The Nightmare of Disappearing Darknet Markets

Author: Heather Antoinetti

The administrators of the Nightmare Market performed an exit scam In July 2019. Discussion and speculation around exit scams is common on dark web forums.

Figure 1: Exit scam motivations

The screenshot above is from a reputable darknet forum. In it, a user named “r00b00t” explains their view on the disappearances of darknet markets and what motivates the administrators to execute exit scams. They say, “exit scams happen when the market admins want to steal $10 million or when the admins are close to being arrested. [They] exit with [the] BTC [in escrow] and disappear. They don’t care about normal users losing money.” It appears that Nightmare Market was no exception. It seems as if the administrators were tempted by the significant funds in escrow, and cashed out. 

The centralized nature of darknet markets where administrators set the rules and control the flow of funds through the market make it easy to defraud users of the sites. In many cases, operators of darknet markets succumb to the allure of the large amounts of cash being deposited into escrow under their control. However, GroupSense researchers have observed other exit scam motivations. 

Understanding the competitive landscape of the dark web

Much like the capitalist world, there is a great deal of competition among darknet marketplaces. The biggest darknet markets such as Empire Market, Berlusconi Market, Cryptonia Market, and Apollon Market are embroiled in a competition to become the primary market for dark web transactions. 

Because of the proliferation of larger markets that users already trust, smaller darknet markets seeking to attract users must first focus on eliminating access to the competition. These smaller players seek to create disruption and undermine trust in the larger markets with tactics such as Distributed Denial of Service, or DDoS attacks. This ‘old reliable’ tactic is among one of the most common methods used to target the leading darknet marketplaces. DDoS attacks make the competitor websites unreliable, which in turn redirects the stream of users to lesser-used darknet markets. 

The future of the dark web

As competition and greed continue to pervade this criminal industry, we expect to see further exit scams and a reduction in the overall number of dark web markets. Our researchers have also been tracking an interesting trend where mainstream technologies such as Telegram are being used to make dark web services more accessible to a larger audience.

Subscribe to our blog to find out more

Figure 2: Decentralization of dark web markets

With the volatile nature of the darknet and the continuing consolidation and centralization it will become increasingly difficult for enterprises to access and monitor dark web forums. Having a trusted partner like GroupSense with deep reach and access to this ever changing landscape is a critical component of a holistic digital risk strategy.

This post was contributed by Viktor Banov of the GroupSense research team.