Loading story…
German and Spanish authorities dismantled the relaunched Crimenetwork criminal marketplace and arrested its suspected operator in Mallorca, according to Germany’s Federal Criminal Police Office (BKA) and subsequent reporting. Investigators identified the suspect as a 35-year-old German national accused of rebuilding the platform shortly after the original Crimenetwork was shut down in December 2024, then operating it as a major German-speaking underground market for stolen data, narcotics, forged documents, and other illicit services.
Authorities said the platform had more than 22,000 users and over 100 vendors, processed payments in cryptocurrencies including Bitcoin, Litecoin, and Monero, and generated more than €3.6 million in revenue. The operation was led by the BKA, the Frankfurt am Main Public Prosecutor’s Office’s ZIT, and the Spanish National Police; investigators also preliminarily seized about €194,000 in assets and obtained user and transaction data that is expected to support follow-on investigations into vendors, buyers, and related criminal activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
In the May 2026 joint operation, investigators said the relaunched Crimenetwork marketplace was hosted on servers belonging to a company in Moldova. The operation involved Moldovan, German, and Spanish authorities with Eurojust support, adding new infrastructure details to the case.
Authorities said the suspected Crimenetwork operator also ran 42 fraudulent online shops using false identities. Investigators estimate the scheme defrauded about 1,000 victims in Germany of at least €323,000, with proceeds allegedly laundered through foreign bank accounts and cryptocurrency conversions.
Law enforcement dismantled the relaunched criminal marketplace Crimenetwork, preliminarily seized about €194,000 in related assets, and obtained user and transaction data for follow-on investigations. Authorities said the platform facilitated sales of stolen data, drugs, forged documents, and other illicit services.
German and Spanish law enforcement arrested the suspected operator of the relaunched Crimenetwork in Mallorca, Spain. The operation was led by Germany's BKA, the Frankfurt am Main Public Prosecutor's Office's ZIT, and the Spanish National Police.
In March 2026, the Gießen Regional Court sentenced the predecessor Crimenetwork operator to seven years and ten months in prison. The court also ordered confiscation of more than €10 million in criminal proceeds, though the judgment was not yet final.
After the original platform was shut down, the suspected 35-year-old German operator allegedly rebuilt and operated a relaunched version of Crimenetwork. The marketplace grew into a major German-speaking underground hub with more than 22,000 users, over 100 vendors, and estimated revenue exceeding €3.6 million.
Authorities shut down the original Crimenetwork marketplace in December 2024. According to later investigators, the suspect rebuilt the platform shortly afterward.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
occrp.org
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcebankinfosecurity.com
Open sourcebka.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spanish National Police, working with international partners, dismantled a cybercrime organization accused of stealing and laundering about **€140 million** through fake investment platforms, **business email compromise (BEC)**, CEO fraud, invoice fraud, and man-in-the-middle attacks. Investigators said the group operated an industrial-scale laundering network tied to more than **800 bank accounts**, **120 business accounts**, **19 companies**, and **67 money mules**, with confirmed links to over **€94 million** in transactions and another **€61 million** connected to 2024 CEO fraud activity. Authorities arrested **four suspects** in Spain, Portugal, and Panama during an operation supported by **Europol** and **Interpol**. Raids in Spain and Portugal led to the seizure of computers, smartphones, and other digital devices allegedly used in the schemes, while police froze **€3 million** in criminal proceeds for potential victim restitution. Officials said the network’s main operators were taken into custody and the laundering infrastructure was effectively dismantled, though the investigation into its wider international links remains ongoing.
Jul 16, 2026
Law enforcement agencies across multiple countries have conducted significant operations targeting cybercriminal groups responsible for large-scale financial fraud, data breaches, and cryptocurrency theft. In Spain, police arrested a 19-year-old hacker accused of stealing and attempting to sell 64 million personal data records from nine companies, while Ukrainian authorities apprehended a separate data broker who used custom malware to compromise accounts and sell access on hacker forums. In California, a member of the so-called "Social Engineering Enterprise" pleaded guilty to laundering millions in cryptocurrency stolen through sophisticated social engineering attacks, with the group responsible for a $263 million heist and extravagant spending of the proceeds. Meanwhile, Russian police dismantled a gang that used NFCGate-based malware to steal millions from bank customers by tricking victims into installing fake banking apps and harvesting card credentials for remote theft. A major international operation led by Europol and Eurojust dismantled a €700 million cryptocurrency scam network in Europe that used deepfake videos and aggressive marketing to lure victims into fake investment schemes. The network operated numerous fraudulent platforms, laundered funds through complex channels, and was taken down in coordinated raids across several countries, resulting in arrests and the seizure of cash, cryptocurrencies, and luxury items. These actions highlight the growing sophistication of cyber-enabled financial crime and the increasing collaboration between law enforcement agencies to disrupt such operations on a global scale.
Jun 29, 2026
Romanian authorities, acting on a request from the UK, investigated two Romanian nationals suspected of operating a **hitman-for-hire** marketplace designed to conceal identities and payments. Prosecutors said the platform relied exclusively on **cryptocurrency**, held user funds in escrow until “jobs” were completed, and was structured to make financial flows difficult to trace; searches in Bucharest and Ramnicu Valcea reportedly resulted in the seizure of electronic storage devices, approximately **$650,000 in cryptocurrency**, and significant cash holdings. Potential charges cited include forming an organized criminal group, incitement to murder, attempted murder, and **money laundering**. Separately, police in Zeeland, the Netherlands arrested four suspects following a tip linking them to the theft of **169 NFTs** valued at roughly **€1.4 million**; the operation included seizure of data carriers, money, vehicles, and a residence, though the suspects were later released after interrogation as the investigation continued. The case highlights how blockchain-based assets (including NFTs) remain attractive targets for theft and fraud, with common access vectors including **phishing, social engineering, malware, and seed phrase theft**, and underscores the evidentiary role of seized digital media in crypto-asset investigations.
Jun 29, 2026