The story of AlphaBay is too multifaceted to attempt to tell in a single 3,000-word article, and a single article would not do it justice. Key parts of the story have already been told multiple times in intricate detail, and there is probably enough information on the market by this point to make a novel or feature-length screenplay. For these reasons, this article will simply cover the basic, must-know information about AlphaBay while also including some lesser-known facets not as well-covered as others.
After Silk Road, AlphaBay is perhaps the second most well-known darknet market. This is for a few notable reasons: 1) it was the biggest market of its time, 2) the movie-worthy story of its founder and admin, Alexandre Cazes, and 3) it was reborn and continues operating under the same name today. The story of AlphaBay is therefore not over, yet its history is rich with dark web lore and filled with chapters that could have never been imagined until after they had already occurred.
At its peak, which was the time of its takedown in July 2017, AlphaBay was about 10 times larger than Silk Road, with over 400,000 registered users and 370,000 listings — about 240,000 of which were in the “Drugs & Chemicals” category. Only a few other markets have rivaled or surpassed AlphaBay in size; most noticeable of which was Hydra, the former Russian language darknet market. The market also had a notoriously big weapons section, with close to 5,000 listings at its end, and was bustling with counterfeit, fraud-related and digital items, as well as hosting a plethora of services for hire.
One of the reasons why AlphaBay’s story is so unique is because it possesses a human element not shared by many other darknet markets: the identity of its main admin and some of its major players are now well-known — even celebrated as dark web folk heroes. Cazes was only 25 years old when he died, but the multi-million-dollar empire he managed to build in less than three years carries on as a legacy today, frequently emulated yet never matched in its level of success.
AlphaBay Market The Early Days
French-Canadian by birth, Alexandre Cazes was a gifted individual by all accounts, starting his first company – EBX Technologies – when he was 17. He built websites and produced software for businesses with his company, later dabbling in computer repair and encryption while still a resident of his Canadian home province, Quebec. Though not a whole lot is known about his youth, a friend described him as an “extremely brilliant guy.” He was also an avid internet poster, with a traceable online history dating back to 2008, when he provided advice on how to remove a virus from a photo in a tech forum. According to his parents, he was a mild-mannered son, did not have an arrest record, do drugs, or even smoke.
Photo of Cazes from Facebook
Cazes moved to Thailand in the first half of 2013, where he lived quietly for about a year before deciding to start work on AlphaBay in July 2014, opening a beta version of the site in Sept. 2014. The market was largely in a state of testing for its first three months and not really advertised to the public during this time. It officially opened on Dec. 22, 2014, with Cazes acting as head administrator under the name alpha02, which he had used while acting as a moderator on a carding forum. Cazes had put together a highly popular guide on carding which he first published in May 2014, releasing updated versions of it all the way through Sept. 2014.
In the introduction of his guide’s final iteration, Cazes referenced his purchase of a Mercedes-Benz with a “suitcase full of money” that he had obtained from exploiting the Stripe payment processing platform. He also revealed the following about his life philosophy:
“I don’t believe in working 40 hours per week to bring home a mere $400 per week, minus all the bills, and count how many pennies are left in my pockets. I believe in living rather than surviving. And even with a real-life business, that’s still not enough. This is where I discovered the world of online fraud.” – alpha02, in ‘Carder Science’
AlphaBay employed the traditional market escrow system first introduced by Silk Road, giving Finalize Early (FE) privileges to vendors who had completed over 200 successful sales. The market’s listings rules were generally lax, allowing the sales of all types of drugs, weapons, software, fraud-related items, and stolen data. It did, however, draw traditional lines in that the sales of poisons and illicit pornography were banned, as were services pertaining murder or physical harm.
The first mention of AlphaBay on DeepDotWeb, the de-facto darknet market authority site, came in early Mar. 2015. Its rise into the community spotlight was propelled by the exit scam of Evolution on Mar. 14, in which the market saw a mass rush of new users. By the end of the following week, AlphaBay had surpassed 90,000 registered accounts, establishing it as a prime candidate for the next darknet market leader.
Early AlphaBay description on the former DeepDotWeb, from Mar. 19, 2015
The market got its first real media exposure later that month, when Vice ran a story about a vendor selling Uber accounts on the market for $5. The accounts included user trip history, telephone number, home address, and partial credit card information, which was especially concerning to the public as Uber denied their databases had suffered a breach. A vendor on the market by the name of ThinkingForward claimed to have “hacked” thousands of accounts which they were selling for as little as $1 in bulk purchases. It was at this point that AlphaBay was firmly marked on the radar of US law enforcement.
