Between March 9 and 19, 2026, the darknet world literally shook. The operation codenamed “Alice” – coordinated by the German services and supported by Europol – turned out to be one of the greatest blows in the history of the fight against crime on the dark web. 23 European countries joined the action.
Europol breaks up the darknet – the scale of the operation is impressive
Europol’s investigation began in mid-2021, and its initial target was a platform with the unpleasantly eloquent name “Alice with Violence CP”. However, it quickly turned out that they had found something much bigger. The platform operator managed a network of over 373,000 onion domains – special addresses designed to effectively hide the identity of both the website owner and its visitors. Sounds like science fiction? This is the reality of the darknet.
Two categories of illegal content were offered on these platforms: sexual exploitation of minors (CSAM) and on-demand cybercrime services (CaaS). Through over 90,000 onion domains available between February 2020 and July 2025, the perpetrator actively advertised CSAM in the form of… ready-made “packages”. Prices ranged from EUR 17 to EUR 215, and data volumes ranged from several gigabytes to many terabytes. Payment? Exclusively in Bitcoin.
Cryptocurrencies – a tool for cybercriminals, but also a clue for investigators
Closing 373,000 domains is not only a symbolic gesture, but a real limitation of the financial infrastructure behind this type of practice. Each blocked payment path means less revenue for operators and higher risk for potential customers.
440 customers targeted
Europol’s investigation allowed the identification of 440 customers who used the operator’s services. Separate proceedings were initiated against each of them. This is a clear signal to cybercriminals that the darknet is no longer a safe haven. Anonymity has its limits, and law enforcement agencies are overcoming barriers that until recently seemed insurmountable.
Operation “Alice” proved that coordinated international actions, combined with the analysis of cryptocurrency traces, can effectively dismantle even extensive criminal networks. Cybercriminals should remember this.
