Laws & enforcement

Operation · ransomwareEuropean Union

KillSec ransomware takedown

A Hamburg-led operation seized KillSec’s leak site and servers. A 16-year-old is the suspected leader.

Operation · scam infrastructureUnited States

Xinbi Guarantee marketplace

DOJ seized infrastructure and about $12M from a marketplace serving scam centres. OFAC sanctioned it the same day.

Operation · malwareEuropean Union

Operation Endgame (SocGholish, Amadey, StealC)

326 servers and 142 domains were taken down, and over €41M in crypto was identified and restricted.

Operation · exchangeUnited States

Huione Guarantee backend seizure

DOJ seized the cloud backend of Huione Group’s guarantee marketplaces, used to launder scam-centre money.

Operation · mixerEuropean Union

AudiA6 crypto laundering service

A service sold as a crypto mixer, suspected of laundering €336M for ransomware gangs, was shut down. Two admins were arrested in Georgia.

Operation · otherGermany

Darknet vendors’ crypto cash-out network

Eight arrests over darknet drug sales cashed out through an underground-banking network. Over €100M passed through the main wallets.

Operation · hostingEuropean Union

First VPN (1VPNS) takedown

France and the Netherlands dismantled a VPN sold to ransomware gangs with anonymous payment. OFAC sanctioned it in July 2026.

Operation · marketplaceGermany

Crimenetwork relaunch shut down

German police shut the relaunched Crimenetwork market, paid in BTC, LTC and XMR, and arrested its alleged operator.

Operation · marketUnited States

Kingdom Market admin sentenced

An administrator of the Kingdom darknet market was sentenced to 200 months in prison.

Operation · marketUnited States

Versus Market co-founder extradited

A co-founder of the Versus darknet market, which had over 380,000 users, was extradited from Colombia to the US.

Operation · DDoSEuropean Union

Operation PowerOFF action week (2026)

21 countries targeted over 75,000 DDoS-for-hire users, took down 53 domains and made 4 arrests.

Operation · botnetUnited States

Aisuru and Kimwolf DDoS botnets

US, German and Canadian action disrupted the IoT botnets behind record-size DDoS attacks.

Operation · marketplaceEuropean Union

LeakBase forum takedown

A stolen-data forum with over 142,000 users was seized in about 100 actions across 14 countries.

Operation · marketUnited States

Incognito Market sentencing

Owner Rui-Siang Lin got 30 years for running a darknet drug market that sold over $105M in narcotics.

Operation · mixerUnited States

Helix mixer forfeiture

A US court finalised forfeiture of over $400M in assets tied to the Helix darknet mixer. Operator Larry Harmon got 36 months in 2024.

Operation · marketplaceUnited States

Stolen-password database seizure

DOJ announced seizure of a stolen-password database used for bank-account takeover.

Operation · exchangeUnited States

e-Note laundering platform

FBI disrupted a virtual money-laundering service used to facilitate criminal activity, including ransomware cash-out.

Operation · otherUnited States

Exodus wallet OFAC settlement

Wallet maker Exodus paid $3.1M over 254 apparent Iran sanctions violations from 2017–2019.

Operation · exchangeUnited States

FinCEN penalty on Paxful

FinCEN fined the P2P platform Paxful $3.5M for operating without an AML programme or suspicious-activity reports.

Operation · scam infrastructureUnited States

Tai Chang scam-compound domain

DOJ announced seizure of a domain used in a cryptocurrency investment scam compound.

Operation · mixerEuropean Union

Operation Olympia (CryptoMixer)

Europol, BKA and Swiss police seized cryptomixer.io servers in Zurich and over €25M in bitcoin. It had mixed over €1.3B since 2016.

Operation · otherUnited Kingdom

Operation Destabilise phase 2

The NCA exposed a Russia-linked network swapping criminal cash for crypto. Arrests reached 128.

Operation · hostingUnited States

Media Land bulletproof hosting

The US, UK and Australia sanctioned Media Land, a host for LockBit, BlackSuit and Play ransomware. Its operators were indicted in July 2026.

Operation · mixerUnited States

Samourai Wallet sentencing

Samourai founders Keonne Rodriguez and William Hill were sentenced to 5 and 4 years in prison.

Operation · infostealerEuropean Union

Operation Endgame (Rhadamanthys, VenomRAT)

Europol-led action took down over 1,000 servers behind the Rhadamanthys infostealer, VenomRAT and the Elysium botnet.