Ransom & Extortion Attempts
In Oct. 2015, AlphaBay managed to make the news again after hackers infiltrated systems belonging to British phone and broadband provider TalkTalk. The hackers at first demanded a ransom of close to $122,000 in BTC, but after the company refused to pay up, they decided to sell the data on AlphaBay, which included customer names, addresses, phone numbers, employers, and bank account information. The data was sold by a vendor named Courvoisier who already had over 600 sales on the market and most likely purchased from the hackers themselves.
In Oct. 2016, two men were arrested for their alleged role in the hacking, pleading guilty to related charges in Apr. 2017. They admitted not being able to achieve their ransoming goals and failures to sell the data themselves, instead handing it over to multiple vendors on AlphaBay. According to well-known cybersecurity researcher Brian Krebs, there was a specific rationale as to why such ransoms of customer data are sometimes not paid:
“Extortion attacks put victim companies in a bit of bind, because even if they do pay the ransom demand, there is no guarantee the data was not already shared with or stolen by other attackers — or that the extortionists won’t simply go ahead and publish the data even if they are paid.” – Brian Krebs
Interestingly, AlphaBay admins and staff were victims of several extortion attempts themselves; the most notable of which occurred in Aug. 2016. As reported by Vice, AlphaBay staff appears to have paid an extortionist 35 BTC (approx. $45k at the time) in exchange for not releasing the personal details of alpha02 (Cazes) and two market moderators. The reason provided to Vice by the Alphabay Reddit account in response to questions about why the demand was paid was “to avoid a potential reddit shitstorm.”
It is not known if the extortionist did indeed possess Cazes’ dox but given the fact that the OpSec slip-up that eventually led to his arrest was somewhat easy to identify, it is quite possible that they did. In short, Cazes used a long-standing Hotmail address as the “From” address in welcome and password reset emails when the market first opened to the public, in Dec. 2014. This address was associated with a LinkedIn account under his name as well as with a computer repair business he operated while in Canada.
The Roosh V Forum
The Roosh V Forum was created in 2008 by Daryush Valizadeh, described as “an alt-right American blogger and former pickup artist.” Though the focus of its content has shifted since, it was during Cazes’ time a place where men would discuss how to meet and engage with women. Cazes registered with the forum in October 2014, though his posts only go back to June 2016, well after the first successes of AlphaBay. His forum name was Rawmeo; the reason he gave being “because, well, Romeo gotta rawdog.” Interestingly, he had logged into the forum on the day of his capture.
Profile of Cazes on rooshvforum.com
Though naturally tight-lipped about his particular enterprise, Cazes did not hide the fact that he was making a lot of money, mentioning cars and even properties that he had purchased, and occasionally made reference to his occupation as a “business owner.” He often used the forum to convey steadfast viewpoints on women, which could be morally interpreted in a number of ways, but more interesting are the glimpses he gave into his personal life:
- He referenced the fact that he was a Bitcoin trader and had a Bitfinex account.
- He was a privacy advocate and referenced using a VPN which he paid for with BTC.
- He was fascinated with Eastern culture and viewed much of it as superior to Western culture.
- He espoused conservative values and expressed admiration for US President Donald Trump.
Cazes also liked giving genuine advice, trying to be helpful to other forum members. He liked boasting about his financial accomplishments but was never dismissive or derogatory toward those with which he conversed. In one particularly telling post, he offered tips on how to live life after one’s financial goals had been achieved:
“Being young with lots of money but little life experience (like my situation) is a dangerous situation. In a heartbeat, everything can be gone… You shouldn’t rely on material possessions to replace game, (but) you can allow yourself to have more than the average. Which means having a nice car, nice wardrobe, nice house.
Paper assets are worth nothing. Millions in a Bitcoin wallet are worth nothing. Use that cash to leverage your lifestyle, but most importantly, do it for yourself. If you want a nice car, buy a car that you like, not a car that’s popular with girls. If that’s the same car, so be it.” – Rawmeo, Dec. 3, 2016
Arrest & Closure
In the two years between July 2015 and July 2017, things went as smoothly for AlphaBay as they could for any darknet market. Cazes raked in tens of millions of dollars in commissions of the sales conducted on his marketplace, which averaged around $600,000-$800,000 per day at the end, taking 2-4% of each transaction. In June 2017, however, things would start to take a turn for the worse as a US warrant was issued for Cazes’ arrest, leading to an indictment by the end of the month. Investigators had been operating undercover on the site since at least May of that year, gathering evidence for their case against the market’s admin.
On Jul. 5, 2017, Thai police arrested Cazes outside one of his homes in Bangkok, with assistance from the FBI and DEA. Royal Thai Police created a diversion by staging a car accident outside the home, hoping to catch him off-guard. The plan worked as Cazes was still logged into AlphaBay as administrator when police searched his home. A week later, on Jul. 12, Cazes was found dead in a detention cell while awaiting extradition to the US, apparently the result of having hanged himself with a towel.
