Darknet Market mortality risks

Survival analysis of lifespans, deaths, and predictive factors of Tor-Bitcoin darknet markets
statistics, predictions, Bitcoin, Silk-Road, R
2013-10-302019-06-09 in progress certainty: possible importance: 7


I com­pile a dataset of 87 pub­lic Eng­lish-lan­guage dark­net mar­kets (DNMs) 2011–2016 in the vein of the famous , record­ing their openings/closing and rel­e­vant char­ac­ter­is­tics. A sur­vival analy­sis indi­cates the mar­kets fol­low a Type TODO lifes­pan, with a median life of TODO months. Risk fac­tors include TODO. With the best mod­el, I gen­er­ate esti­mates for the cur­rent­ly-op­er­at­ing mar­kets.

The most strik­ing aspect of dark­net mar­kets (DNMs; online web­sites sell­ing drugs and other goods using cryp­tocur­ren­cies), after the fact that they are so suc­cess­ful and exist at all, is how much turnover there is. The casual observer of DNMs will quickly become con­fused by the sheer num­ber of DNMs over time, and their short life­times. How many are there? What pre­dicts longer or shorter life­times? Why are they so tran­sient? How do they die? Here I try to shed some light on these ques­tions by tab­u­lat­ing all known launched Eng­lish-lan­guage DNMs from the inven­tion of the busi­ness model by Silk Road 1 up through 2016. I am inter­ested in web­sites sell­ing drugs over Tor or i2p, using cryp­tocur­ren­cies like Bitcoin/Litecoin/Dogecoin, allow­ing mul­ti­ple sell­ers other than the site oper­a­tors, and pro­vid­ing some sort of escrow func­tion­al­i­ty. This excludes clear­net sites like Top­ix, sin­gle-ven­dor shops like Mod­ern Cul­ture or Bungee54, card­ing shops like Tor Carders Mar­ket, host­ing ser­vices like Cryuserv or Bad Wolf, DNM-focused forums like The Hub, and forums for buy­ers & sell­ers to deal directly with each other like The Majes­tic Gar­den.

For­eign lan­guage mar­kets are excluded because I can­not nav­i­gate them1; Drug­Mar­ket, Bigshop & a few oth­ers are excluded because they report­edly have always been a scam (sim­i­larly for most sites listed on the noto­ri­ously wrong Hid­den Wik­i); the Majes­tic Gar­den & Under­ground Mar­ket Board 3.0 are excluded because they are forums & do not do escrow for their users; Grand Trunk never left beta & had actual sales.

Data

Vari­ables:

  • start/end dates are, when pos­si­ble, the date of the first & last known sales/withdrawals; oth­er­wise they are rounded to my first/last visit to them; or to the start/end of the month they appeared/disappeared
  • clo­sure: whether the shut down was due to law enforce­ment, pre­cip­i­tated by a hack or de-anonymiza­tion, a scam/theft by oper­a­tors, or vol­un­tary (with­out known losses to users)
  • arrest­ed: whether the prin­ci­pal operator/owner/maintainer of the mar­ket­place was arrested for run­ning it (this excludes hired staff)
  • mul­ti­sig: whether 2-of-3 escrow sup­port­ed; 2-of-2 and other ‘lite’ ver­sions are not con­sid­ered mul­ti­sig because they still allow for thefts
  • i2p: whether i2p is used in addition/instead of Tor
  • hacks: num­ber of pub­licly known hacks result­ing in leaks of user infor­ma­tion, loss of funds, etc
  • doxed: whether a plau­si­ble can­di­date for site oper­a­tors has been made pub­licly known by law enforce­ment or other peo­ple
  • code­base: the ori­gin of the source code for a site where any­thing is pub­licly known; ‘cus­tom’ sim­ply means the site oper­a­tors seem to have writ­ten it them­selves
  • coin: prin­ci­pal cryp­tocur­rency of mar­ket­place; if mul­ti­ple coins are accept­ed, I list the most promi­nent alt­coin
  • guns: whether firearms were sold, spec­i­fied in rules/policies as allowed to be sold, or rules/policies spec­i­fied there were no bans on item cat­e­gories
  • fraud: whether card­ing items like credit card dumps were sold etc (this does not include fake IDs or infor­ma­tional guides on how to com­mit fraud; the for­mer have uses besides card­ing, and the lat­ter are often out­dated or just scams)

Table

A table of 87 DNMs (up­dated 2019-06-09):

