In April 2016, AlphaBay's API was compromised leading to 13,000 messages being stolen.[18] In January 2017, the API was once again compromised, allowing over 200,000 private messages from the last 30 days and a list of user names to be leaked. The attack was from a single hacker who was paid by AlphaBay for the disclosure. AlphaBay reported that the exploit had only been used in conjunction with this attack and not used previously.[19]