Three VPNs popular with criminals and active for over a decade have had their servers and web domains seized by law enforcement from US, Germany, France, others
Context & Ripple Effects
This is a coordinated infrastructure takedown rather than an arrest: authorities in the US, Germany, France and other countries seized the servers and web domains of three VPNs that had served criminal customers for over a decade. It lands in a stretch of coverage where VPNs are being pulled in opposite directions — as targets, with Hollywood's lawsuit against providers like ExpressVPN arguing the tools enable crimes well beyond piracy (Hollywood's expanding legal fight against VPN providers), and as instruments of state policy, with the US boosting funding for nthLink, Psiphon and Lantern to serve Russian users (increased US funding for circumvention VPNs).
First-order effects
- The three VPNs' users lose their anonymizing infrastructure overnight, and the operators lose the servers and domains their paid subscriptions ran on.
- Customers who believed a decade of uptime meant safety now have direct evidence that long-lived criminal services are visible to, and actionable by, multinational law enforcement.
Second-order effects
- Legitimate VPN brands inherit the suspicion: coverage of shady ownership structures like Kape Technologies' stable of VPNs and review sites (Kape's ownership of VPNs and review sites) gets sharper because seizures blur the line between privacy tools and criminal ones.
- Criminal customers migrate to replacement services or self-hosted setups, pushing investigators toward the same infrastructure-seizure playbook they would later use against ransomware operations like ALPHV (the ALPHV leak-site seizure).
Third-order effects
- If coordinated multi-country seizures become routine, running criminal infrastructure in any single jurisdiction stops being protection, reshaping how illicit services are hosted and priced.
- The privacy-tool market faces structural bifurcation — state-funded circumvention VPNs on one side, commercially scrutinized consumer VPNs on the other — with regulators and litigants increasingly treating 'VPN' as a category needing differentiated rules.
The trend: Law enforcement is shifting from pursuing individual offenders to seizing the shared infrastructure criminal ecosystems depend on, with cross-border coalitions making longevity itself a liability for illicit services.