of the site and to impersonate the administrators. Their plan, in coordination with the FBI, was to absorb users coming over from the upcoming AlphaBay shutdown. The following changes were made to the Hansa website to learn about careless users:


AlphaBay was then shut down on July 4, and as expected a flood of users came to Hansa, until its shutdown on July 19/20. During this time, the police allowed the Hansa userbase (then growing from 1000 to 8000 vendors per day [3] ) to make 27000 illegal transactions in order to collect evidence for future prosecution of users. [4] [7] Local cybercrime prosecutor Martijn Egberts claimed to have obtained around 10,000 addresses of Hansa buyers outside of the Netherlands. [8]

After shut down, the site displayed a seizure notice and directed users to their hidden service [9] to find more information about the operation.

Related Research Articles

Silk Road (marketplace) 2011–2014 darknet market known for the sale of illegal drugs

Silk Road was an online black market and the first modern darknet market, best known as a platform for selling illegal drugs. As part of the dark web, it was operated as a Tor hidden service, such that online users were able to browse it anonymously and securely without potential traffic monitoring. The website was launched in February 2011; development had begun six months prior. Initially there were a limited number of new seller accounts available; new sellers had to purchase an account in an auction. Later, a fixed fee was charged for each new seller account. Silk Road provided goods and services to over 100,000 buyers.

The dark web is the World Wide Web content that exists on darknets: overlay networks that use the Internet but require specific software, configurations, or authorization to access. Through the dark web, private straphanger networks can communicate and conduct business anonymously without divulging identifying information, such as a user's location. The dark web forms a small part of the deep web, the part of the Web not indexed by web search engines, although sometimes the term deep web is mistakenly used to refer specifically to the dark web.

Sheep Marketplace

Sheep Marketplace was an anonymous marketplace set up as a Tor hidden service. It launched in March 2013 and was one of the lesser known sites to gain popularity with the well publicized closure of the Silk Road marketplace later that year. It ceased operation in December 2013, when it announced it was shutting down after a vendor stole $6 million worth of users' bitcoins.

Operation Onymous International police operation targeting darknet markets

Operation Onymous was an international law enforcement operation targeting darknet markets and other hidden services operating on the Tor network.

Agora was a darknet market operating in the Tor network, launched in 2013 and shut down in August 2015.

Evolution (marketplace)

Evolution was a darknet market operating on the Tor network. The site was founded by an individual known as 'Verto' who also founded the now defunct Tor Carding Forum.

Doxbin Document sharing website

Doxbin was a document sharing and publishing website which invited users to contribute personally identifiable information, or "dox", of any person of interest. It was previously operated on the darknet as a Tor hidden service, by a person known on the internet as nachash. Since its takedown in 2014, nachash has stepped down and relinquished his ownership to a predecessor that used the username, king oren, when interviewed. He told in an interview that he is hosting the Doxbin on public access, referring to World Wide Web, as well as on darknet and Tor hidden service websites, although he would not release the link to either of them, saying, "The people that use the service, know how to find it, that's what keeps it secure and out of the reach of incompetent people using it for malice things".

Monero is a privacy-focused cryptocurrency released in 2014. It is an open-source protocol based on CryptoNote. It uses an obfuscated public ledger, meaning anyone can send or broadcast transactions, but no outside observer can tell the source, amount, or destination. A proof of work mechanism is used to issue new coins and incentivize miners to secure the network and validate transactions.


AlphaBay Market was an online darknet market which operated on an onion service of the Tor network. It was shut down after a law enforcement action as a part of Operation Bayonet against it in the United States, Canada, and Thailand, reported 13 July 2017. The alleged founder, Alexandre Cazes, a Canadian citizen born on 19 October 1991, was found dead in his cell in Thailand several days after his arrest; suicide is suspected.

TheRealDeal was a darknet website and a part of the cyber-arms industry reported to be selling code and zero-day software exploits.

