Inside the Nemesis Market seizure: how German and US investigators dismantled a three-year darknet bazaar
On March 20, 2024, visitors to Nemesis Market found something unusual where the vendor listings used to be: a law enforcement seizure banner, backed by German federal police and US agencies. The Tor-based marketplace, one of the more active mid-sized platforms of its era, was finished. Its servers had been quietly taken in Germany and Lithuania, and its alleged founder would spend the next year learning that infrastructure is only ever rented anonymity.
How the takedown actually happened
The operation was led by Germany's Federal Criminal Police Office (BKA) and the Frankfurt public prosecutor's cybercrime unit (ZIT), working in parallel with the FBI, the DEA, and IRS Criminal Investigation. According to the BKA press release, investigators had been running the joint effort since October 2022, an eighteen-month build-up before the single coordinated action day. The mechanics were conventional but effective. Investigators located the market's physical server infrastructure hosted in Germany and Lithuania rather than chasing the onion address itself. In a synchronized raid on March 20, both server locations were secured simultaneously, so operators could not migrate or wipe anything. Roughly 94,000 euros in cryptocurrency sitting in market-controlled wallets was confiscated at the same time. Once the infrastructure was in hand, the .onion property was repurposed. Visitors were served the standard seizure notice, and the BKA even embedded a retro-style video game animation as a flourish, a detail noted by BleepingComputer's coverage. No arrests of administrators were announced that day; the seized data itself was the prize.What the numbers said about Nemesis
Nemesis launched in 2021 and grew fast. By seizure it counted more than 150,000 registered users and over 1,100 seller accounts worldwide, with nearly 20 percent of vendors based in Germany, per the BKA. The listings ran the familiar spectrum: narcotics, stolen data and cards, counterfeit documents, plus cybercrime services like ransomware-as-a-service, phishing kits, and DDoS-for-hire. The scale became clearer later through court filings. A federal grand jury indictment unsealed in April 2025 alleges the platform processed more than 400,000 orders between 2021 and 2024, including over 55,000 orders for stimulants such as methamphetamine and cocaine and roughly 17,000 for opioids including fentanyl and heroin, according to the Department of Justice announcement. Government covert purchases from the site were lab-confirmed to contain fentanyl and other controlled substances.The long tail: an alleged founder identified
The seizure was never the end of the case. In March 2025, the Treasury Department's OFAC sanctioned Behrouz Parsarad, an Iranian national identified as Nemesis's sole administrator, accusing him of pocketing transaction fees worth millions and laundering cryptocurrency for the site's users. OFAC estimated the marketplace facilitated nearly $30 million in drug sales between 2021 and 2024. A month later, the DOJ indictment followed, charging Parsarad with narcotics distribution conspiracy and money laundering conspiracy in the Northern District of Ohio, with a mandatory minimum of ten years if convicted. Notably, Treasury said he had already been sounding out former Nemesis vendors about building a replacement market. The OFAC designation also listed 49 cryptocurrency addresses, 44 Bitcoin and 5 Monero, tying the financial plumbing directly to one person.Investigators did not need to break Tor to break Nemesis. They needed the servers, the wallets, and eighteen months of patience.
What Nemesis taught about mid-sized markets
Nemesis was never Hydra-sized, and that is precisely what made it representative. It sat in the crowded middle tier that absorbed users after the big collapses, credible enough to attract six-figure registrations, small enough that its hosting footprint stayed findable. The case showed that operational security failures usually live off-Tor: payment processing, wallet custody, and server contracts.- The market banned transactions in government-backed currency and offered built-in crypto mixing, yet blockchain tracing still connected wallets to the administrator. Servers in two jurisdictions were seized in a single coordinated action, leaving no window for migration or destruction of evidence. Seized order data fed later operations: JCODE partners cited Nemesis intelligence among leads supporting the 270-arrest Operation RapTor sweep in 2025. Announced arrests lagged the takedown by a full year, reflecting a deliberate evidence-first strategy.