Darknet Markets in the Past: AlphaBay

The narrative of AlphaBay is far too complex to be told in a single 3,000-word piece, and a single article would be inadequate. Key elements of the story have previously been described in great detail, and there is likely enough information on the market at this moment to write a novel or feature-length screenplay. For these reasons, this essay will simply cover the essentials of AlphaBay while also discussing some lesser-known aspects that have not received as much attention as others.

AlphaBay is possibly the second most well-known darknet market after Silk Road. This is due to several factors, including: 1) it was the largest market at the time, 2) the movie-worthy story of its founder and administrator, Alexandre Cazes, and 3) it was revived and continues to operate under the same name today. AlphaBay’s story is thus far from over, but it is rich in dark web mythology and filled with chapters that could never have been imagined until after they had already transpired.

At its peak, around the time of its demise in July 2017, AlphaBay had over 400,000 registered members and 370,000 listings, around 240,000 of which were in the “Drugs & Chemicals” category. Only a few other markets have been as large as or larger than AlphaBay, the most notable of which was Hydra, the defunct Russian language darknet market. The market also had a very large weapons section, with about 5,000 listings in the end, and was teeming with counterfeit, fraud-related, and digital commodities, as well as a plethora of services for hire.

One of the reasons AlphaBay’s narrative is so unusual is that it has a human element that few other darknet markets have: the identity of its chief admin and some of its important players is now well-known — even celebrated as dark web folk heroes. Cazes died at the age of 25, but the multimillion-dollar company he built in less than three years lives on as a legacy, frequently imitated but never surpassed in terms of success.

The Early Days of the AlphaBay Market

Alexandre Cazes, a French-Canadian by origin, was a talented guy by all accounts, founding his first firm, EBX Technologies, when he was 17 years old. With his company, he created websites and software for businesses, later dabbling in computer repair and encryption while still residing in his Canadian home region of Quebec. Although nothing is known about his childhood, a friend described him as a “very smart guy.” He was also a frequent internet poster, with an online history reaching back to 2008, when he offered assistance on how to remove a virus from a photo on a computer forum. According to his parents, he was a mild-mannered son who did not do drugs or even smoke.

Cazes photo courtesy of Facebook

Cazes relocated to Thailand in the first part of 2013, where he lived quietly for almost a year before deciding to begin work on AlphaBay in July 2014, with the site launching as a beta version in September 2014. For the first three months, the market was mostly in testing mode and was not widely publicized to the general public. Cazes took over as top administrator on December 22, 2014, using the identity alpha02, which he had used as a moderator on a carding site. Cazes had put together a popular carding guide, which he first released in May 2014 and continued to update until September 2014.

Cazes mentioned his purchase of a Mercedes-Benz with a “suitcase full of money” obtained using the Stripe payment processing platform in the introduction to the final version of his guide. He also shared the following information regarding his life philosophy:

“I don’t believe in working 40 hours per week to bring home $400 per week after deducting all costs and counting how many pennies are left in my pockets.” I choose to live rather than survive. Even with a real-life business, this is insufficient. This is where I became acquainted with the world of internet fraud.” – alpha02 from “Carder Science”

AlphaBay used Silk Road’s typical market escrow mechanism, granting Finalize Early (FE) access to vendors who have completed over 200 successful sales. The market’s listing regulations were often lenient, permitting the sale of virtually any form of drug, weapon, software, fraud-related item, or stolen data. It did, however, draw customary lines by prohibiting the selling of poisons and unlawful pornography, as well as services involving murder or physical injury.

AlphaBay was initially mentioned on DeepDotWeb, the de facto darknet market authority site, in early March 2015. Its ascension into the community spotlight was fueled by Evolution’s exit fraud on March 14, when the market saw a massive influx of new players. AlphaBay had topped 90,000 registered accounts by the end of the next week, establishing it as a leading contender for the future darknet market leader.

From March 19, 2015, an early AlphaBay description on the defunct DeepDotWeb.

Later that month, Vice posted a story on a vendor selling Uber accounts on the market for $5, giving the market its first significant media exposure. The accounts included customer travel history, phone number, home address, and partial credit card information, which was especially troubling to the public given that Uber denied a breach of its databases. ThinkingForward, a market vendor, claimed to have “hacked” thousands of accounts, which they were selling for as cheap as $1 in bulk orders. AlphaBay was officially on the radar of US law enforcement at this point.