Operation · exchangeCanada

FINTRAC penalty on Cryptomus

FINTRAC fined Cryptomus about C$177M for not reporting transactions tied to darknet markets, ransomware and sanctions evasion.

Operation · otherEuropean Union

Operation SIMCARTEL

Raids dismantled SIM-farm infrastructure used for OTP bypass and account takeover, with arrests and server seizures.

Operation · scam infrastructureUnited States

Prince Group / Chen Zhi (127,271 BTC)

DOJ indicted Prince Group chairman Chen Zhi over scam compounds and sought forfeiture of about 127,271 BTC. The US and UK sanctioned the group the same day.

Operation · exchangeCanada

TradeOgre seizure

RCMP seized TradeOgre infrastructure and a large amount of crypto — among Canada’s largest digital-asset seizures.

Operation · ransomwareUnited States

BlackSuit (Royal) ransomware disruption

US and partners took down BlackSuit servers and domains and unsealed a warrant to seize about $1.09M in crypto.

Operation · marketplaceEuropean Union

XSS forum administrator arrest

The suspected admin of the Russian-language cybercrime forum XSS was arrested in Kyiv. He allegedly earned over €7M in fees.

Operation · DDoSEuropean Union

Operation Eastwood / NoName057(16)

Action against the pro-Russian DDoS network, with European arrests and US charges.

Operation · malwareUnited Kingdom

Scattered Spider-style retail arrests (NCA)

NCA arrested suspects over cyberattacks on UK retailers, with data monetized through resale channels.

Operation · hostingUnited States

Aeza Group sanctions

OFAC sanctioned the Russian bulletproof host Aeza Group for hosting ransomware, infostealers and the BlackSprut darknet market.

Operation · marketEuropean Union

Archetyp Market takedown

A German-led action shut a darknet drug market with over 600,000 users and €250M in trades. The admin was arrested in Spain.

Operation · infostealerEuropean Union

Operation Secure (infostealers)

INTERPOL-coordinated action against infostealer infrastructure, taking down malicious IPs and domains.

Operation · marketplaceUnited States

BidenCash carding market

The US seized about 145 BidenCash domains and crypto. The market had over 117,000 customers.

Operation · infostealerEuropean Union

Lumma infostealer disruption

Europol and Microsoft disrupted Lumma, described as one of the largest infostealer operations.

Operation · marketUnited States

Operation RapTOR

US and Europol action against darknet traffickers across multiple markets, with large seizures of drugs, firearms, and proceeds.

Operation · DDoSEuropean Union

DDoS-for-hire empire (Poland)

Administrators arrested and domains seized in a takedown of crypto-paid booter services.

Operation · exchangeEuropean Union

eXch seizure

German BKA and ZIT shut down eXch on 30 April 2025 and seized about €34M in crypto. Part of the Bybit hack proceeds was allegedly swapped through it.

Operation · mixerUnited States

Tornado Cash OFAC delisting

Treasury removed Tornado Cash from the SDN list. The 2022 designation remains in this table for context. Developer cases continue separately.

Operation · ransomwareEuropean Union

8Base / Phobos ransomware arrests

JC3 partners arrested key figures behind Phobos and 8Base ransomware and dismantled leak-site infrastructure.

Operation · mixerUnited States

Roman Storm / Tornado Cash trial proceedings

A 2025 jury convicted the Tornado Cash developer on one count and hung on the rest; a retrial is set for April 2027. Storm’s legal defence fundraiser: https://freeromanstorm.com/donate

Operation · botnetUnited States

911 S5 proxy botnet

US and partners disrupted the 911 S5 residential proxy botnet used to conceal cybercrime.

Operation · botnetEuropean Union

Operation Endgame (dropper botnets)

Largest-ever operation against dropper malware ecosystems, taking down servers and domains used to deliver ransomware.

Operation · mixerUnited States

Samourai Wallet arrests and seizure

FBI seized Samourai infrastructure and arrested Keonne Rodriguez and William Lonergan Hill over Whirlpool and related tools.

Operation · ransomwareUnited Kingdom

LockBit disruption

US and UK action disrupted LockBit infrastructure, with arrests and recovery of decryptors.

Operation · botnetUnited States

Volt Typhoon botnet disruption

US government disrupted a PRC-linked botnet used to conceal hacking of critical infrastructure.

Operation · mixerUnited States

Sinbad.io OFAC designation and seizure

Treasury designated Sinbad.io; partners seized servers in Europe the same period.

Operation · botnetUnited States

Qakbot botnet disruption

An international cyber action disrupted Qakbot infrastructure used as an initial access tool for ransomware.

