Two men from the German state of North Rhine-Westphalia are believed to be the masterminds behind the world's second largest Darknet market that was taken down this week by US and European law enforcement.

Authorities took down Hansa Market on Thursday, in a dramatic surprise that sent shockwaves across illicit online markets dealing in everything from drugs and weapons to forged documents.

Read the full story on the Alphabay and Hansa takedown here

Dutch authorities had been secretly running the site for more than a month after they seized its servers in the Netherlands, Germany and Lithuania.  During this time they were able to gather information on customers and the functioning of the darknet.

On the same day that Dutch police took control of the servers, the two German men running the site - a 30-year-old from Siegen and a 31-year-old from Cologne - were arrested. After their June 20 arrest the men were held in a prison in Bavaria and were only allowed to communicate with their lawyers.

The blow against Hansa came a month after Alphabay, the largest darknet market, mysteriously went down. It later emerged that Alphabay had been shut down and millions of dollars worth of cryptocurrencies seized, as well as servers in Canada and the Netherlands.  When Alphabay closed, many users fled to the rival Hansa Market. 

Investigation

Prosecutors in Frankfurt and the state of Bavaria are still investigating the Hansa case, which could last up to four more months. 

Frankfurt prosecutors accuse the men of abetting illicit drug sales, weapons trafficking and plagiarism of copyrighted goods.

"We estimate that this platform had a customer base in the five-digits. It was therefore the second largest Darknet market place in the world," Frankfurt chief prosecutors Georg Ungefuk told German public broadcaster WDR.

He said it was clear the two men had knowledge of IT in order to be able to run such a sophisticated operation. 

Separately, local German news "Westfälische Rundschau" quoted IT researcher Karsten Zimmer as claiming that he sent Europol critical evidence after examining the computer of an employee of a company.  The computer of the employee was apparently left open to the Hansa platform and contained child porn.

Read: German swoop in over child abuse images

Administrators ran a separate illegal site

Police have also taken a third person into custody, who allegedly operated another website alongside the two men running Hansa. Prosecutors in Bamberg, Bavaria, accused the men of copyright infringement

Under the domain www.LuL.to, which has been shut down, the three men were alleged to have run an online portal selling downloads of e-books, audio books, newspapers and magazines for as little as a few cents. 

Police searches led to the confiscation of 165,000 euros in bitcoins, cash and bank deposits.

The shut down of the markets came ahead of the one year anniversary of a spree shooting in Munich using a weapon bought on the darknet. In that shooting an 18-year-old gunman killed nine people. Police later arrested the person who sent the weapon and ammunition to the gunman.  

Read: Munich shooter bought gun online: Here's how the darknet works

Darknet websites have flourished on the web since Silk Road appeared in 2011. It was taken down two years later. 

cw/aw (AP, AFP, Reuters, WDR)