The criminal environment of darknet markets is extremely turbulent. Numerous darknet markets are launched every year and just as many are constantly exiting, being seized, or otherwise going defunct. Despite this barrage, CipherTrace has noted more dark markets online than ever before.
CipherTrace researchers are currently monitoring over 35 active darknet markets. The newest darknet markets – both launched around early September – are Invictus Market and Lime Market. Lime Market, thought to be run by the former admins of DarkBay, appears to be a very small market and is not expected to become a very notable enterprise. Invictus Market, on the other hand, is run by the admins of the well-known Imperiya darknet service—an enterprise that creates and maintains darknet vendor shops for a modest fee. As the admins of Invictus already have a good reputation among the darknet community, it stood to see quick growth. However, while Invictus was able to gain close to 10,000 customer accounts in its first month, by the end of its second month of operation (October 20), Invictus’ customer base had barely surpassed 10,000 accounts, indicating its exponential growth appears to have slowed drastically.
Three Tumultuous Exit Scams
Empire Market was one of the largest, longest running and most successful darknet markets. Launched in February of 2018, Empire rose to become the largest darknet market in the Western world during its time. However, by late August 2020 the dark market pivoted and exit scammed—a scheme where a dark market or fraudulent exchange ceases operation and steals all the funds in escrow and account wallets. An exiting market will either abruptly shut down or remain online with escrow payouts and withdrawals disabled, but deposits still enabled, allowing the scammers to net more funds until users catch on.
Following Empire’s exit, its vendors and customers had to move to a new market, leading to a large influx of new users on all other open darknet markets.
On September 10—less than three weeks after Empire’s exit—Icarus Market also went offline. The site never came back up, taking all their vendors’ and customers’ funds with them . Icarus had been pushing high effort updates soon before the exit, leading CipherTrace analysts to believe that the exit likely wasn’t planned. Rather, it’s probable that the large influx of new users from Empire and their deposits made Icarus ripe for a profitable exit. As a result, the admins may have taken advantage of the opportunity and exited sooner than they had originally planned.
Sometime around October 12, DeepSea market also abruptly went offline. After just a few days with no word from market admins, users and one DeepSea forum moderator concluded that the market had exit scammed. As of the writing of this report, it has been one week since the market went offline. It is possible—but unlikely—that the market will return. It could have been seized instead of exit scammed, but law enforcement has yet to announce the seizure. If the market doesn’t return and law enforcement don’t announce a seizure, it can be concluded that DeapSea has exit scammed.
White House Market, due to its good reputation among darknet users, will take some traffic from these exits and has the potential to be the next biggest market. However, White House Market’s high security requirements tends to turn the average dark market user away. It is more likely that DarkMarket will take much of the traffic from the Empire, Icarus, and DeepSea exit scams.
As it stands, DarkMarket and White House Market appear to be the largest darknet markets in the Western world with over 300,000 customer accounts each. White House Market saw a 40% increase in users between August 27 and September 28, following the exit scam of Icarus, and a further 8-10% increase between late September and October 20. The next most notable darknet markets currently active are Versus Market, Monopoly Market, ToRReZ Market, and of course the Russian darknet behemoth—Hydra—which has been active since 2015 and is likely the largest darknet market in the world.
Why So Many Dark Markets Come and Go
Creating a darknet market requires little upfront cost, and the potential rewards can be high—Empire market admins, for example, reportedly profited around $30 million from their exit scam alone, not including the money they made in the two years of their operation. Evolution market exited with $12 million in user bitcoin. This results in numerous darknet markets launching every year. According to CipherTrace research, there has been at least one notable darknet market launched every month on average since early 2019.
However, darknet markets go as quickly as they come. The eventual fate of all darknet markets is to be seized, to be hacked, to exit scam, or to voluntarily shut down. It’s most likely that the majority of darknet markets plan to exit scam from their inception, especially as a plan B if things go sideways.
Operating a darknet market is risky. Market operators have a long list of adversaries. Law enforcement is the most obvious, powerful, and dangerous adversary of a darknet market. If a market runs for long enough, it’s likely to be seized and its operators arrested. Ten years ago, the first dark market, The Farmers Market, appeared on the Tor network; eight years ago its eight founders were arrested, seven pled guilty and the leader was convicted to 10 years in prison for selling narcotics and laundering money. Ross Ulbricht, aka Dread Pirate Roberts, allegedly operated Silk Road—the first large scale dark market with over 100,000 customers. Ulbricht was also charged with a murder for hire plot and was sentenced to a double life sentence plus forty years without the possibility of parole. Ulbricht built this black market bazaar to exploit the dark web and the digital currency Bitcoin to allow users to conduct illegal business beyond the reach of law enforcement. According to the DOJ “Ulbricht’s arrest and conviction – and our seizure of millions of dollars of Silk Road Bitcoins – should send a clear message to anyone else attempting to operate an online criminal enterprise. The supposed anonymity of the dark web is not a protective shield from arrest and prosecution.
Darknet markets are also under constant threat of being hacked by adversaries who want to steal funds from a market’s hot wallet, extort the admins, or conduct an attack that might lead to a profit. Furthermore, darknet markets are constantly receiving Denial of Service (DoS) attacks. DoS attacks on a market might be conducted by an individual demanding ransom, by admins of a competing market who want to diminish competition, or even by law enforcement who want to destabilize these criminal enterprises.
Even if a market intends to be around forever and manages to avoid being seized or hacked, there is always the chance of either a slip up in their operational security or an attack that poses too great a threat to the admins that they’re forced to execute their plan B: an exit scam. By conducting an exit scam, the admins of a darknet market are able to solve their problem while making a substantial profit.
The Ease of Creating a Dark Market
The ease of creating a dark market adds to its lucrative appeal, particularly if one intends to exit scam. While the biggest hurdle to operating a dark market was once the issue of gaining the trust of vendors and customers to use your site, the barrage of seizures and exits leaves many bouncing to and from one dark market to the next.
There are many ways criminals can quickly produce dark markets, with the easiest being to simply buy a pre-built marketplace template—all the customer has to do is replace any place-holder text and install the software to their servers. This method was used by the popular dark market “DarkMarket.” The current price for a standard, pre-built marketplace kit that accepts BTC and Monero is only $599 in BTC. Support for additional coins range from $50-$90 per coin. This upfront cost is minuscule when compared to the profits of many of the established exit scams.
The ease of creating your own dark market, coupled with the profitability of exit scamming and constant demand shown by the volume of customer accounts on these marketplaces culminate in a record number of dark markets now online. It is likely that this number will only grow in the future, however, the use of blockchain analytics such as CipherTrace can ensure that the funds originating from any of these dark markets are identified the moment they are moved to fiat off-ramps such as exchanges.