Hansa was an online darknet market which operated on a hidden service of the Tor network.

With the closure of AlphaBay in June 2017, it was predicted to become one of the leading markets.[2] However on July 20, 2017 it was revealed that it had been compromised by law enforcement for several weeks before closing shortly after AlphaBay as a culmination of multinational law enforcement operation Operation Bayonet.[3][4]

Dutch police impersonated the site's administrators, collecting usernames and passwords. Local cybercrime prosecutor Martijn Egberts claimed to have obtained around 10,000 addresses of Hansa buyers outside of the Netherlands.[5] During this time, the police allowed the Hansa userbase (then growing from 1000 to 8000 vendors per day, due to the AlphaBay shutdown[4]) to make illegal transactions in order to collect evidence for future prosecution of users.[6] After the takeover, investigators are believed to have modified a file Hansa users downloaded in order to get a summary of their recent transactions.[7] The file was changed from a text file to a Microsoft Excel spreadsheet which, when opened, transmitted the IP address of the user to an OVH-hosted server.[7][8]

After shut down, the site displayed a seizure notice and directed users to their hidden service politiepcvh42eav.onion/hansafaq.html[9] to find more information about the operation.[10]


  1. ^ "Deep Dot Web - Hansa". 
  2. ^ Buntinx, JP (16 July 2017). "Top 4 Darknet Marketplaces Poised to Take AlphaBay's Place". Retrieved 20 July 2017. 
  3. ^ "Massive blow to criminal Dark Web activities after globally coordinated operation". 20 July 2017. Retrieved 20 July 2017. 
  4. ^ a b "Underground Hansa Market taken over and shut down". Politie (Dutch Police). 20 July 2017. 
  5. ^ Satter, Raphael; Bajak, Frank (2017-07-21). "Dutch 'darknet' drug marketplace shut down". Portland Press Herald. Retrieved 2017-07-22. 
  6. ^ Riggs, Mike (2017-07-26). "Five Lessons from the Hansa and AlphaBay Busts". Reason Hit&Run. Retrieved 2017-07-26. 
  7. ^ a b Cox, Joseph (August 25, 2017). "This Is How Cops Trick Dark-Web Criminals Into Unmasking Themselves". The Daily Beast. 
  8. ^ pxx51092 (July 25, 2017). "DON'T open the xlsx locktime file, beacon image confirmed in it with Hansa's server IP address". reddit. Archived from the original on October 9, 2017. 
  9. ^ DeepDotWeb (31 October 2016). "Dutch National Prosecution Service and police launch Hidden Service in global Darknet enforcement operation". Retrieved 26 July 2017. 
  10. ^ Vitaris, Benjamin (20 July 2016). "Hansa Market Taken Down in Global Law Enforcement Operation". 

External links