Mar­ket Start End Alive Clo­sure Arrested URL Mul­ti­sig I2P Bit­coin Lite­coin Doge­coin Dark­coin Code­base Guns Fraud Hacks Doxed Notes
Silk Road 1 2011-01-31 2013-10-02 FALSE raided TRUE silkroadvb5piz3r.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 2 TRUE SR1 tem­porar­ily sold guns as part of “the Armory” but only for a brief time as sales were poor.
Black­Mar­ket Reloaded 2011-06-30 2013-12-02 FALSE hacked FALSE r6rcmz6lga4i5vb4.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 1 FALSE back­opy stopped buy­ing on 2 Dec aggra­vated in part by a big theft, fully shut­down by 23 Decem­ber. May reopen. BMR per­mit­ted gun sales, and also seems to have per­mit­ted credit card infor­ma­tion sales, judg­ing by angry feed­back.
Atlantis 2013-03-26 2013-09-20 FALSE scam FALSE atlantisrky4es5q.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE FALSE 0 FALSE Atlantis’s shut­down seems, judg­ing by com­ments on Red­dit pages & All Things Vice to have ini­tially allowed with­drawals, but dis­abled it after a few days and then stole the remain­ing deposit­s+e­scrow+ven­dor-bonds.
Sheep Mar­ket­place 2013-02-28 2013-11-29 FALSE scam TRUE sheep5u64fi457aw.onion FALSE FALSE TRUE FALSE FALSE FALSE Nette FALSE TRUE 1 TRUE with­drawals were halted before 29 Nov, but deposits & sales were ongo­ing. I choose 29 Nov as the day where the Sheep scam became irrefutable. Strictly speak­ing, an oper­a­tor has not been arrested as of 2015-03-27, but the sus­pected oper­a­tor is in legal trou­ble over mon­ey-laun­der­ing of large Bit­coin-re­lated sums.
Deep­bay 2013-06-30 2013-11-04 FALSE scam FALSE deepbay4xr3sw2va.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE FALSE 0 FALSE Dis­ap­peared with funds; based on a screen­shot of cat­e­gories, seems to have been almost exclu­sively drugs.
Bud­ster 2013-10-10 2013-10-20 FALSE scam FALSE budsterga5hcdxjn.onion FALSE FALSE TRUE FALSE FALSE FALSE Word­Press FALSE FALSE 1 TRUE https://old.reddit.com/r/Budster/comments/1ove9w/has_anyone_made_a_purchase_yet/ccw8srh https://old.reddit.com/r/DarkNetMarkets/comments/1xyixa/psa_cyruserv_is_down_for_good_budster_taf_hosting/ Bud­ster did not seem to use gen­uine mul­ti­sig and this enabled the scam: https://old.reddit.com/r/SilkRoad/comments/1opmha/budster_the_worlds_first_p2p_marketplace/
Project Black Flag 2013-10-14 2013-10-28 FALSE scam FALSE ajd4yqq7ngzmqo3p.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE TRUE 1 FALSE https://old.reddit.com/r/DarkNetMarkets/comments/1peguv/pbf_rip/ ; forums: blackiiw5nozs6i5.onion; poli­cies stated on forums (“Pro­hib­it­ed: Weapons, coun­ter­feit mon­ey, stolen goods, child pornog­ra­phy, post­ing other users infor­ma­tion, attempt to cause harm, spam­ming.”)
Tor­Mar­ket 2013-11-07 2013-12-22 FALSE scam FALSE tormarkozaegyvco.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE TRUE 1 FALSE Part of the Tor­Mar­ket user list was leaked by DPR2 on SR2F; TM also admit­ted other secu­rity issues, but fur­ther rumors that Tor­Mar­ket’s shut down was pre­cip­i­tated by a hack by “Pro­fe­sor­house” have not been sub­stan­ti­at­ed. TM may have used Bit­wasp, but it did­n’t seem to have Bit­wasp error pages and does­n’t really look like the usual Bit­wasp DNM.
Flo­Mar­ket 2013-12-01 2014-01-01 FALSE hacked FALSE fmkt3wixc772jxyj.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp 2 FALSE Appar­ently hacked 2013-12-20 (pre­vi­ously noted to be hack­able); with­drawals began fail­ing on 2014-01-01 & Flo­Mar­ket announced a sec­ond hack on 2014-01-06; for the oper­a­tor’s expla­na­tion, see his inter­view
