Ten months of 2026 enforcement: infrastructure first, administrators close behind
Ten months into 2026, the public enforcement record against darknet and cybercrime infrastructure is dominated not by blockbuster marketplace takedowns but by a steady grind against the plumbing: servers, domains, botnets and the services that rent them out. This post compiles only actions announced through mid-October by agencies that published their own accounts - Europol, the US Department of Justice, the BKA, the Dutch police and the FBI - and looks for the pattern underneath. Every case links to a source we opened; rumours and single-blog claims did not make the cut.
Infrastructure first
The largest coordinated action of the period was Operation Endgame's June strike against malware distribution. Announced on 24 June by the international coalition behind the long-running campaign, the action hit the dropper and infostealer toolkits SocGholish, Amadey and StealC: 326 servers and 142 domains were taken over within two weeks, criminal crypto assets valued at over EUR 41 million were flagged and frozen, and 27 million stolen login credentials were recovered. The participant list - Canada, Denmark, Germany, the Netherlands, the UK, the US and Microsoft, coordinated by Europol and Eurojust - shows how routine the public-private format has become (operation-endgame.com). For scale, the campaign's November 2025 phase alone had taken down 1,025 servers. Days earlier, Dutch police had taken down First VPN, a criminal VPN service advertised on cybercrime forums. In a Team High Tech Crime operation with French authorities on 19-20 May, 33 servers were dismantled, the suspected administrator was questioned in Ukraine at France's request, and users of the service were notified - in effect - that they had been observed the whole time. Europol's support office produced 83 analytical products for the joint investigation team (politie.nl). July brought the FBI's turn: on 2 July, hundreds of domains belonging to NetNut, a commercial residential proxy network tied to the Popa botnet running on more than two million consumer devices, were seized and the company's homepage was replaced with an FBI seizure banner. NetNut is operated by Alarum Technologies, a publicly traded Israeli firm - a reminder that 'botnet infrastructure' and 'Nasdaq-listed product' can describe the same machine. According to KrebsOnSecurity, Google's threat intelligence group had counted 316 distinct threat-actor clusters using NetNut exit nodes in a single week that June (KrebsOnSecurity).Administrators, not vendors
The market actions of 2026 were narrow and surgical. In early May, the Frankfurt ZIT and the BKA shut down the relaunch of Crimenetwork, the German-language trading platform whose predecessor fell in December 2024; the suspected operator, a 35-year-old German, was arrested on Mallorca on a European warrant on 6 May. The relaunch had grown to over 22,000 users and more than 100 vendors, accepted Bitcoin, Litecoin and Monero, and left turnover evidence pointing above EUR 3.6 million, with roughly EUR 194,000 in assets provisionally seized. Note what did not happen: no mass arrest of vendors. The data on 22,000 users became evidence, not a press-release number (BKA/ZIT release). Europol's October announcement about KillSec reads similarly. Operation KillSwitch, led by Hamburg's state criminal police and public prosecutor's office, took over the ransomware group's leak site on 30 September and secured at least 110 terabytes of data. The suspected main operator is sixteen years old; the suspected developer turned eighteen in August. Three provisional arrests and eight house searches spanned Greece, Romania, Spain and the UK, and the group's domains now redirect to a seizure notice. Europol also reported that the group used AI tooling to build and maintain its infrastructure and to identify potential victims - a detail that says as much about 2026 as any arrest count (Europol).The long tail of prosecutions
Older cases keep maturing into sentences. On 7 October, federal prosecutors in Chicago announced that Raheim Hamilton, co-creator of the dark web marketplace Empire Market, was sentenced to forty years in federal prison and fined five million dollars. Empire ran from 2018 to 2020 and processed more than four million transactions worth over 430 million dollars. The forfeiture - roughly 1,230 bitcoins plus three Virginia properties - landed years after the market itself disappeared, which is the point: seizures are immediate, accountability is slow (justice.gov).The quiet fourth lane: designations
Sanctions ran parallel to the criminal-justice track. On 8 October the UK designated Cryptomus, a cryptocurrency payment platform previously known as Certa Payments and Xeltox, under its Russia sanctions regime, together with VexPay, TokenSpot and Tsunami Payments (KrebsOnSecurity). Freezing a payment platform's reach comes without a banner, but for cash-out infrastructure a designation can bite harder than a seizure.What the banners say, and what is missing
The seizure-banner grammar is intact: KillSec's domains redirect to a law-enforcement notice, NetNut's homepage carries the FBI banner, Crimenetwork and First VPN simply vanish. The absences are as informative as the actions. In the compiled public record for 2026 so far:- no darknet market of the biggest international class was seized - the only market shutdown was a German-language relaunch that had survived about a year and a half;
- none of the actions compiled here is a mixer designation, and the one sanctions move in the set targets a payment platform, not a mixing service;
- there is no vendor-level mass-arrest sweep of the kind that marked previous waves.