Black Hand: the story of the largest French-language marketplace on the dark web

Between April 2016 and June 2018, Black Hand held a unique place in the dark web ecosystem: that of the first — and largest — exclusively French-language marketplace. While AlphaBay, Silk Road, and Dream Market were transacting in English with seven-figure volumes, Black Hand carved out a niche: the French market, with its own codes, language, specific postal logistics, regional vendors, and loyal customer base. Two years of activity, 3,000 users, around sixty major vendors, and a spectacular fall on June 12, 2018, when it was dismantled by the gendarmerie under the coordination of the J3 section of the Paris prosecutor's office. This article traces the documented timeline of this landmark case in French cybercrime history.

Context: a fragmented French-language dark web

Before Black Hand, the French-language dark web was a fragmented landscape. A handful of discussion forums (FrenchBB, French Deep Web Forum) enabled informal exchanges, but no structured French-language marketplace had managed to establish itself. French vendors mostly operated on major English-language marketplaces (AlphaBay, Dream Market), simply noting in their profiles that they shipped from France.

This setup had two significant drawbacks. For vendors, the language barrier limited customer loyalty among French buyers. For buyers, cross-border postal logistics represented a real risk: customs interception, international tracking, and technical vocabulary in English that could easily lead to mistakes. A French buyer much preferred a French vendor shipping a standard parcel to a metropolitan French department.

Black Hand stepped into that gap. Its positioning was explicit from the very first forum posts: "The marketplace built for French speakers. Verified French vendors. Domestic shipping. Interface and support in French."

April 2016: the launch of Black Hand

Black Hand officially opened on April 24, 2016, announced via a post on French Deep Web Forum. The site was accessible at a .onion v2 address (v3 was not yet widespread at the time). The interface was in French, the design clean and understated, heavily inspired by AlphaBay's aesthetic but with its own color palette (black, red, gold accents).

The main administrator introduced himself under the alias "BlackHandFR". Early posts were methodical and professional: a detailed breakdown of the escrow system, moderation rules, vendor vetting criteria (a dummy first shipment required before a commercial account was opened), and customer support (a promise of responses within 12 hours).

Notably, BlackHandFR immediately banned several product categories from the platform. No firearms, no child sexual abuse material (obviously), no hitman services, no offensive hacking "as a service". This relatively restrained editorial stance earned it a reputation as a "serious market" within the community. Ultimately, the dominant categories were narcotics (70% of listings), forged identity documents (15%), and stolen banking data (10%), with a few residual categories.

How the site worked

Technically, Black Hand operated on a standard dark web marketplace architecture: a Tor-based web interface, multi-signature Bitcoin escrow, a vendor ratings and reviews system, and a separate community forum.

Fees and revenue

• Standard commission: 3.5% on each transaction (below AlphaBay's 4% to attract vendors)
• Vendor bond: €800 equivalent in Bitcoin
• Featured listings: €50 per week, capped at 10 featured listings per vendor

The platform's estimated monthly revenue at its peak (summer 2017) was around €600,000 to €800,000, generating estimated gross income for the operators of between €20,000 and €28,000 per month. Modest compared to AlphaBay (several million per month), but very substantial for a niche linguistic platform.

User base

Later court documents clarified the volumes: approximately 3,000 registered users with recent activity, including around sixty regularly active vendors. The geographic distribution of buyers mirrored metropolitan France, with an overrepresentation of Île-de-France, Bouches-du-Rhône, Nord, and Rhône departments — typical of the urban concentration of the French market.

The C3N investigation

The investigation began in autumn 2016, just a few months after Black Hand launched. It was entrusted to the C3N (Centre de lutte contre les criminalités numériques of the national gendarmerie), a specialist unit based in Pontoise, under the coordination of the J3 section of the Paris prosecutor's office (with an examining magistrate from the cybercrime division).

Infiltration

Two C3N officers opened buyer accounts on Black Hand in October and November 2016, using entirely fabricated profiles (plausible pseudonyms, manufactured forum histories, "clean" Bitcoin wallets prepared with innocuous purchases). They made several dozen small purchases from various vendors, documenting each time:

• The ordering process and escrow system
• Packaging techniques (padded envelopes, vacuum sealing, odor-masking chemistry)
• Postal routes from the sender's post office
• Product quality (analyzed by IRCGN laboratories)

Later, one officer even opened a vendor account and sold small quantities of gendarmerie-supplied products (embedded with trackers) to map the downstream courier network.

International cooperation

In parallel, the C3N worked with Europol and Dutch and German police to locate Black Hand's physical servers. The infrastructure was identified in a datacenter in the Netherlands (primary server) and in Romania (backup mirror). An international letter rogatory was issued in spring 2018 to prepare the coordinated seizure.