Ransom & Extortion Attempts

In October 2015, AlphaBay made headlines once more as hackers breached the networks of TalkTalk, a British phone and broadband operator. The hackers initially sought a ransom of about $122,000 in BTC, but when the company refused, they chose to sell the data, which included client names, addresses, phone numbers, employers, and bank account information, on AlphaBay. The data was sold by Courvoisier, a dealer with over 600 transactions on the market, and was most likely purchased from the hackers themselves.

Two men were detained in October 2016 for their alleged role in the hacking, and they pleaded guilty to related offenses in April 2017. They admitted to failing to meet their ransoming aims and failing to sell the data directly, instead giving it over to multiple AlphaBay vendors. According to well-known cybersecurity expert Brian Krebs, there is a specific reason why such customer data ransoms are sometimes not paid:

“Extortion assaults put victim companies in a position because, even if they pay the ransom demand, there is no guarantee that the material hasn’t already been shared with or stolen by other attackers — or that the extortionists won’t simply go ahead and publish the data even if they are paid.” – Mr. Brian Krebs

Interestingly, AlphaBay admins and personnel have been the target of multiple extortion attempts, the most recent of which occurred in August 2016. According to Vice, AlphaBay employees appeared to have paid an extortionist 35 BTC (about $45k at the time) in exchange for not disclosing the personal information of alpha02 (Cazes) and two market moderators. In answer to Vice’s questioning about why the demand was paid, the Alphabay Reddit user said it was “to avert a potential reddit shitstorm.”

It is unknown whether the extortionist had Cazes’ dox, but considering that the OpSec blunder that eventually led to his arrest was rather obvious, it is extremely possible that they did. In summary, when the market first opened to the public in December 2014, Cazes utilized a long-standing Hotmail address as the “From” address in welcome and password reset emails. This location was linked to a LinkedIn account in his name as well as a computer repair business he had in Canada.

The Roosh V Forum

Daryush Valizadeh, a self-described “alt-right American blogger and former pickup artist,” founded the Roosh V Forum in 2008. Though the focus of its material has evolved afterwards, it was a venue for males to discuss how to meet and communicate with women during Cazes’ tenure. Cazes joined the site in October 2014, but his posts date only back to June 2016, far after AlphaBay’s initial triumph. His forum moniker was Rawmeo, which he chose because “hey, Romeo gotta rawdog.” He had, interestingly, checked into the forum on the day of his capture.

Cazes’s profile on rooshvforum.com

Cazes did not hide the fact that he was making a lot of money, referencing automobiles and even homes that he had purchased, and occasionally made reference to his position as a “company owner.” He frequently utilized the forum to express firm views about women, which might be morally taken in a variety of ways, but what is more interesting are the peeks he provided into his personal life:

  • He referenced the fact that he was a Bitcoin trader and had a Bitfinex account.
  • He was a privacy advocate and referenced using a VPN which he paid for with BTC.
  • He was fascinated with Eastern culture and viewed much of it as superior to Western culture.
  • He espoused conservative values and expressed admiration for US President Donald Trump.

Cazes also enjoyed giving honest advice and attempting to assist other forum members. He enjoyed bragging about his financial achievements, yet he was never rude or disparaging toward others with whom he interacted. In one particularly illuminating piece, he offered advice on how to live life after financial goals were met:

“Being young and wealthy with little life experience (like I am) is a risky situation.” Everything can vanish in an instant… You shouldn’t rely on material items to replace gaming, but you can have more than the average amount. That means having a nice automobile, a nice clothing, and a nice home.

Paper assets are worthless. Millions of dollars in a Bitcoin wallet are worthless. Make use of that money to improve your lifestyle, but most importantly, do it for yourself. If you want a good car, get one that you like rather than one that is popular with women. So be it if it’s the same car.” Rawmeo, December 3, 2016

Arrest & Closure

In the two years between July 2015 and July 2017, AlphaBay ran as smoothly as any darknet market could. Cazes earned tens of millions of dollars in commissions from sales on his marketplace, which averaged $600,000-$800,000 per day in the end, taking 2-4% of each transaction. Things would take a turn for the worse in June 2017, when a US warrant was issued for Cazes’ arrest, culminating to an indictment by the end of the month. Since at least May of that year, investigators had been working secretly on the site, amassing evidence for their case against the market’s administrator.

Thai police apprehended Cazes outside one of his Bangkok properties on July 5, 2017, with assistance from the FBI and DEA. Royal Thai Police staged a car accident outside the house in the hopes of catching him off guard. Cazes was still signed into AlphaBay as administrator when police raided his residence, therefore the plot worked. A week later, on July 12, Cazes was discovered dead in a detention cell while awaiting extradition to the United States, having reportedly hung himself with a towel.