Thai police with one of Cazes’ vehicles confiscated after his arrest
As of May 2022, the assets seized by officials after the arrest of Cazes were worth an estimated 1.6 billion baht, or roughly $43.7 million USD. Found by investigators on his unencrypted laptop at the time of his arrest was a document detailing the locations and values of all his major assets, which included the following:
- 1,605 BTC ($6.6 million)
- 8,309 ETH ($2.4 million)
- 12,000 XMR ($622,000)
- 3,692 ZEC ($980,500)
- 11 bank accounts in his or his wife’s name, in Thailand, Lichtenstein, Switzerland, and St. Vincent and the Grenadines
- 2013 Lamborghini Aventador
- Porsche Panamera
- Mini Cooper
- BMW motorcycle
- 3 properties in Bangkok, vacation property in Phuket, Thailand
- Villa in Cyprus
- Condo in Antigua
He had obtained Antiguan citizenship in Feb. 2017 by purchasing property there and was pursuing “economic citizenship” in Cyprus at the time of his death.
Martin Cazes, father of Alexandre, expressed doubts about his son being the sole architect of AlphaBay in interviews following his son’s death, saying he couldn’t believe the story. “I’d like your opinion on how the biggest (darknet market) site can be created, managed, and operated by one person, what do you think?”, he asked a Canadian news outlet a week after the death of Alexandre. “And, by the way, every time I saw my son, he was enjoying life, he never looked stressed,” he added.
Cazes’ stepmother had similar doubts about her son, but on Jul. 23, 2017, conveyed in an interview that she was “willing to accept” what she had been told and that she wanted to move forward. “If what the FBI says is all true, it’s not the Alexandre Cazes that we know, but we will love him anyway and forgive him,” she told reporters.
Resurrection
On Aug. 7, 2021, a PGP-signed message was posted to the Dread darknet forum by what was later confirmed to be DeSnake, Cazes’ secondary administrator. Though absent from the community for the last five years, DeSnake had apparently evaded capture and had built a new darknet market which he described as a continuation of the old AlphaBay.
Excerpt from DeSnake’s return message on the Dread forum
Though much of the community was hesitant to use the “reborn” AlphaBay for its first few months after launch, it has since skyrocketed in popularity and currently hosts over 800,000 users and close to 35,000 listings. A few new rules implemented this time around include a ban on customers from the Russian Federation as well as a ban on fentanyl and related analogs. Another noticeable difference is that the market is now Monero-only, having discontinued support for Bitcoin. The new policies serve to help keep some pressure from law enforcement off the market, though it is probably still quite high on the list of targets for takedowns.
Aside from some minor alterations in design, the spirit of the old market is still there. It is currently the biggest darknet market in terms of active user base, thanks to a string of closures of competing markets over the course of the last year. DeSnake has repeatedly expressed a desire to eventually decentralize the market, which would allow it to be run by multiple operators in separate locations. This would assure the market can remain functioning even if one of its operators were to be arrested or otherwise vanish.
Now almost a year into existence, the “new” AlphaBay has outlasted most claims that it is either a “money grab” or “honeypot” operation and seems to be flourishing under the guidance of DeSnake. It is therefore a rather fitting continuation of (or at least tribute to) Cazes’ enterprise; its operators having learned from mistakes of past markets and demonstrating a strong desire to integrate technical advancements of the last five years. DeSnake maintains on Dread that Cazes was killed and did not commit suicide. While this claim isn’t easily verifiable, it is clear he wishes to continue Cazes’ legacy to the best of his abilities and has thus far been largely successful in this goal.
Timeline of AlphaBay and Related Events
Jul 2014 – Cazes launches closed version of AlphaBay
Dec 22, 2014 – AlphaBay opens to the public
Mar 14, 2015 – Evolution exit scams
Mar 28, 2015 – Vice publishes story about Uber accounts for sale on AlphaBay
Apr 2015 – AlphaBay surges in popularity after media coverage, surpasses 100,000 users
Oct 2015 – TalkTalk user data sold by multiple vendors on AlphaBay
May 2016 – AlphaBay becomes largest darknet market after Nucleus shuts down
Aug 2016 – AlphaBay staff pays money to extortionist to stop release of alpha02 dox
Jul 5, 2017 – AlphaBay seized, taken offline, Cazes arrested
Jul 12, 2017 – Cazes found dead in Bangkok jail cell while awaiting extradition to the US
Aug 7, 2021 – AlphaBay re-launches under the leadership of DeSnake
Jun 2022 – AlphaBay regains title as most popular darknet market