These Are Some of the Largest Darknet Markets That Pulled an Exit Scam and Completely Vanished

This article was originally published on Medium on February 28th, 2024.

There has been quite a few Darknet markets that have exit scammed as of late (the last 2–3 years), but most are not even some of the biggest in history.

Before we start, let’s discuss what categories Darknet markets normally fall under. Only markets that have exit scammed will be mentioned in this article:

• Exit Scam — This occurs when the admins of the market typically give no notice to any of the users and steal all of the crypto from the userbase. The example behavior usually will start with the site failing to show the login page or another type of initial page. The admins will state they are having a DDoS attack and are working through it. However, the users are left wondering and further communications usually stop. Some exit scams can also be gradual and done over the course of a couple days to weeks. Bohemia is a perfect recent example, but not covered in this article.
• Hacked — Sometimes darknet markets get hacked and this doesn’t occur from law enforcement, some shut down immediately and others fix the vulnerability and keep the market up. A perfect example was Black Market Reloaded. Black Market Reloaded had a VPS administrator allegedly leak the source code for the market in October 2013. The site was shut down after being compromised. It then re-opened after fixing the security vulnerability. A month later and towards the end of November 2013, Black Market Reloaded closed it’s doors. The admin, backopy, said this was due to an unmanageable influx of new users following the collapse of Sheep Marketplace and Silk Road.
• Respectfully Left — The admins notified it’s userbase that they would be closing up their market by a specific date. This gives the users time to transfer their crypto to their own wallet, if any is held on the market’s wallet. I go into “9 Darknet Markets That Left Gracefully” in this article. Admins will have a good outlook from the community, rather than outright stealing their money. This scenario is incredibly rare though.
• Seizure — While exit scams are quite common and admins who respectfully left the darknet are rare, seizures by different types of law enforcement agencies also are frequent. Law enforcement will usually look for ways to bypass the security of the market using vulnerabilities and gain access to protected infrastructure. Recon by LEA can take months or even more than a year depending on how large a market is. Keep in mind, just because a site gets seized, doesn’t mean LEA have arrested any of the admins. Hydra is a great example. LEA seized their market, but no one was arrested since it’s shutdown in April 2022, except for Dmitry Olegovich Pavlov. However, Dmitry was arrested in Russia and the USA does not have an extradition treaty in place.

Now that I have gone into details of how Darknet markets usually fall, I will be taking you through some of the Largest Darknet Markets That Pulled an Exit Scam and Completely Vanished.

Let’s take a look!

1. Market Name: Apollon

• Established Date: Mid-March, 2018
• Exit Date: January 27th, 2020
• Profit Taken: Estimated $2.5M — $30M at the time of exit
• URL (Offline): apollonujscjrlng[.]onion of many different mirrors
• Admins/Mods: Reloaded (admin), M53 (mod), Sudo (mod), Unknown Third Support Member (mod)
• Arrests: No admin/mod arrests known via documented research, multiple vendors arrested.
• Categories Offered: Drugs, Fraud, Guides, Digital Goods, Carding, Software/Malware, etc.
• Listings: 54,000+
• Notes: Users started to have issues where their accounts several days before the exit date. It was said that many buyers and vendors had their accounts locked, preventing anyone from logging into their accounts that had crypto in it. One vendor on Dread noted that they had lost over $10,000 in crypto. After the exit date an attacker starting a large DDoS attack against Dread, The Hub, Envoy, Other forums and some marketplaces. It is believed that Apollon may have been responsible for the DDoS, which also occurred on Empire Market simultaneously.

2. Market Name: AlphaBay Market Relaunch

• Established Date: August 8th, 2021
• Exit Date: February 9th, 2023
• Profit Taken: Estimated $10M at the time of exit
• URL (Offline): alphabay522szl32u4ci5e3iokdsyth56ei7rwngr2wm7i5jo54j2eid.onion of many different mirrors
• Admins/Mods: DeSnake (admin), TheCypriot (mod), wxmaz (mod)
• Arrests: No admin/mod arrests known via documented research, multiple vendors arrested. Multiple arrests in original AlphaBay including mod and original owner.
• Categories Offered: Fraud, Hacking, Malware, Drugs, Services, Security, Tutorials, Software, Digital Items, Counterfeit Items, etc.
• Listings: 50,000+
• Notes: In a kind of wild story that has been rumored since the site shut down, is in regards to DeSnake, admin of AlphaBay Market. On February 6th, 2023 users started to complain about 2FA no longer working and not being able to sign in to the market. DeSnake was a very outspoken admin and did multiple interviews and spoke heavily on Dread. He claimed in one interview that he resided in a country with no extradition to the USA. Also occurring on February 6th, 2023, a 7.8 earthquake struck southern and central Turkey and northern and western Syria. It is said DeSnake may have been living in Syria at the time and as a result of the earthquake, died. This is all just a rumor though and he hasn’t been spoken to since.