Following Cazes’ arrest, Thai authorities took one of his vehicles.

The assets seized by officials following Cazes’ arrest were estimated to be worth 1.6 billion baht, or $43.7 million USD, as of May 2022. Investigators discovered a paper documenting the locations and prices of all his key assets on his unencrypted laptop at the time of his arrest, which included the following:

  • 1,605 BTC ($6.6 million)
  • 8,309 ETH ($2.4 million)
  • 12,000 XMR ($622,000)
  • 3,692 ZEC ($980,500)
  • 11 bank accounts in his or his wife’s name, in Thailand, Lichtenstein, Switzerland, and St. Vincent and the Grenadines
  • 2013 Lamborghini Aventador
  • Porsche Panamera
  • Mini Cooper
  • BMW motorcycle
  • 3 properties in Bangkok, vacation property in Phuket, Thailand
  • Villa in Cyprus
  • Condo in Antigua

He had earned Antiguan citizenship in February 2017 by acquiring property there, and at the time of his death, he was pursuing “economic citizenship” in Cyprus.

In interviews following his son’s death, Alexandre’s father, Martin Cazes, expressed reservations about his son being the only creator of AlphaBay, stating he couldn’t accept the account. “I’d appreciate your view on how the largest (darknet market) site can be developed, managed, and operated by one person,” he told a Canadian news source a week after Alexandre’s murder. “By the way, every time I saw my son, he was having a good time; he never seemed stressed,” he added.

Cazes’ stepmother had similar reservations about her son, but she stated in an interview on July 23, 2017, that she was “ready to accept” what she had been told and that she wanted to go forward. “If everything the FBI claims is true, it’s not the Alexandre Cazes we know, but we will love and forgive him nevertheless,” she told reporters.


On August 7, 2021, a PGP-signed message was uploaded to the Dread darknet forum by DeSnake, Cazes’ secondary administrator. DeSnake had supposedly escaped detection for the last five years and had developed a new darknet market that he described as a continuation of the old AlphaBay.

Excerpt from DeSnake’s reply on the Dread forum

Though much of the community was hesitant to use the “reborn” AlphaBay in its early months, it has since exploded in popularity, now hosting over 800,000 users and close to 35,000 listings. This time around, new laws include a ban on Russian Federation clients as well as a ban on fentanyl and related analogs. Another notable distinction is that the market is now Monero-only, with Bitcoin no longer supported. The new restrictions assist to keep some law enforcement pressure off the market, while it is still likely to be high on the list of targets for takedowns.

Aside from some modest architectural changes, the spirit of the old market remains. It is presently the largest darknet market in terms of active users, thanks to the shutdown of several competing marketplaces over the last year. DeSnake has consistently stated his goal to eventually decentralize the market, allowing it to be administered by many operators in different regions. This ensures that the market can continue to function even if one of its operators is jailed or otherwise disappears.

Now almost a year old, the “new” AlphaBay has survived most claims that it is a “money grab” or “honeypot” business and appears to be flourishing under DeSnake’s leadership. It is thus an appropriate successor (or at least tribute to) Cazes’ firm, with its operators having learned from previous market failures and exhibiting a strong desire to incorporate technological improvements of the prior five years. On Dread, DeSnake maintains that Cazes was slain and did not commit suicide. While this assertion is difficult to verify, it is evident that he desires to carry on Cazes’ tradition to the best of his ability and has thus far been fairly successful in doing so.

Timeline of AlphaBay and Related Events

Jul 2014 – Cazes launches closed version of AlphaBay

Dec 22, 2014 – AlphaBay opens to the public

Mar 14, 2015 – Evolution exit scams

Mar 28, 2015 – Vice publishes story about Uber accounts for sale on AlphaBay

Apr 2015 – AlphaBay surges in popularity after media coverage, surpasses 100,000 users

Oct 2015 – TalkTalk user data sold by multiple vendors on AlphaBay

May 2016 – AlphaBay becomes largest darknet market after Nucleus shuts down

Aug 2016 – AlphaBay staff pays money to extortionist to stop release of alpha02 dox

Jul 5, 2017 – AlphaBay seized, taken offline, Cazes arrested

Jul 12, 2017 – Cazes found dead in Bangkok jail cell while awaiting extradition to the US

Aug 7, 2021 – AlphaBay re-launches under the leadership of DeSnake

Jun 2022 – AlphaBay regains title as most popular darknet market

Leave a Reply