Operation Alice — 373K Dark Web CSAM Sites Taken Down Across 23 Countries (2026)

Incident Summary

Operation Alice, a coordinated law enforcement operation spanning 23 countries, took down 373,000 dark web sites distributing child sexual abuse material (CSAM) between March 9 and 19, 2026.^[1] The operation seized 287 servers and identified 440 users of the CSAM distribution network, which had approximately 10,000 users who had collectively paid $400,000 in Bitcoin for access to the material.^[2] The primary operator of the network was traced to China.^[3] The scale of the operation — 373,000 sites — underscores the industrial scale at which CSAM distribution operates on the dark web, a scale that has been amplified by AI-generated content that enables the production of CSAM without direct involvement of real children in the production process. Operation Alice represents both the largest coordinated CSAM takedown to date and a demonstration that international law enforcement cooperation can operate at the scale necessary to disrupt dark web CSAM infrastructure.

Key Facts

• Sites taken down: 373,000 dark web CSAM sites^[1]
• Servers seized: 287 servers across 23 countries^[2]
• Users identified: 440 users^[2]
• Total users: Approximately 10,000 paying users^[3]
• Payments: $400,000 in Bitcoin^[3]
• Operator: Traced to China^[3]

Threat Patterns Involved

Primary: Representational Harm — The 373,000 CSAM sites represent the industrial-scale distribution of harmful representations of children, with AI-generated content enabling the production of CSAM at volumes that exceed what manual production could achieve.

Significance

1. Industrial-scale CSAM infrastructure — The 373,000 sites and 10,000 users demonstrate that dark web CSAM distribution operates at industrial scale, with dedicated infrastructure, payment systems, and user bases comparable to legitimate digital services
2. International coordination success — The 23-country operation demonstrates that law enforcement can coordinate at the scale necessary to disrupt global CSAM networks, providing a model for future operations
3. AI generation amplification — The sheer volume of content distributed across 373,000 sites suggests that AI-generated CSAM has amplified the production capacity of CSAM networks, enabling content creation at scales that would be impossible through traditional means
4. Bitcoin payment trail — The $400,000 in Bitcoin payments provides a financial trail that may enable further identification of users beyond the 440 already identified, demonstrating that cryptocurrency does not guarantee anonymity for CSAM purchasers