Bohemia and Cypher: how parallel operations ended two darknet market runs
In 2023, two of the darknet's busiest marketplaces started wobbling within months of each other. Bohemia, then one of the fastest-growing drug bazaars on Tor, and the smaller but longer-running Cypher both dropped off the onion lists that vendors and buyers watch daily. What first looked like routine exit-scam drama turned out to be the visible edge of coordinated international police work.
Two markets, one pattern
The numbers behind Bohemia were striking. According to the Dutch national police, the site hosted roughly 82,000 advertisements worldwide each day and processed about 67,000 transactions monthly, peaking at EUR 12 million in turnover in September 2023 alone. Its sister market Cannabia specialised in cannabis, while Bohemia also carried counterfeit documents, malware and DDoS-for-hire offers. Cypher was a different animal entirely. Launched in February 2020, it built a reputation for reliability with around 10,000 listings and 500 vendors active by 2023, according to Searchlight Cyber researchers.How the Bohemia case unfolded
The mechanics of the investigation matter. Dutch detectives opened the file at the end of 2022 and discovered that several servers powering the markets sat inside the Netherlands, handing them a legal foothold. Working alongside Ireland, the United Kingdom and the United States, they spent 2023 quietly mapping what investigators later described as the entire infrastructure of Bohemia and Cannabia. When officers moved in, they took everything: the database server, the crypto server and the webserver. That trove of order histories, messages and wallet records now feeds vendor-level prosecutions in multiple countries, turning one seizure into a rolling series of arrests."Administrators, sellers and buyers on illegal marketplaces often believe themselves to be elusive to the police and the judiciary," said Stan Duijf, head of the operations unit of the National Investigation and Interventions.
An exit scam that fooled no one
From early October 2023, Bohemia suffered repeated outages and frozen withdrawals. On 20 November an administrator blamed a rogue developer on the forum Dread, claiming small amounts of bitcoin had been siphoned off over a month. Longtime vendors did not buy it. They were right not to. Police say the operators simply split the remaining escrow funds and disappeared late that year. But the money trail held: in June 2024 a 20-year-old British suspect was arrested at Schiphol Airport carrying devices and wallet keys, and in August Irish authorities detained 23-year-old Kevin Daniel Andrei, identified by The Record as a suspected second administrator. More than EUR 8 million in virtual assets and two vehicles were seized.The wider dragnet of 2023
Bohemia was not an isolated target. In June 2023, Europol and the Justice Department announced Operation SpecTor, a nine-country sweep built around the seizure of Monopoly Market that produced 288 arrests plus EUR 50.8 million in cash and cryptocurrency. The timeline shows how the pressure compounded:- April 2023: Genesis Market is seized in Operation Cookie Monster, with around 120 arrests.
- June 2023: Monopoly Market falls in Operation SpecTor across nine countries.
- Late 2023: Bohemia and Cannabia go dark after their administrators run an exit scam.
- 2024 onwards: seized Bohemia data feeds further arrests and later international sweeps.