German Police Arrest Crimenetwork Admin Months After First Takedown

Days after German authorities dismantled one of the darknet's most established marketplaces in December 2024, someone built it back. Same name, new infrastructure, new operator. The Crimenetwork takedown had barely concluded before a replacement was live and accepting users. This week, German and Spanish law enforcement closed it again. This time arresting the man behind the reboot at his home in Mallorca.

The operation was coordinated by the Federal Criminal Police Office (BKA) and the Public Prosecutor's Office in Frankfurt am Main, working through its Central Office for Combating Cybercrime (ZIT). Spanish authorities executed the arrest under a European arrest warrant, detaining the 35-year-old German national at his Mallorca residence.

A Platform Built to Replace Itself

Crimenetwork had a long run. The platform launched in 2012 and grew into Germany's largest darknet marketplace, serving over 100,000 users at its peak. It traded in stolen data, drugs, forged documents, and cybercrime services, operating almost exclusively within German-speaking communities. Buyers paid in Bitcoin and Monero, keeping transactions difficult to trace.

The BKA and ZIT shut it down in December 2024, seizing the infrastructure and arresting its administrator. By most measures, that should have been the end of it.

It was not. Within days of the original Crimenetwork takedown, a new version appeared on entirely separate infrastructure. A different operator, the same brand. The rebooted platform offered the same range of illicit goods and services and moved quickly to rebuild its user base.

The Reboot Scaled Fast

The speed ofrecovery was notable. Before authorities could act, the relaunched marketplace had attracted 22,000 registered users and more than 100 active vendors. Revenue reached at least €3.6 million (roughly $4.2 million) before the operation wasdismantled.

That kind of traction, built in a matter of months, reflects how quickly darknet communities reconstitute around familiar brands. Crimenetwork carried name recognition. Users knew what it was and where to find it. The operator exploited that, keeping the name and the model intact while moving to infrastructure that the original investigation had never touched.

Authorities seized approximately €194,000 in assets with direct links to the platform. They also obtained substantial volumes of user and transaction data, material that is likely to drive further investigations and additional arrests.

The Arrest and the Charges

The 35-year-old suspect now faces charges under two separate legal frameworks. The first is Section 127 of the German Criminal Code, which covers the operation of criminal trading platforms online. The second involves Sections 29a and 30a of the German Narcotics Act, related to large-scale drug trafficking. Both carry potential prison sentences.

BKA Director Carsten Meywirth was direct in his assessment.

"The reboot of Crimenetworkhas failed, and another administrator will have to answer before a Germancourt," he said. "Together with our national and internationalpartners, we consistently enforce the law even in the darknet. Cybercrime doesnot pay."

The statement carries weight given what happened to the platform's original operator. In March 2026, a German court sentenced him to seven years and ten months in prison and ordered the forfeiture of more than €10 million in criminal proceeds. That ruling is not yet final, but it establishes the legal ceiling that the new suspect is now looking at.

What the Data Seizure Means

The asset and data seizure may be the most consequential part of the operation. Darknet marketplace takedowns often end with an arrest and a seized server. What investigators pulled from Crimenetwork's infrastructure includes user records and transaction histories — the kind of data that maps an entire criminal network, not just its operator.

The BKA has used similar data in the past to pursue users and vendors long after the initial takedown. The same pattern is likely here. Anyone who used the rebooted Crimenetwork marketplace has reason to expect that law enforcement already has their activity on record.

Rapid Relaunch, Rapid Response

The Crimenetwork takedown and its sequel illustrate something broader about how darknet enforcement has shifted. The gap between a platform going dark and a replacement going live has narrowed to days. Operators move faster, lean on brand recognition, and spin up infrastructure with minimal delay.

But law enforcement has adapted. The cross-border coordination between German and Spanish authorities, executed cleanly under a European arrest warrant, shows that investigative reach has expanded alongside the speed of criminal operations. The window to operate may be shorter than darknet operators are accounting for.

The data seized from both versions of Crimenetwork is still being processed. Further arrests are expected.