OpenSpy The internet forgot. We kept the receipts.
Hive websites and infrastructure seizure
SEIZED

Hive websites and infrastructure seizure

hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion

ransomware

Last reviewed: 26 July 2026

Summary

The archived Hive onion address displayed a seizure banner on 26 January 2023. Announcements by the U.S. Department of Justice and Europol confirmed that authorities had taken control of Hive servers and websites.

Current assessment: ONLINE → SEIZED. Supporting sources appear below.

Before and after

BEFORE

AFTER

International law-enforcement seizure notice displayed on Hive infrastructure
Captured: 26 January 2023Status: SEIZED Source: Extortion Wiki seizure archive / seized.fyi

Select an available image to open the preserved archive copy.

Status history

  1. ONLINE → SEIZED

    Authorities seized control of Hive servers and websites and a seizure banner was archived for this address.

Record details

Domain
hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion
Category
ransomware
Current status
SEIZED
Previous status
ONLINE
First seen
Not confirmed for this address.
Last seen
No verified final online observation is preserved.
Changed at
26 January 2023
Action type
law-enforcement seizure
Agency
Federal Bureau of Investigation, German Federal Criminal Police, Netherlands National High Tech Crime Unit
Registrar
Not confirmed
Hosting provider
Not confirmed
Country
United States, Germany, Netherlands
Related operation
Not confirmed

What happened?

The archived Hive onion address displayed a seizure banner on 26 January 2023. Announcements by the U.S. Department of Justice and Europol confirmed that authorities had taken control of Hive servers and websites.

No replacement domain or mirror has been confirmed.

Visual similarity alone is not treated as evidence of common ownership. Websites can copy each other. This remains one of the internet’s more dependable features.

Extortion Wiki documents the actor, negotiations, ransom notes, victims, and related ransomware activity.

Open the full Extortion Wiki record →

vx-underground provides malware-family samples and technical research. These links provide family context and do not serve as evidence for the takedown documented above.

OpenSpy stores metadata and research links only. It does not mirror executable malware or sample archives.

Sources

  1. U.S. Department of Justice Disrupts Hive Ransomware Variant

    U.S. Department of Justice

    Type: official law-enforcement announcement · Published: 26 January 2023 · Accessed: 26 July 2026

  2. Cybercriminals stung as HIVE infrastructure shut down

    Europol

    Type: official law-enforcement announcement · Published: 26 January 2023 · Accessed: 26 July 2026

  3. Hive website seizure banner

    Extortion Wiki

    Type: verified archive record · Published: 26 January 2023 · Accessed: 26 July 2026

Record quality

Before snapshot
Not preserved
After snapshot
Available
Official confirmation
Not confirmed
Exact takedown time
Not confirmed
Last reviewed
26 July 2026

Found an error?

Send the record URL, the incorrect claim, and a source supporting the correction. “My friend said so” remains unsupported even when your friend types confidently.

Submit a correction →