German and Spanish Police Dismantle Crimenetwork Marketplace
German and Spanish authorities dismantled the relaunched Crimenetwork criminal marketplace and arrested its suspected operator in Mallorca, according to Germany’s Federal Criminal Police Office (BKA) and subsequent reporting. Investigators identified the suspect as a 35-year-old German national accused of rebuilding the platform shortly after the original Crimenetwork was shut down in December 2024, then operating it as a major German-speaking underground market for stolen data, narcotics, forged documents, and other illicit services.
Authorities said the platform had more than 22,000 users and over 100 vendors, processed payments in cryptocurrencies including Bitcoin, Litecoin, and Monero, and generated more than €3.6 million in revenue. The operation was led by the BKA, the Frankfurt am Main Public Prosecutor’s Office’s ZIT, and the Spanish National Police; investigators also preliminarily seized about €194,000 in assets and obtained user and transaction data that is expected to support follow-on investigations into vendors, buyers, and related criminal activity.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
7 events from the most recent confirmed update back to the earliest known activity.
Authorities say Crimenetwork ran on servers hosted in Moldova
In the May 2026 joint operation, investigators said the relaunched Crimenetwork marketplace was hosted on servers belonging to a company in Moldova. The operation involved Moldovan, German, and Spanish authorities with Eurojust support, adding new infrastructure details to the case.
Investigators link suspect to 42 fake shops defrauding 1,000 victims
Authorities said the suspected Crimenetwork operator also ran 42 fraudulent online shops using false identities. Investigators estimate the scheme defrauded about 1,000 victims in Germany of at least €323,000, with proceeds allegedly laundered through foreign bank accounts and cryptocurrency conversions.
Authorities dismantle relaunched Crimenetwork and seize data
Law enforcement dismantled the relaunched criminal marketplace Crimenetwork, preliminarily seized about €194,000 in related assets, and obtained user and transaction data for follow-on investigations. Authorities said the platform facilitated sales of stolen data, drugs, forged documents, and other illicit services.
German and Spanish police arrest suspected Crimenetwork operator
German and Spanish law enforcement arrested the suspected operator of the relaunched Crimenetwork in Mallorca, Spain. The operation was led by Germany's BKA, the Frankfurt am Main Public Prosecutor's Office's ZIT, and the Spanish National Police.
Court sentences predecessor Crimenetwork operator in Germany
In March 2026, the Gießen Regional Court sentenced the predecessor Crimenetwork operator to seven years and ten months in prison. The court also ordered confiscation of more than €10 million in criminal proceeds, though the judgment was not yet final.
Suspect relaunches Crimenetwork marketplace
After the original platform was shut down, the suspected 35-year-old German operator allegedly rebuilt and operated a relaunched version of Crimenetwork. The marketplace grew into a major German-speaking underground hub with more than 22,000 users, over 100 vendors, and estimated revenue exceeding €3.6 million.
Original Crimenetwork marketplace shut down
Authorities shut down the original Crimenetwork marketplace in December 2024. According to later investigators, the suspect rebuilt the platform shortly afterward.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
6 references tracked. Mallory keeps watching after this page renders.
Servers in Moldova Hosted Darknet Crime Market, Authorities Say | OCCRP
occrp.org
Open sourceGerman authorities shut down relaunched Crimenetwork marketplace, arrest operator | brief | SC Media
scworld.com
Open sourceCrimenetwork Takedown Exposes 22,000 Users and Over 100 Illegal SellersIn a massive, internation
cybersecuritynews.com
Open sourcePolice take down relaunched criminal marketplace with 22,000 users, €3.6 million in revenue - Help Net Security
helpnetsecurity.com
Open sourceCops Shutter Rebooted German Language Cybercrime Market
bankinfosecurity.com
Open sourceBKA - Listenseite für Pressemitteilungen 2026 - Deutscher Betreiber von „Crimenetwork“ in Spanien festgenommen
bka.de
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Major International Law Enforcement Actions Against Cybercrime and Financial Fraud Networks
Law enforcement agencies across multiple countries have conducted significant operations targeting cybercriminal groups responsible for large-scale financial fraud, data breaches, and cryptocurrency theft. In Spain, police arrested a 19-year-old hacker accused of stealing and attempting to sell 64 million personal data records from nine companies, while Ukrainian authorities apprehended a separate data broker who used custom malware to compromise accounts and sell access on hacker forums. In California, a member of the so-called "Social Engineering Enterprise" pleaded guilty to laundering millions in cryptocurrency stolen through sophisticated social engineering attacks, with the group responsible for a $263 million heist and extravagant spending of the proceeds. Meanwhile, Russian police dismantled a gang that used NFCGate-based malware to steal millions from bank customers by tricking victims into installing fake banking apps and harvesting card credentials for remote theft. A major international operation led by Europol and Eurojust dismantled a €700 million cryptocurrency scam network in Europe that used deepfake videos and aggressive marketing to lure victims into fake investment schemes. The network operated numerous fraudulent platforms, laundered funds through complex channels, and was taken down in coordinated raids across several countries, resulting in arrests and the seizure of cash, cryptocurrencies, and luxury items. These actions highlight the growing sophistication of cyber-enabled financial crime and the increasing collaboration between law enforcement agencies to disrupt such operations on a global scale.
Mar 21, 2026
Romanian and Dutch Police Investigations Into Crypto-Enabled Online Crime
Romanian authorities, acting on a request from the UK, investigated two Romanian nationals suspected of operating a **hitman-for-hire** marketplace designed to conceal identities and payments. Prosecutors said the platform relied exclusively on **cryptocurrency**, held user funds in escrow until “jobs” were completed, and was structured to make financial flows difficult to trace; searches in Bucharest and Ramnicu Valcea reportedly resulted in the seizure of electronic storage devices, approximately **$650,000 in cryptocurrency**, and significant cash holdings. Potential charges cited include forming an organized criminal group, incitement to murder, attempted murder, and **money laundering**. Separately, police in Zeeland, the Netherlands arrested four suspects following a tip linking them to the theft of **169 NFTs** valued at roughly **€1.4 million**; the operation included seizure of data carriers, money, vehicles, and a residence, though the suspects were later released after interrogation as the investigation continued. The case highlights how blockchain-based assets (including NFTs) remain attractive targets for theft and fraud, with common access vectors including **phishing, social engineering, malware, and seed phrase theft**, and underscores the evidentiary role of seized digital media in crypto-asset investigations.
Mar 21, 2026
European Police Dismantle €600 Million Cryptocurrency Investment Fraud Network
European law enforcement agencies arrested nine individuals suspected of operating a large-scale cryptocurrency investment fraud network that defrauded victims of over €600 million. The suspects allegedly created dozens of fake cryptocurrency investment platforms, luring victims with promises of high returns through social media ads, cold calls, and fabricated celebrity endorsements. Once funds were transferred, victims were unable to recover their money, while the criminals laundered the stolen assets using blockchain technology. The coordinated operation, led by Eurojust and involving authorities from France, Belgium, Cyprus, Spain, and Germany, resulted in simultaneous arrests and searches in Cyprus, Spain, and Germany, with significant seizures of cash, cryptocurrencies, and bank assets. The investigation revealed that the network used sophisticated methods to conceal the origins of the stolen funds, cycling them through various wallets and exchanges. Authorities seized €800,000 in bank accounts, €415,000 in cryptocurrencies, and €300,000 in cash during the raids. The operation underscores the growing threat of organized cybercrime leveraging fake investment platforms to target individuals across Europe, and highlights the importance of international cooperation in combating large-scale financial fraud in the cryptocurrency sector.
Mar 21, 2026