Operation · marketUnited States

Operation SpecTor

International action against darknet traffickers, with large-scale arrests and seizures of drugs, firearms, and crypto.

Operation · DDoSUnited Kingdom

Operation PowerOFF

NCA and partners shuttered booter/stresser portals and arrested administrators.

Operation · marketplaceUnited States

Genesis Market disruption

Court-authorized action disrupted Genesis Market, a bazaar for stolen credentials and bot access.

Operation · mixerEuropean Union

ChipMixer seizure

Europol and BKA seized ChipMixer infrastructure and Bitcoin, and pursued the operator.

Operation · ransomwareUnited States

Hive ransomware disruption

FBI infiltrated Hive’s panel, obtained decryptors, and disrupted the variant used against hospitals and other victims.

Operation · mixerUnited States

Tornado Cash OFAC designation

OFAC designated the Tornado Cash mixer and listed associated smart-contract addresses. This 2022 action is kept for context; the SDN listing was later removed.

Operation · mixerUnited States

Blender.io OFAC designation

OFAC sanctioned Blender.io, the first mixer designation, citing DPRK-linked laundering.

Operation · marketUnited States

Hydra Market

DOJ and German authorities announced the shutdown of Hydra, then the largest darknet market, and related crypto seizures.

Operation · hostingEuropean Union

DoubleVPN seizure

Authorities seized DoubleVPN, a service marketed to cybercriminals to hide traffic.

Operation · mixerUnited States

Bitcoin Fog arrest (Roman Sterlingov)

Roman Sterlingov was arrested in Los Angeles; prosecutors later obtained a conviction related to Bitcoin Fog.

Operation · botnetEuropean Union

Emotet botnet disruption

An international action disrupted Emotet infrastructure used as a loader for ransomware and banking malware.

Operation · ransomwareUnited States

NetWalker ransomware disruption

DOJ announced global action against NetWalker, including charges and seizures tied to ransom payments.

Operation · marketEuropean Union

DarkMarket

German police, with Europol support, took down DarkMarket, then described as the world’s largest illegal dark-web marketplace.

Operation · marketUnited States

Operation DisrupTor

International action against darknet opioid vendors, with arrests and seizures of cash, drugs, weapons, and crypto.

Operation · mixerUnited States

Helix / Larry Harmon indictment

DOJ indicted Helix operator Larry Harmon for laundering proceeds of darknet markets; he later pleaded guilty.

Operation · marketplaceUnited States

Welcome to Video

DOJ announced the takedown of the Welcome to Video site and arrests of users who paid in Bitcoin.

Operation · mixerEuropean Union

Bestmixer.io seizure

Dutch FIOD and Europol seized Bestmixer infrastructure, shut down servers, and published transaction records.

Operation · marketplaceUnited States

DeepDotWeb

The administrator of DeepDotWeb was charged with laundering kickbacks from darknet market referral links.

Operation · marketEuropean Union

Wall Street Market

German and US authorities seized Wall Street Market and arrested its administrators.

Operation · marketplaceUnited States

Infraud carding organization

Indictments hit Infraud, a carding forum whose sellers monetized stolen cards via BTC escrow and mule cashouts.

Operation · exchangeUnited States

BTC-e / Alexander Vinnik

DOJ charged BTC-e and Alexander Vinnik with operating an unlicensed exchange used to launder proceeds of hacks and ransomware.

Operation · marketUnited States

AlphaBay darknet market

Agents seized AlphaBay’s Tor infrastructure, froze escrow wallets, and arrested administrator Alexandre Cazes in Thailand.

Operation · marketEuropean Union

Hansa Market (covert takeover)

Dutch police ran Hansa covertly after AlphaBay fell, identifying vendors and buyers before shutting the market.

Operation · botnetUnited States

Kelihos botnet (Peter Levashov)

A Russian national pleaded guilty to operating the Kelihos botnet used for spam, credential theft, and malware distribution.

Operation · DDoSEuropean Union

DDoS-for-hire user sweep

Europol warned and arrested dozens of mostly teenage clients of booter services that sold PayPal and crypto subscriptions for DDoS attacks.

Operation · hostingEuropean Union

Avalanche network

Partners dismantled the Avalanche fast-flux hosting ring used to deliver Dridex and Zeus, seizing hundreds of thousands of domains and dozens of servers.

Operation · malwareUnited States

GozNym malware network

DOJ and Europol targeted the GozNym banking-trojan crew that drained accounts and moved proceeds through mule networks and BTC-friendly exchangers.