Blockchain analysis

The Bitcoin wallets used by the operators were traced through collaboration with Chainalysis and the French Treasury's TRACFIN unit. This analysis identified several exit addresses used by BlackHandFR to cash out the platform's revenue — notably through smaller European exchanges with lax controls on the origin of funds.

Fragile operational security

Despite initially sound operational security, the main administrator made several mistakes that allowed investigators to gradually locate him:

• Reuse of the same PGP key between his "public" forum presence (under a different alias) and his BlackHandFR account — enabling linguistic and semantic cross-referencing
• Leaking a personal IP address during a server maintenance session in 2017 (a direct connection without a VPN for a few minutes)
• Listing photos uploaded by other vendors that contained uncleaned EXIF metadata, providing geolocation clues — not about BlackHandFR directly, but generating leads that traced back to certain vendors who later testified against the operators

June 12, 2018: the takedown

On June 12, 2018, at 6:30 a.m., a coordinated operation was simultaneously launched across around ten French cities. The primary targets:

• BlackHandFR — arrested at his home in the Paris region. Three computers, 2 phones, several USB drives, approximately €15,000 in cash, and crypto wallets containing around €180,000 at the day's exchange rate were seized
• 2 moderators — one in Ivry-sur-Seine, the other in Toulouse. Computing equipment and documents seized
• 12 major vendors — across France, with seizure of drug stocks totaling several kilograms

Simultaneously, in the Netherlands, Black Hand's primary servers were seized by Dutch police in coordination with the French gendarmerie. The site went offline at 9:00 a.m. French time, replaced by a seizure page co-signed by French and Dutch agencies and Europol.

The operation was officially announced the following day, June 13, 2018, at a joint press conference by the gendarmerie and the Paris prosecutor's office. The official statement highlighted the dismantling of "the leading French-language dark web marketplace," citing the investigation's figures (80 cumulative arrests over the following two years).

Trials and convictions

The legal proceedings stretched over several years, as the case required hearing hundreds of witnesses and processing several terabytes of digital data.

The main administrator

BlackHandFR's trial was held in June 2019 before the 32nd criminal chamber of the Paris tribunal de grande instance. After three weeks of hearings, he was convicted on June 21, 2019, and sentenced to:

• 8 years in prison with a two-thirds mandatory minimum term
• A fine of €500,000
• Confiscation of all seized crypto assets and real estate acquired through platform revenues
• A permanent ban from working as an IT professional

The sentence was one of the harshest handed down in France in a dark web case. Several legal commentators (see analyses by Me Olivier Iteanu in Les Cahiers de la Justice) viewed it as a clear message of firmness from the Paris prosecutor's office against operators of illegal marketplaces.

Moderators and vendors

The two moderators were sentenced to 4 years and 3 years in prison respectively. Major vendors received sentences ranging from 2 to 6 years depending on volumes and the nature of the products sold. High-volume buyers were prosecuted in separate proceedings — only some received effective convictions, while others had their cases dropped conditionally or received formal warnings.

Consequences for the French dark web

The dismantling of Black Hand had a structural effect on the French-language dark web:

• Collapse of the autonomous French-language market: no new French marketplace managed to establish itself after 2018. Attempts (French Dark Place, FDM Market) remained negligible
• Migration to international marketplaces: French-speaking vendors who continued their activity opened accounts on more robust English-language platforms
• Rise of private channels: encrypted Telegram, Signal, Session, and private Matrix/XMPP servers absorbed a significant share of traffic, bringing their own risks (no escrow system, proliferation of scams)
• Strengthening of French investigative capabilities: the C3N and the J3 section of the Paris prosecutor's office developed expertise and procedures that were applied in subsequent cases (several individual vendor convictions in 2020–2024)

For a complete overview of the French legal framework on the dark web, see our guide to the dark web in France.

Lessons from the case

The Black Hand case offers several key lessons.

On operational security. BlackHandFR's mistakes are typical: reuse of PGP keys across identities, a moment of carelessness with a VPN disabled, semantic traces linking multiple accounts. None of these errors were technically sophisticated — they are the classic blunders that every operational security training warns against.

On the balance of forces. French agencies are capable, when they commit the resources, of dismantling a dark web marketplace in 20 months of investigation. International cooperation works. What limits large-scale takedowns is not technical capability but the allocation of investigative resources: the gendarmerie's cyber budgets remain modest relative to the scale of the problem.

On judicial strategy. The 8-year sentence handed to BlackHandFR is seen as a deterrent benchmark. It is heavier than comparable sentences in other European countries for similar cases (typically 4 to 6 years). This French firmness is documented in the J3 section's annual reports.

On the ecosystem. Black Hand's disappearance left a lasting void. The French-language market did not recreate an autonomous marketplace. This absence is either a sign of success for the authorities (deterrence is working), or a shift toward less visible channels (Telegram, Signal) — which complicates investigation but does not necessarily reduce the overall volume of illegal transactions.

FAQ on the Black Hand case