Together with the Swedish Police and private sector including Bitdefender, Finnish Customs has closed down and seized the contents of network servers of the Sipulitie marketplace that was operating on the Tor network from 2023. The site was used for criminal activities, such as for the anonymous sale of narcotics.

The online narcotics marketplace Sipulitie, which operated as a hidden service on the encrypted Tor network, was opened for business in February 2023. The site, operating in Finnish and English, was used for criminal activities, such as selling narcotics under the protection of anonymity. The administrator of the site has stated on public forums that the turnover of Sipulitie amounted to 1.3 million euros.

“Over the years, we at Finnish Customs have intervened effectively using many different methods in the criminal activities taking place on the dark web. Seamless cooperation between the authorities at both the national and the international level plays a crucial role in combating online crime,” says Hannu Sinkkonen, Director of Enforcement at Finnish Customs.

Preliminary Investigation Identified the Persons Responsible for the Criminal Activities

Sipulimarket, the predecessor of Sipulitie, was launched in April 2019. Criminal trade in narcotics and doping substances was conducted under the protection of the anonymity provided by the Finnish-language site. Finnish Customs closed down the site in December 2020 in cooperation with Polish authorities. The turnover of the Sipulimarket site is estimated to have exceeded two million euros.

The preliminary investigation has shown that after Finnish Customs closed down Sipulimarket in 2020, its administrator opened a new marketplace for selling narcotics, that is, the Sipulitie marketplace that has now been closed down, and that this person also administered this new site. The same person is also suspected of having acted as the administrator of a 2022 opened chat-based sales website called Tsätti. Finnish Customs has now closed also the Tsätti website.

The criminal investigation has identified the administrator of Sipulitie, Sipulimarket and Tsätti. In addition, the investigation has also uncovered the identities of persons who acted in support roles in the administration of the site, such as moderators and customer service agents. Based on the seized material, it has also been possible to identify sellers and buyers who were trading on the Sipulitie site.

During the preliminary investigation, Finnish Customs has cooperated broadly with the Swedish Police, Europol and various police units in Finland. The preliminary investigation is still ongoing.

“We are extremely pleased with the successful takedown of the Sipulitie and Tsatti dark markets, and congratulate Finnish Customs, the Swedish Police, global law enforcement, and all those involved,” said Bitdefender Chief Security Strategist Alex Cosoi. “This operation exemplifies the power of collaboration between the public and private security sector in dismantling illegal online activities, in this case, markets that sold large amounts of narcotics. It also serves a message to criminals who believe the dark web covers their actions and guarantees their anonymity. If they become the target of an international effort, they can’t hide.”