German police shut down a revived Crimenetwork marketplace with 22,000 users and 100+ sellers months after the original takedown.
German police dismantled a resurrected version of the German-language cybercrime marketplace Crimenetwork, just months after the original platform was taken down. The second iteration of the site had already attracted more than 22,000 users and over 100 sellers, showing how quickly underground markets can recover when operators are able to rebuild their infrastructure.
“Before being shut down by law enforcement at the end of 2024, “Crimenetwork” was for many years one of the central marketplaces of the German-speaking underground economy. The relaunch of the platform offered a similarly wide range of illegal goods and services, including stolen data, drugs, and forged documents. The relaunch most recently boasted over 22,000 users and more than 100 vendors.” reads the announcement by BKA. “Users of the new platform used cryptocurrencies such as Bitcoin, Litecoin, and Monero to conduct their transactions. During the operation, law enforcement secured extensive evidence suggesting the platform generated revenue exceeding €3.6 million.”
According to German authorities, the marketplace was being used to trade a broad range of illegal goods and services, including stolen personal data, drugs, forged documents, and other criminal offerings. Payments were made through cryptocurrencies such as Bitcoin, Litecoin, and Monero, making it easier for users to hide financial trails and move funds across borders. Investigators believe the platform generated more than €3.6 million in revenue before it was shut down.
Crimenetwork had originally been dismantled in December 2024. Since 2012, Crimenetwork facilitated the sale of illegal goods and services, including drugs, forged documents, hacking tools, and stolen data. The platform served as a hub for cybercriminals to trade and coordinate illegal operations.
At the time, police described it as the largest German-speaking criminal marketplace. Investigators estimated that more than $100 million in cryptocurrency had passed through the platform between 2018 and 2024, underlining the scale of the business and the level of trust it had built within the criminal underground.
In late 2024, police arrested a 29-year-old alleged admin of the marketplace, seized €1M in assets, and charged him with enabling sales of drugs, stolen data, and illegal services. He is not in custody.
Public Prosecutor’s Office in Frankfurt carried out the operation am Main, the Central Office for Combating Cybercrime (ZIT), and the Federal Criminal Police Office (BKA).
What makes the latest takedown important is not only the shutdown itself, but also the arrest linked to the operation. Police said a 35-year-old German citizen suspected of being the administrator was detained in Mallorca by Spanish authorities. That arrest is significant because it suggests investigators were able to move beyond the platform’s technical infrastructure and identify a person directly involved in running it.
In addition to the arrest, law enforcement seized around €194,000 in assets connected to the marketplace. Authorities also obtained extensive user and transaction records, which are now being analyzed to better understand the criminal network behind the site and possibly identify vendors, buyers, and support actors who remained active on the platform.
The Crimenetwork case is a good reminder that online crime markets are often resilient. When one site is taken down, a successor may appear soon after on new servers, with a new interface and the same criminal audience. That happened here: the original platform was removed, but a new version emerged days later and quickly regained users and sellers.
Still, the case also shows that repeated law-enforcement pressure can make these markets harder to sustain. A marketplace is not just software. It depends on administrators, payment handling, trust systems, and a stable community of vendors and buyers. Once police start seizing data, freezing assets, and arresting people behind the scenes, rebuilding becomes much harder.
German police have been increasingly active against this type of infrastructure. The Crimenetwork operation fits into a broader pattern of investigations targeting cybercrime forums, darknet shops, and other illicit marketplaces that serve as distribution hubs for stolen data and fraud tools. These actions matter because marketplaces like this do not just sell illegal products; they help professionalize cybercrime by giving offenders a place to meet, trade, and scale their operations.
Other successful German police actions against online crime marketplaces show the same approach: follow the money, collect transaction data, identify the administrators, and work with foreign partners when suspects or servers are abroad. That combination has repeatedly led to arrests and seizures that weaken the ecosystem behind the platforms.
In April 2022, German authorities shut down Hydra, one of the world’s largest dark web marketplace. The seizure of the Hydra Market is the result of an international investigation conducted by the Central Office for Combating Cybercrime (ZIT) in partnership with U.S. law enforcement authorities since August 2021.
Hydra was a top Russian Darknet market famous among Russian speaking users that have been active since 2015.
According to the authorities, its sales amounted to at least 1.23 billion euros in 2020 alone. The German police seized approximately EUR 23 million worth of Bitcoin. The German authorities reported that around 17 million customers and over 19,000 seller accounts were registered on the Hydra Market.
The key lesson from Crimenetwork is clear. Shutting down a site is important, but the real disruption comes when investigators also remove the people, funds, and data that keep it alive. Without that pressure, a marketplace can return almost immediately. With it, the cost of rebuilding rises sharply.
For law enforcement, that makes marketplace disruption less of a one-time operation and more of a long campaign. For the criminal underground, it is a warning that even a revived platform may not stay online for long.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, cybercrime)
