German police shut down Crimenetwork darknet reboot, arrest operator in Mallorca

At a glance:

• German, Spanish, and EU law enforcement agencies dismantled a rebooted version of Crimenetwork, a major darknet cybercrime marketplace, and arrested its 35-year-old German operator in Mallorca, Spain.
• The rebooted platform generated at least €3.6 million (~$4.2 million) in revenue, attracted around 22,000 users and over 100 vendors within weeks of relaunching.
• The original Crimenetwork administrator was sentenced in March 2025 to seven years and ten months in prison with more than €10 million in criminal proceeds ordered forfeited, though the ruling is not yet final.

What happened

In late 2024, the Public Prosecutor's Office in Frankfurt am Main, the Central Office for Combating Cybercrime (ZIT), and the Federal Criminal Police Office (BKA) carried out a coordinated takedown of Crimenetwork, seizing the platform's infrastructure and arresting one of its administrators. Crimenetwork had been Germany's largest online cybercrime marketplace, operating continuously since 2012 and accumulating roughly 100,000 registered users over its lifespan. The platform facilitated the trade of illegal services, controlled substances, and stolen data.

Just days after the December 2024 shutdown, however, a new version of Crimenetwork appeared on entirely fresh infrastructure, administered by a different operator. The speed of the relaunch underscored how resilient these illicit ecosystems can be when their underlying codebase and brand retain value among criminal communities.

The arrest in Mallorca

Earlier this week, a 35-year-old German man suspected of building and running the rebooted Crimenetwork was taken into custody at his residence in Mallorca, Spain. The arrest was executed by a special unit of the Spanish National Police acting on a European arrest warrant issued by German judicial authorities. In a press release, the BKA stated that the suspect "built and administered a completely new technical infrastructure only a few days after the shutdown of the previous version of Crimenetwork and the arrest of its former administrator in December 2024, also naming it Crimenetwork."

Carsten Meywirth, Director at the Federal Criminal Police in Germany, declared that "the reboot of Crimenetwork has failed, and another administrator will have to answer before a German court." He added that German authorities, together with their national and international partners, "consistently enforce the law even in the darknet" and that "cybercrime does not pay."

Scale of the rebooted marketplace

The relaunched version of Crimenetwork replicated much of the original platform's illicit catalogue and quickly gained traction. Within its brief operational window it accumulated approximately 22,000 registered users and more than 100 active vendors. Revenue estimates based on evidence collected during the police action suggest the reboot generated at least €3.6 million (approximately $4.2 million).

During the coordinated raids, law enforcement seized roughly €194,000 (around $228,000) in allegedly illicit assets and obtained substantial volumes of user and transaction data. Authorities say this digital evidence will be central to identifying further suspects and mapping out the full scope of criminal activity conducted through the platform.

Legal consequences

The arrested administrator now faces charges under Section 127 of the German Criminal Code — which covers the formation of criminal organizations — as well as Sections 29a and 30a of the German Narcotics Act, both of which carry potential prison sentences. Meanwhile, the operator of the original Crimenetwork marketplace was sentenced in March 2025 to seven years and ten months in prison and ordered to forfeit more than €10 million in criminal proceeds. That ruling, however, is not yet legally final.

Broader context

Crimenetwork's rise and fall illustrates a recurring pattern in the darknet economy: when a major marketplace is seized, copycats or successors often attempt to fill the vacuum almost immediately. The fact that the reboot attracted tens of thousands of users within days highlights persistent demand for anonymous cybercrime infrastructure. German authorities, working alongside Spanish police and EU-level coordination mechanisms, have demonstrated that cross-border law enforcement cooperation can keep pace — at least temporarily — with these agile criminal operations. What remains to be seen is whether a third iteration will emerge or whether the arrests and seizures have meaningfully disrupted the network's operations for good.