The Silk Road login page used a CAPTCHA implementation that briefly exposed a clearnet server IP in an HTTP header. The FBI used this IP to locate the server infrastructure, bypassing Tor entirely.

Alexandre Cazes (Alpha02) used his personal Hotmail address ([email protected]) as the sender in AlphaBay's automated welcome emails to new users. The email was trivially linked to his real identity through public records.

Hansa's servers were located in the Netherlands — within Dutch police jurisdiction. This allowed a domestic covert takeover without international legal barriers. The Dutch NCA operated the site for a month, collecting plaintext passwords and shipping addresses.

Despite being a Russian-language market serving the CIS region, Hydra's physical servers were hosted in Germany. The German BKA executed a domestic warrant to seize the hardware, requiring no complex international cooperation for the critical first step.

Wall Street Market's administrators drained funds gradually over several days rather than in a single move. This gave defrauded users time to contact law enforcement — and at least one user provided enough information to accelerate the identification and arrest of all three operators.

Monopoly Market's alleged operator Milomir Desnica chose Monero to avoid financial tracing, but was identified through traditional investigative methods unrelated to blockchain analysis. Cryptocurrency privacy does not substitute for comprehensive personal operational security.