red 
Operators of several darknet markets with combined sales of over $1 billion have pulled out in the past year – marking a shift away from the typical takedowns and “exit scams.” But what is behind this change?
Darknet markets are an important part of the underground criminal economy and facilitate the trade of illegal goods and services ranging from narcotics to hacking tools. Starting with Silk Road in 2011, over a hundred marketplaces have been established that bring in billions of dollars in sales. It is a dynamic and complex ecosystem, with numerous markets opening and closing every year. Market closures have most often taken the form of “exit fraud” or removal by law enforcement.
Exit scams involve an anonymous market operator simply disappearing – taking customers’ money, in the form of cryptocurrency, with them. For example, in late 2013 the operators of the Sheep Marketplace allegedly had disappeared with almost 40,000 bitcoins – now worth around $1.7 billion – belonging to their customers.
Takedown involves law enforcement investigators gaining access to the site’s underlying infrastructure and shutting it down. In some cases, market operators were also detained. In October 2013, the FBI shut down Silk Road and arrested Ross Ulbricht – the founder and operator of the market.
The past few months have seen an increase in darknet market shutdowns, but few have resulted from takedowns or exit scams. Instead, they retire voluntarily and in an orderly manner. Over the past year, several large marketplaces with total sales of over a billion dollars have been shut down in this manner.
What are the possible reasons for these recent closures? Why do darknet market operators choose to retire rather than simply steal their customers’ money and disappear?
1. They made enough money
Running a darknet market is undoubtedly a difficult and stressful job. Their operators have to attract customers, handle complaints and maintain infrastructure, all with the constant threat of arrest hanging over their heads. Successful markets can be very lucrative, and the rising prices of cryptocurrencies over the past year have also meant that those operators who have held onto their cryptocurrency have further increased their profits. But at some point, the financial rewards just aren’t enough.
For example, in early 2021 Joker’s Stash – at the time the leading marketplace for stolen credit cards – retired. Our analysis has indicated that its operator may have retired as a Bitcoin billionaire, thanks to over $400 million in sales on the site, combined with the rising price of Bitcoin.
Most recently, in October 2021, the White House Market—the largest English-language darknet marketplace operating at the time—announced its withdrawal. The service launched in 2019 and has hosted tens of thousands of ads for everything from hard drugs to hacking tools. According to our estimates, the total sales amount to more than 100 million dollars. Explaining the decision to withdraw on a darknet forum, the market operator stated:
2. The risk of getting caught has become too great
Law enforcement agencies have had notable successes in identifying and apprehending darknet market operators. Their focus usually falls on the largest markets, or those that have been in business the longest. This attention may be too much for some markets, which will voluntarily close rather than remain an obvious target for law enforcement for too long.
This could explain the withdrawal of ToRReZ Market in December 2021. After the White House Market called it a day two months earlier, it left ToRReZ as the leading player in the darknet market. This is the point the ToRReZ operator may have made in the forum post announcing their withdrawal:
“After 675 days of presence on the darknet, we have decided to close our doors forever. […] When choosing a new market, please use common sense. I would personally avoid any “established” market, the older they are, the greater the chances of collapse.”
3. They are extorted by other cybercriminals
In November 2021, the popular darknet cannabis marketplace Cannazon also announced its withdrawal. The service appears to have been motivated to withdraw after suffering a massive distributed denial of service (DDoS) attack, and its web server was shut down due to a deliberate flood of traffic.
These attacks are sometimes launched by competing markets to try to gain market share. More often they are just extortion attempts. Dream Market was forced to close faced a DDOS extortion in 2019, and the attacker demanded a ransom of $400,000.
4. Personal circumstances have changed
Changes in personal circumstances affect the professional lives of many, especially during global pandemics, and darknet market operators are no exception. January 12, 2022 UniCC – darknet marketplace for stolen credit cards – announced his retirement on a prominent card forum. UniCC became the market leader after the withdrawal of Joker’s Stash and achieved sales of $358 million.
In the notice, the UniCC operator cited health concerns as the primary reason for closing the market:
5. They Didn’t Actually Retire – They Were Arrested(?)
Things aren’t always what they seem when it comes to shutting down darknet markets. When European law enforcement shut down the Hansa market in July 2017, it was revealed that investigators were actually operate on the market for several weeks. Its operators were arrested in Germany almost a month ago, but it was kept quiet so that the Dutch police would take over and continue to work on the market to gather more information about Hansa’s users. This was coordinated with the takedown of Alphabay – another market – by law enforcement, in order to collect information on individuals who had migrated from Alphabay to Hansa. This has fueled paranoia among darknet market users, with many suspecting that the police are involved in any market shutdown.
Ten days after UniCC announced its withdrawal (but just before the announced closing date), it was registered that the Russian Federal Security Service (FSB) arrested the alleged operator of the site: Andrei Sergeevich Novak. It is unclear whether the arrest was in response to the retirement announcement or part of a larger operation involving taking control of UniCC.
Luxsocks – another marketplace “linked” to UniCC – displayed what appeared to be a “takedown notice” issued by the Russian Ministry of Internal Affairs:
Why do these markets avoid exit scams?
Once a market operator decides to close, an exit scam is a tempting exit. However, in the past six months, most of the closures have been orderly retirements, with buyers given advance notice and the ability to withdraw their funds.
One possible reason for this change is that reputation has become an increasingly valuable commodity on the dark web. In an environment where trust is in short supply, the experience of a pseudonymous actor is important if they want to work on the dark web in the future.
For example, in August 2021. Alphabay market has been relaunched by his former operator “DeSnake”, who was jailed in a major law enforcement operation four years earlier. This person was allegedly able to prove his identity using a cryptographic key – lending legitimacy to the relaunched market.
This motivation appears to be behind Torrez’s orderly retirement. In his December 2021 forum post, the operator suggested their eventual return with a new project:
Additionally, exit fraud may be less attractive when the operator has accumulated significant wealth – especially if there is a risk of retaliation from their clients.
What next for Darknet markets?
Does this recent surge in retirements signal the end of the darknet market? Probably not. Sellers and buyers are already exploring the remaining markets and deciding which ones to shift their business to.
Darknet marketplaces remain very lucrative businesses, and if anything, the retirement could give operators confidence that they can operate a successful marketplace and make a fortune—without getting busted.
However, monetizing the income from their activity will increasingly become a challenge. As regulation of cryptocurrency businesses, such as stock exchanges, has tightened, it has become increasingly difficult to launder these funds. Blockchain analytics capabilities like those provided by Elliptic also make it much more difficult for market operators to benefit from their proceeds – with law enforcement investigators and exchanges using such tools to identify and trace these assets.
Contact us to learn more about Elliptic’s cryptoasset research and compliance solutions.