3. Market Name: Empire Market

• Established Date: February, 2018
• Exit Date: August 20th, 2020
• Profit Taken: Estimated $30M USD or 2,683 BTC at the time of exit.
• URL (Offline): oaj4azjxxxhlojk.onion of many different mirrors and Forum link: empire23d4mne2afpn4lnemfahydxp6dv3c7s6tekii3g7vel3xs7rad.onion
• Admins/Mods: Dopenugget (admin), Zero Angel/Sydney (admin), Se7en (mod), Orbital (mod), Melbourne (mod)
• Arrests: No admin/mod arrests known via documented research, multiple vendors arrested.
• Categories Offered: Fraud, Drugs, Tutorials, Counterfeit Items, Digital Products, Jewels, Carding, Services, Software and Malware, etc.
• Listings: 56,000+
• Notes: I am putting together an article specifically on Empire Market because of how big it was, how much money they stole and how they completely disappeared. This story is a big one and will take time. Stay tuned.

4. Market Name: Evolution

• Established Date: January 14th, 2014
• Exit Date: March 17th, 2015
• Profit Taken: Estimated $10M — $15M at the time of exit
• URL (Offline): k5zq47j6wd3wdvjq.onion of many different mirrors
• Admins/Mods: Verto (admin), Kimble (admin), NSWGreat (PR)
• Arrests: No admin/mod arrests known via documented research, multiple vendors arrested.
• Categories Offered: Drugs, Fraud, Tutorials, Services, Digital Goods, Drug Paraphernalia, Electronics, etc.
• Listings: 20,000+
• Notes: Evolution is best known for becoming the #1 market at the time when Silk Road was suddenly seized by law enforcement. But this was only for a brief period before they exit scammed. It is said Ross Ulbricht, the founder of Silk Road, was charged with being involved in Evolution market, but he has denied all involvement to this day. There has been no known arrests to the admins/mods/PR despite what one website claims, two admins were arrested. This is 100% NOT true.

5. Market Name: Nightmare Market

• Established Date: October, 2018
• Exit Date: July 24th, 2019
• Profit Taken: Estimated $10M at the time of exit
• URL (Offline): nightmareocykhgs.onion of many different mirrors
• Admins/Mods: Unknown Name (admin), Sandman (mod), Starlord (mod), Redbee (mod)
• Arrests: No admin/mod arrests known via documented research, multiple vendors arrested.
• Categories Offered: Drugs, Fraud, Services, Tutorials, Digital Products, Counterfeit, Hosting and Security, Software and Malware, Erotica, etc.
• Listings: 93,000+
• Notes: Leading up to Nightmare Market’s exit scam, buyers and vendors had difficulties logging into their accounts, DarkDotFail removed the listing, and Dread, Torum, The Hub and other forums began to show that an exit scam was starting to occur. In July, 2019 Nightmare Market allegedly had a data breach. Vendor mnemonics and internal messages between staff members were leaked. On July 24th, 2019 the onion was no longer online and all crypto was stolen.

Some other prominent Darknet Markets that exit scammed: Bohemia, Sheep Marketplace, Tor2door.

I really wanted to add BTC addresses of any admins/mods that I talked about earlier. However, it’s more difficult than it looks to find a definitive address with proof. I’m also only aware of 2 known BTC addresses of everyone mentioned above. Both of these addresses has no more than $35,000 in them. If you know of any BTC addresses that can be confirmed/verified, please leave a comment!

Every market has some things in common.. they all exit scammed, all of the admins and mods vanished, no one outside of vendors have ever been arrested and they made off with millions of dollars.

I hope you enjoyed this article and I’m happy to see everyone reading my previous ones. Have a good day and a great week and I will see you next time!!! 👋

DISLCAIMER NOTE: Using the Darknet and Dark Web is at your own risk. Act appropriately by using good OpSec. Please do your due diligence when doing anything, especially if you want to use a Darknet market. The URLs in this article are all OFFLINE onions that were owned by the market at some point before closure.

I currently only post on the links below. Please give a clap here and follow me on all my socials to see lots of things from the Dark Web. I regularly post on X/Twitter.

Medium: https://medium.com/@DarkWebInformer
X/Twitter: https://twitter.com/DarkWebInformer
Infosec Exchange: https://infosec.exchange/@DarkWebInformer
GitHub: https://github.com/DarkWebInformer
LinkedIn: https://linkedin.com/in/DarkWebInformer
Telegram Channel: https://t.me/TheDarkWebInformer
Telegram Contact: https://t.me/D4rkWebInformer