A darknet market is a commercial website on the web that operates via darknets such as Tor or I2P. They function primarily as black markets, selling or brokering transactions involving drugs, cyber-arms, weapons, counterfeit currency, stolen credit card details, forged documents, unlicensed pharmaceuticals, steroids, and other illicit goods as well as the sale of legal products. In December 2014, a study by Gareth Owen from the University of Portsmouth suggested the second most popular sites on Tor were darknet markets.

Cryptocurrency tumbler or cryptocurrency mixing service is a service offered to mix potentially identifiable or 'tainted' cryptocurrency funds with others, so as to obscure the trail back to the fund's original source. Tumblers have arisen to improve the anonymity of cryptocurrencies, usually bitcoin, since the currencies provide a public ledger of all transactions.

DeepDotWeb was a news site dedicated to events in and surrounding the dark web featuring interviews and reviews about darknet markets, Tor hidden services, privacy, bitcoin and related news. The website was seized on May 7, 2019 during an investigation into the owners' affiliate marketing model, in which they received money for posting links to certain darknet markets.

Grams is a discontinued search engine for Tor based darknet markets launched in April 2014, and closed in December 2017. The service allowed users to search multiple darknet markets for products like drugs and guns from a simple search interface, and also provided the capability for its users to hide their transactions through its bitcoin tumbler Helix.

The Hub is a discussion forum on Tor hidden services on the dark web focused on darknet market reviews, cryptocurrency and security.

An exit scam is a confidence trick where an established business stops shipping orders while continuing to receive payment for new orders. If the entity had a good reputation, then it can take some time before it is widely recognized that orders are not shipping, and the entity can then make off with the money paid for unshipped orders. Customers that trusted the business do not realize that orders are not being fulfilled until the business has already disappeared.

Operation Bayonet was a multinational law enforcement operation culminating in 2017 targeting the AlphaBay and Hansa darknet markets. Many other darknet markets were also shut down.

Dream Market Online black market

Dream Market was an online darknet market founded in late 2013. Dream Market operated on a hidden service of the Tor network, allowing online users to browse anonymously and securely while avoiding potential monitoring of traffic. The marketplace sold a variety of content, including drugs, stolen data, and counterfeit consumer goods, all using cryptocurrency. Dream provided an escrow service, with disputes handled by staff. The market also had accompanying forums, hosted on a different URL, where buyers, vendors, and other members of the community could interact.

Dread (forum) Online discussion forum hosted on the dark web

Dread is a Reddit-like dark web discussion forum featuring news and discussions around darknet markets. The site's administrators go by the alias of Paris and HugBunter.


  1. "Deep Dot Web - Hansa". Archived from the original on 2015-08-12.
  2. "Massive blow to criminal Dark Web activities after globally coordinated operation". 20 July 2017. Retrieved 20 July 2017.
  3. 1 2 "Underground Hansa Market taken over and shut down". Politie (Dutch Police). 20 July 2017.
  4. 1 2 3 4 5 6 7 8 "Operation Bayonet: Inside the Sting That Hijacked an Entire Dark Web Drug Market". Wired. 2018-03-08.
  5. Cox, Joseph (August 25, 2017). "This Is How Cops Trick Dark-Web Criminals Into Unmasking Themselves". The Daily Beast .
  6. pxx51092 (July 25, 2017). "DON'T open the xlsx locktime file, beacon image confirmed in it with Hansa's server IP address". reddit. Archived from the original on October 9, 2017.
  7. Riggs, Mike (2017-07-26). "Five Lessons from the Hansa and AlphaBay Busts". Reason Hit&Run. Retrieved 2017-07-26.
  8. Satter, Raphael; Bajak, Frank (2017-07-21). "Dutch 'darknet' drug marketplace shut down". Portland Press Herald. Retrieved 2017-07-22.
  9. DeepDotWeb (31 October 2016). "Dutch National Prosecution Service and police launch Hidden Service in global Darknet enforcement operation". Archived from the original on 1 November 2016. Retrieved 26 July 2017.