There are some interesting theories being tossed around. I'd like to add one more.

The common thread across all darknet websites is the fact that they generally run from datacenters. Most people don't host websites from their residence.

Further, most people don't colocate servers anymore. I would be surprised if any of the 414 websites operated on boxes that had been colocated. However I won't rule out that colocating is also compromised.

I'd like to posit the following law of nature: You can't run a darknet website from a datacenter and think you've hidden the location of the server, regardless of whether it's using Tor or other anonymity software.

Why not? Because the datacenter has the ability to image servers, along with the ability to notice that you're generating large amounts of outgoing Tor traffic (or other anonymity software).

Here's how the attack may have happened: Step one, collect data about which computers are sending and receiving large amounts of Tor bandwidth. Step two, if the server resides in a datacenter, request an image of the server. Step three, you now know whether the server is a darknet website.

Remember, the point of Tor is to hide the final IP address of a web request or web service. It does not hide the total volume of traffic that must be delivered. And it can't. If you operate a darknet marketplace, you're probably serving a large volume of traffic. Guess who notices? ISPs and datacenters. Guess which datacenters can be trusted not to divulge an image of your server to authorities? None of them.

What do I think the future of darknet opsec will look like? Well, if you're reading this, and you're an individual or group interested in pursuing your ideology through a darknet website, you will need to run your website from a datacenter and not rent your server in your name. In fact, your opsec needs to be so good that there's no way to trace the account back to you. This sounds hard, and it is, but it's possible. Secondly, you must assume at all times that the server you're using is compromised. Assume that aurhorities can access the contents of the server, can manipulate it, and can subvert anything you put on it.

This is a grim situation, to be sure. The above assumption is that you are never safe from authorities gaining a copy of the contents of your datacenter-hosted darknet website (including any databases), and from a takedown of the service whenever authorities deem to do so.

Here's the ray of hope: Just because they takedown your website doesn't mean they take you down. This is where opsec comes into play, and it's our last hope. Every other link in the chain of trust for darknet websites has been broken. The one and only chance is that you can figure out a way to create accounts at datacenters without authorities being able to trace them back to you.

Authorities takedown your service? Okay, start it again at some other datacenter. Authorities get a copy of what's on your server? Okay, no problem: you were assuming it was compromised anyway, right? Authorities install a program to make your software malfunction? That's unfortunate, and will shake the trust in your website, but it's possible to recover from this.

Do your best, and do not get caught. The rest follows from this.

At a minimum, you need to research opsec. Read history of how groups have evaded detection. Do your research using Tor, because associating such Google searches with your home account is a terrible mistake.

One of your biggest problems is going to be anonymous money. No, bitcoin won't help you. You can't rent a server from a datacenter using bitcoin. But you can anonymize your money and then use that money to rent your server.

It's a long shot, but it's all we've got left. Be perfect. There's no room for error. Or realize the truth: If you can't be perfect, you will get caught. And you may get caught anyway. Being perfect sounds impossible, but human history has shown that there are situations in which no or few mistakes are made. I would recommend you research those situations and how to minimize the total number of mistakes you make. Use software to help you do this, while realizing that clever software alone won't be enough. For example, if you're configuring an individual piece of software on your personal computer to connect to your darknet website, even through Tor, you're doing it wrong. You need to isolate yourself from this equation at all times. Sound hard? Oh, it's hard. It will slowly dawn on you how hard this method of operating is. Convenience? No. You don't get to enjoy the benefits of convenience. Convenience is the opposite of security.

Oh, and if you do happen to somehow make a lot of money, you should keep it as bitcoin for the forseeable future. What good is it? Maybe converting small amounts won't be noticed. On the other hand, converting large amounts of bitcoin to dollars will be noticed, and it's extraordinarily dangerous to your opsec.

I'll be around to answer questions if you have them. If you'd like to ask a question anonymously using Tor, create a new HN account and post your question. I'll see it, but it will show up as dead on HN, so I won't be able to reply to it directly. So I'll reply to my own comment with a copy of your question, along with a response. Then you can reply to that, and I'll repeat the process.

HN is one of the few websites that we can even have these kinds of conversations on using Tor. Everything on Reddit is autokilled. 4chan doesn't let you use Tor. Maybe we should work on this problem first: How to make the equivalent of unlisted Tor exit nodes so that Tor isn't so trivially blocked?

There are a lot of ideas in my comment, and some of them are better than others. I hope that the bad ideas can be discarded and the good ones refined until we have someting workable.