"The relaunch of the platform offered a similarly wide range of illegal goods and services, including stolen data, drugs, and forged documents. The relaunch most recently boasted over 22,000 users and more than 100 vendors," the BKA said.
Arrest in Mallorca and charges lodged by German authorities
Spanish police arrested a 35-year-old German national at his residence on Mallorca on Wednesday as part of an internationally coordinated operation tied to a European arrest warrant issued by Germany's Cybercrime Center, a unit of the Federal Criminal Police Office (BKA). The suspect, who police have not named and whom the BKA described as "one of the alleged leading figures in the German-speaking underground economy," is accused of building and administering a brand-new version of the German-language cybercrime forum Crimenetwork.
Beyond operating the relaunch, prosecutors say the suspect faces charges that include "trafficking in narcotics in not insignificant quantities" and running a network of fraudulent e-commerce sites that targeted consumers. Police allege he used false identities and had been hiding on Mallorca for several years; they identified him "primarily through technical investigations."
How the rebooted Crimenetwork operated and its scale
Crimenetwork, first launched in 2012, has been a fixture of the German-speaking underground for more than a decade. When authorities seized the forum’s servers in late 2024, they said the site had more than 100,000 users and 100 sellers. Days after that takedown, police say the suspect launched a rebuilt platform on a "completely new technical infrastructure." During 16 months of operation, the relaunch reportedly grew to over 22,000 users and more than 100 vendors.
Police allege the platform accepted multiple cryptocurrencies — named in the investigation as Bitcoin, Litecoin and Monero — and appears to have generated more than 3.6 million euros (about $4.2 million) in revenue over that period. Authorities say the platform operator received a cut of every transaction. Investigators also reported seizing about $228,000 in assets linked to the case.
Fraudulent e‑commerce network: 42 sites, ~1,000 alleged victims
Investigators say the suspect ran roughly 42 fake online shops, each with its own domain name, between March 2023 and January 2025. Karlsruhe Public Prosecutor's Office, and the Offenburg and Reutlingen Police headquarters reported that those sites defrauded approximately 1,000 Germans who collectively lost at least 323,000 euros (about $380,000).
The criminal pattern described in the joint press release involved instructing victims to send funds to foreign bank accounts; the funds were then transferred onward and "frequently converted into cryptocurrencies to conceal their origin," prosecutors said. Police reported they seized transaction and user data that is "providing valuable leads for further investigating the criminal structures behind the platform."
Investigative steps, seized material and follow‑up targets
As part of the coordinated operation, authorities searched "several properties in Germany" last week and seized "numerous electronic data storage devices," which will be examined by digital forensic investigators. Police report that they obtained data about users and their transactions, most of whom were located in German-speaking countries. Investigators said they are also targeting two other suspects, both German nationals.
In addition to evidence collection, law enforcement created a retro-looking website, www.bustedagaincrime.network, which they described as "aimed at former users of the recently shut-down trading platform." In a related judicial outcome from the original seizure, a judge in Germany in March sentenced the alleged operator of the first version of Crimenetwork to seven years and ten months in prison and ordered the confiscation of 10 million euros (about $11.8 million) in ill-gotten gains.
How technologists, prosecutors, and victims are affected
- Technologists and security teams: The platform's use of Bitcoin, Litecoin and Monero, and the rapid relaunch after a prior shutdown, underscores the resilience of marketplaces built on distributed payment rails and new hosting infrastructures. Police recovery of transactional and user data will be analyzed by digital forensic teams and could yield technical leads into platform architecture and vendor networks.
- Prosecutors and law enforcement: The operation demonstrates cross-border coordination — a European arrest warrant from Germany, an arrest by Spanish police, searches in Germany and joint press releases from regional prosecutor and police offices — and shows investigators are pursuing both platform operators and downstream fraud facilitators, including money-movement chains involving foreign bank accounts and cryptocurrency conversion.
- Consumers and victims: Authorities attribute roughly 323,000 euros in losses to the 42 fake shops, affecting about 1,000 Germans. The public-facing site aimed at former users signals a prosecutorial intent to harvest user cooperation and further intelligence from those who contacted or transacted with the marketplace.
The arrest in Mallorca and the subsequent seizures close one chapter in a long-running criminal ecosystem, but the investigation continues: two additional suspects are being targeted, seized digital media await forensic analysis, and prosecutors will seek to trace funds and vendor networks revealed in the recovered data. Whether that work will expose broader, organized structures behind the relaunch remains the next, concrete test for investigators.