Tor­tuga 2013-12-16 2014-01-05 FALSE vol­un­tary FALSE tortugauwngwecwd.onion FALSE FALSE TRUE FALSE FALSE FALSE Seag­ull 0 FALSE Adver­tised in the SR2F on 2013-12-19; adver­tised on the BMR forums on 16 Dec. Up on 2014-01-01, down on 2014-01-09 & after­wards. No news about rea­sons for its clo­sure. No offi­cial rules on list­ings were posted before it dis­ap­peared, prob­a­bly because it was unpop­u­lar enough that con­tent was not an issue.
Black­Box Mar­ket 2013-11-12 2014-02-01 FALSE vol­un­tary FALSE 77yqlxe7pnxhnxvi.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Inter­est­ing site, but not sure it should be listed here. Start date based on Red­dit. Site stopped respond­ing 2014-02-01. On-site escrow did not use mul­ti­sig (“We do not make use of the Escrow ser­vices pro­vided by Bit­coin itself as this asso­ciates buy­ers and sell­ers.”) Poli­cies based on the fact that BBM could not know what was being sold on it and so de facto per­mit­ted both cat­e­gories.
Grey­Road 2014-01-04 2014-02-01 FALSE vol­un­tary FALSE greyroaderw4qymd.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Went pub­lic 2013-01-04 (2), oper­a­tor claims to have been sell­ing for a while but refuses to pro­vide any specifics & very few sell­ers on mar­ket so open­ing date is used; forums: grforums5qwzbhkl.onion. URL stopped work­ing 2014-02-01
Can­tina 2014-01-20 2014-02-07 FALSE hacked FALSE vsudl2g3em6qhcw4.onion FALSE FALSE TRUE FALSE FALSE FALSE Nette TRUE TRUE 3 TRUE Can­tina spammed ven­dors on SR2F on 2014-01-20; ear­li­est known men­tion of the mar­ket. It was repeat­edly hacked & doxed. Can­tina had no stated poli­cies, but it did have a cat­e­gory for guns and given the ‘Data’ cat­e­gories & gen­eral lack of ethics & greed, highly likely would have per­mit­ted card­ing had it not died so igno­min­ious­ly.
Break­ing Bad 2014-02-01 2014-02-06 FALSE vol­un­tary FALSE breakingnartglxd.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE Announced on Red­dit; site went down 6 Feb­ru­ary, owner explained shut­down due to “Lack of inter­est from ven­dors, con­stant hate mail, down­votes and claims on secu­rity vul­ner­a­bil­i­ties”
Black Gob­lin Mar­ket 2014-02-03 2014-02-04 FALSE hacked FALSE ua4aptglh45m5p6b.onion FALSE FALSE TRUE FALSE FALSE FALSE Dru­pal TRUE TRUE 0 TRUE Announced on Red­dit; I de-anonymized the site, so it shut down. The “Black Gob­lin Rules” page does not men­tion any ban of guns or card­ing.
Cannabis Road 2014-02-03 2014-02-07 FALSE hacked FALSE ji4wrifhsnawaw7t.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 TRUE Announced on The Hub; thor­oughly hacked & de-anonymized
Utopia 2014-02-03 2014-02-11 FALSE raided TRUE ggvow6fj3sehlm45.onion FALSE FALSE TRUE FALSE FALSE FALSE CakePHP TRUE TRUE 0 TRUE forums: ysas7uv4drg7rlwv.onion; forms opened in early Jan­u­ary, site opened to ex-BMR sell­ers late Jan­u­ary, gen­eral buy­ers only allowed in Feb­ru­ary. Dutch seizure notice posted ~7:30AM EST, fol­lowed by 5 in Nether­lands & Ger­many
Black Ser­vices Mar­ket 2013-12-02 2014-02-01 FALSE scam FALSE thebsm6okkbx7fik.onion FALSE FALSE TRUE FALSE FALSE FALSE OSclass TRUE TRUE 0 FALSE Start date based on old­est list­ing when I checked on 2013-12-26; last admin forum post 18 Jan & PMs to him dis­abled, reports of escrow prob­lems in late Jan/early Feb, many com­plaints on forums; site went down 2014-02-14
Red Sun Mar­ket­place 2014-03-20 2014-03-23 FALSE hacked FALSE redsun4lvjrxwwuy.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE TRUE 1 FALSE Announced on Red­dit; hacked (SQli etc); forum: forumsyccj7ekvvv.onion. Sur­viv­ing mate­ri­als don’t say whether guns were per­mit­ted, but given the oper­a­tor’s inter­est in recruit­ing fake ID ven­dors it seems more likely than not that card­ing sales would have been allowed.
Buy­It­Now 2013-04-30 2014-02-17 FALSE vol­un­tary FALSE buyitnowquyft7dx.onion FALSE FALSE TRUE FALSE FALSE FALSE Word­Press TRUE FALSE 0 FALSE Site did not respond on 2014-02-17 or after­wards; no reports on shut­down rea­son or whether it was a scam. Poli­cies not spec­i­fied, but many list­ings for guns, and none of any kind related to card­ing.
