The chance for the investigators from Oldenburg came when a 34-year-old Australian went on a trip to Europe.
They kept the man under observation for days.
Then, when he was coming to Germany from Denmark, they struck and arrested him on suspicion of running one of the world's largest marketplaces for drugs, stolen data and criminal services on the darknet.
DarkMarket is the name of the platform on which, according to the General Public Prosecutor's Office in Koblenz and Central Criminal Inspection Oldenburg, over 500,000 users and around 24,000 salespeople processed at least around 320,000 transactions.
Counterfeit money, stolen or falsified credit card details, anonymous SIM cards, malware and drugs of all kinds - the range on DarkMarket was broad.
Payment was in crypto currencies.
More than 4650 Bitcoin and 12,800 Monero are said to have flowed - according to current exchange rates, this corresponds to more than 140 million euros.
The illegal marketplace is said to have been one of the largest of its kind on the Darknet - that part of the Internet that is only accessible with a special browser.
So far, because the investigators have closed it.
Users now only see a banner of the investigators, which shows a fly swatter under the words “This dark web marketplace was confiscated”, which crushes the logo of DarkMarket - a black and purple insect.
A little joke by the officials.
The investigators had already arrested the alleged operator of the sales point near the German-Danish border on Sunday.
The 34-year-old Australian national is now on remand.
The investigations are being led by the State Central Cybercrime Office (LZC) of the Koblenz Public Prosecutor's Office.
They were supported by several domestic and foreign authorities, including the FBI and the Australian, British, Danish, Swiss, Ukrainian and Moldovan police.
The marketplace had been in their focus for several months.
The "Cyberbunker" case showed investigators a lead
In September 2019, a data center was discovered on a former military facility in Traben-Trarbach, Rhineland-Palatinate, which operated illegal websites and platforms in the Darknet.
Since October, eight defendants have been on trial in Trier in what has become known as the “cyberbunker”.
They are accused of complicity in more than 249,000 criminal offenses, mainly drug deals, but also counterfeit money transactions, data theft and cyber attacks.
The illegal DarkMarket is also said to have been operated temporarily via the cyberbunker and thus led the investigators on its trail.
The authorities have now confiscated more than 20 servers in Moldova and Ukraine.
With their help, they now want to continue investigating to learn more about the moderators, sellers and buyers of the marketplace.
In the past few years, operators of trading venues had to determine several times that the technology of the Darknet is by no means a guarantee of anonymity.
Probably the most prominent case was the arrest of Texan Ross Ulbricht, who ran the drug black market Silk Road from 2011 to 2013 - it was closed, successors such as Agora or Hansa fared not much better.
Most of the time, the investigators track down the perpetrators by tracing money transactions, in the case of DarkMarket using data they found when the "cyber bunker" was excavated on the Moselle.
The vast majority of transactions on the Darknet are for drug trafficking - over 85 percent of over 100,000 transactions on “Agora”, for example, were dedicated to drug orders, according to an analysis by the crypto-money advisors from “Finantio”.
How large the total trading volume for illegal services in the Darknet is can only be estimated - according to an analysis by the cryptocurrency specialists from “Chainalysis” in December 2020, the trading volume in Bitcoin in 2020 was the equivalent of around 1.5 billion dollars.
According to the Chainalysis study, the pressure of the investigators has by no means ensured that the trading volume on the black markets has fallen, on the contrary: never more was traded on the darknet than this year.
But thanks to the work of the investigators, the number of available trading venues is falling: in 2019 there were still more than 60 platforms, according to the experts there are currently 37 - the lowest number since 2017. The platforms that have survived so far benefit, however.
Before this weekend, however, the largest market for drugs on the Darknet was probably not DarkMarket - according to the Chainalysis analysis, this dubious title still belongs to the Russian drug market "Hydra" - according to the study, the operators have and are able to set up a complete logistics network for drugs in Eastern Europe Claim over half a billion dollars in annual sales alone.
This makes Hydra one of the five largest cryptocurrency recipients in all of Eastern Europe.
Thanks to the current cryptocurrency boom on regular stock exchanges, however, the importance of drug trafficking is declining - while 20 percent of all Bitcoin transactions were attributable to darknet trading venues in 2013, it was less than one percent in 2020.