Record number of dark online markets as the demand for illegal goods and services continues to grow
The criminal environment of the darknet markets is extremely turbulent. Numerous darknet markets are introduced each year, and just as many are constantly running out, confiscated, or otherwise perishing. Despite this barrage, CipherTrace has discovered more dark online markets than ever before.
CipherTrace researchers are currently monitoring over 35 active darknet markets. The newest darknet markets – both launched around the beginning of September – are the Invictus Market and the Lime Market. Lime Market, which is believed to be run by the former administrators of DarkBay, appears to be a very small market and is not expected to become a very notable company. Invictus Market, on the other hand, is operated by the administrators of the well-known darknet service Imperiya – a company that creates and maintains darknet shops for a small fee. With Invictus admins already having a good reputation in the darknet community, it was growing rapidly. However, while Invictus gained nearly 10,000 customer accounts in the first month, Invictus’ customer base had barely exceeded 10,000 accounts by the end of its second month of operation (October 20), suggesting that its exponential growth has slowed drastically.
Three turbulent exit scams
Empire Market was one of the largest, longest running, and most successful darknet markets. Founded in February 2018, Empire rose to become the largest darknet market in the western world in its time. However, in late August 2020 the dark market spun and the exit was scammed – a scheme in which a dark market or fraudulent exchange ceases to operate and steals all funds in escrow and account wallets. An expiring market will either close abruptly or stay online with escrow withdrawals and withdrawals disabled but deposits still enabled so the scammers can deposit more funds until users understand.
After Empire left, its providers and customers had to move to a new market, which resulted in a large influx of new users across all of the other open darknet markets.
On September 10th – less than three weeks after Empire exited – the Icarus market went offline too. The site never opened again and took away all of its sellers and customers’ funds. Icarus had made a major effort to update shortly before the exit, leading CipherTrace analysts to believe that the exit was likely not planned. Rather, it is likely that the large influx of new users from Empire and their deposits has made Icarus ripe for a profitable exit. As a result, the admins may have taken the opportunity and quit earlier than originally planned.
Sometime around October 12th, the DeepSea market suddenly went offline too. After just a few days with no news from the market administrators, users and a moderator on the DeepSea forum concluded that the market had been cheated. At the time of this writing, it has been a week since the market went offline. It is possible – but unlikely – that the market will return. It could have been confiscated instead of betrayed, but law enforcement agencies have not yet disclosed the confiscation. If the market does not return and law enforcement authorities do not disclose the seizure, it can be concluded that DeapSea has been scammed.
The White House Market will take some of the traffic from these outlets due to its good reputation with darknet users and has the potential to become the next largest market. However, the high security requirements of the White House Market tend to reject the average Dark Market user. It is more likely that DarkMarket will take over much of the traffic from the Empire, Icarus, and DeepSea exit fraud cases.
As it stands, DarkMarket and White House Market appear to be the largest darknet markets in the western world, each with over 300,000 customer accounts. The White House market saw user numbers increase by 40% between August 27 and September 28 following the Icarus exit scam and another 8-10% increase between late September and October 20. The second most important currently active darknet markets are Versus Market, Monopoly Market, ToRReZ Market and of course the Russian darknet giant Hydra, which has been active since 2015 and is probably the largest darknet market in the world.
Why so many dark markets come and go
Creating a darknet market requires low up-front costs, and the potential rewards can be high – the Empire’s market administrators, for example, have reportedly benefited around $ 30 million from their exit scam alone, excluding the money they put into the have earned two years of operation. The Evolution market was left with $ 12 million in user bitcoins. As a result, numerous darknet markets are launched every year. According to CipherTrace research, at least one significant darknet market has been launched on average every month since early 2019.
However, darknet markets are going as fast as they come. The ultimate fate of all darknet markets is to be attacked, hacked, put an end to scams, or voluntarily shut down. It is very likely that the majority of darknet markets plan to end fraud from the start, especially as Plan B if things go sideways.
Operating a darknet market is risky. Market operators have a long list of opponents. Law enforcement is the most obvious, powerful, and dangerous adversary of a darknet market. If a market runs long enough, it will likely be confiscated and its operators arrested. Ten years ago the first dark market, The Farmers Market, appeared on the Tor network; Eight years ago, the eight founders were arrested, seven pleaded guilty, and the leader was sentenced to ten years in prison for selling narcotics and money laundering. Ross Ulbricht, aka Dread Pirate Roberts, reportedly ran Silk Road – the first large dark market with over 100,000 customers. Ulbricht was also charged with murder and sentenced to double life imprisonment plus forty years with no parole. Ulbricht built this black market bazaar to take advantage of the dark web and the digital currency Bitcoin to allow users to conduct illegal business beyond the reach of law enforcement agencies. According to the DOJ, “Ulbricht’s arrest and conviction – and our seizure of millions of dollars from Silk Road Bitcoins – should send a clear message to anyone else trying to run an online criminal business. The supposed anonymity of the Darknet is not a shield against arrest and prosecution.
Darknet markets are also constantly at risk of being hacked by attackers stealing funds from a market’s hot wallet, blackmailing admins or attempting an attack that could result in a profit. In addition, darknet markets are constantly receiving Denial of Service (DoS) attacks. DoS attacks on a market can be carried out by individuals seeking ransom, administrators of a competing market seeking to restrict competition, or even law enforcement agencies seeking to destabilize these criminal organizations.
Even if a market wants to exist forever and manages not to be occupied or hacked, there is always the possibility that either its operational security slips or an attack threatens the admins too much when they are forced to carry out their plan B: an exit Scam. By carrying out an exit scam, the administrators of a darknet market can solve their problem while making a significant profit.
The ease of creating a dark market
The ease of creating a dark market adds to its lucrative appeal, especially if one intends to put an end to scams. While the biggest hurdle to running a dark market was once getting the trust of vendors and customers to use your website, the spate of seizures and exits makes many jump from one dark market to the next.
There are many ways that criminals can quickly create dark markets. The easiest way is to simply buy a pre-made marketplace template – all the customer has to do is replace placeholder text and install the software on their servers. This method was used by the popular DarkMarket. The current price for a standard, pre-made marketplace kit that accepts BTC and Monero is only $ 599 in BTC. Support for additional coins ranges from $ 50 to $ 90 per coin. These upfront costs are tiny compared to the profits of many of the established exit scams.
The ease of creating your own dark market, coupled with the profitability of exit fraud and the constant demand that comes from the volume of customer accounts in these marketplaces, culminates in a record number of dark markets now online. It’s likely that this number will continue to rise in the future, however, employing blockchain analytics like CipherTrace can ensure that the funds coming out of one of these dark markets are identified the moment they are fiat-off -Ramps as exchanges are moved.