After the take down of the darknet markets, Silk Road 1 & 2.0, researchers at Carnegie Mellon University described the activity of users as a “waterbed” effect. Users tends to migrate to another darknet market and resume their criminal operations. In a joint operation by the FBI and the Dutch National Police called “Operation Bayonet” authorities anticipated this waterbed effect on darknet markets and used it their advantage. While the FBI took over and then took down leading darknet market Alphabay on July 4th, 2017, the National High-Tech Crime and Dark Web Unit of the Dutch Police took the next best market, Hansa, and ran it for a period of time before the ultimately shut it down on July 20th, 2017. They did this to not only shake up the underground cyber economy, but to collect intelligence on thousands of darknet buyers and vendors. As a result of the takedown of these two major darknet marketplaces, the user base of the Dream Market, a darknet market established toward the end of 2013, has increased from 20 news users a day pre-Operation Bayonet, to 60 new users a day post Operation Bayonet.
Considering that Alphabay had 40,000 vendors and 200,000 buyers, and Dream Market only had a post Operation Bayonet user base of 16,000, it is clear not all users and vendors made the migration to the Dream Market. However, using darknet search engine grams, cybercrime researchers were able to find where 195 newly registered Dream Market vendors migrated from. Then the researchers were able to find if the vendors kept they’re old username, kept their PGP key and changed their username, kept their username and changed their PGP key, or changed their username and their PGP key. Considering that on darknet markets, reputation is essential to clientele, a complete change would be a sign of panic showing established vendors starting from scratch. While 50 percent of new vendors on Dream Market came from Alphabay, its appears that the honeypot style operation of the Dutch police prevented many Hansa users from migrating to Dream. Moreover, a majority of new vendors did not even use any evasive strategies post Operation Bayonet, but almost half had some type of identity change.
This data analysis of the darknet market migrations shows a potential for authorities to prevent this waterbed affect through honeypot operations like in Hansa, but to also disrupt vendors operations in these marketplaces that pride themselves on anonymity by forcing them to restart their online reputation