White Rab­bit 2013-12-23 2014-02-01 FALSE scam FALSE rabbittorvr74veg.onion FALSE TRUE FALSE TRUE FALSE FALSE unknown TRUE TRUE 0 TRUE Start date based on Red­dit posts. For­merly named “Rab­bit’s Mar­ket­place”. Unable to find reports of suc­cess­ful sales on The Hub or Red­dit, and WR with­drawal has been bro­ken at least since 2014-02-21; no one has claimed with­drawals recent­ly. Dead date is based on the Feb­ru­ary news notice “There are prob­lems with pay­ment gate­way”. Forum states only CP is banned (“Items which are not allowed: child porn (and other sick stuff).”) i2p: wrmarket.i2p. IP was found to be leak­ing.
Free­Bay 2013-12-01 2014-02-28 FALSE vol­un­tary FALSE freebay3yxuebsog.onion FALSE FALSE TRUE TRUE FALSE FALSE unknown FALSE TRUE 0 FALSE URL is also appar­ently litebay7vp5pm77f.onion (Free­Bay took Bit­coin, Lite­Bay took Lite­coin); open date is guess based on Red­dit post; site was not up on 2014-02-28 when I checked. Poli­cies not spec­i­fied, but many card­ing & no gun list­ings.
drugslist 2014-01-08 2014-02-28 FALSE scam FALSE drugslisvdknitqd.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 FALSE With­drawals began fail­ing & admin ceased respond­ing in Feb­ru­ary 2014; date clo­sure to the forum admin accoun­t’s last login.
Doge Road 2014-01-18 2014-03-13 FALSE scam FALSE dogeroadiqt6olb6.onion FALSE FALSE FALSE FALSE TRUE FALSE Bit­wasp FALSE TRUE 0 FALSE Announced on Red­dit; forums: dogeroadqmu2yzcg.onion. Went down some­time in March 2014, may have gone bad in late Feb­ru­ary.
TorE­scrow 2014-02-02 2014-04-19 FALSE scam FALSE torescrow7upglhe.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE TRUE 0 FALSE Ini­tially just an escrow, but TE expanded into a mar­ket. Forums: 4rtvonaubslk7vvk.onion. TE seems to have per­mit­ted card­ing: “We do not allow the sale of weapons, pornog­ra­phy, ebooks, pirated soft­ware or hits.”
Armory Ven­dor Mar­ket 2014-02-06 2014-04-07 FALSE scam FALSE armoryx7kvdq3jds.onion FALSE FALSE FALSE FALSE FALSE TRUE Quick­.­Cart TRUE FALSE 1 FALSE Announced on Red­dit; their Cryuserv host­ing, accord­ing to the hack­er, dated back to 2013-05-23 but it’s unclear when they had their first sale. It announced use of Dark­coin in March 2014.
Dark­net Nation 2014-02-19 2014-03-01 FALSE hacked FALSE 26a2ueoc3xxrrgs4.onion FALSE FALSE TRUE FALSE FALSE FALSE Joomla TRUE TRUE 0 TRUE Announced on Red­dit; Q&A. The site leaked its IP address. Down 2014-04-03; best guess, shut down some­time in March (the admin­is­tra­tor’s last post on The Hub was 2014-03-01.)
San­i­tar­ium Mar­ket 2014-02-20 2014-03-28 FALSE vol­un­tary FALSE sanitarium-market.i2p FALSE TRUE TRUE FALSE FALSE FALSE Bit­wasp 0 FALSE Announced on Red­dit; long address: dhd5okd2imkskbhsrlbs5c4nx3cdtmwpplvcei6o3l2sc35kt4ma.b32.i2p; Tor mir­ror: nyu7nlbj33ym2va3.onion. Unreach­able by Deep­DotWeb 2014-03-28, and last sub­red­dit activ­ity was 2014-03-19. The oper­a­tor claimed on 2014-02-24 to have inte­grated mul­ti­sig but I can’t find any reports of use of it. No sur­viv­ing info indi­cates whether weapons or card­ing were allowed.
Hansa 2014-03-09 2014-03-20 FALSE raided TRUE hansann7wim5ier2.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 TRUE Announced on Red­dit & de-anonymized; clo­sure date based on last trans­ac­tion by their IP. They planned to imple­ment mul­ti­sig but seem to have shut down before it went live. Bit­wasp clas­si­fi­ca­tion based on two com­ments & screen­shot of login page. They appeared to be a vol­un­tary shut down but had been sub­verted by Dutch police & mul­ti­sig dis­abled & turned into a hon­ey­pot for mon­i­tor­ing buyer address­es, seller geo­t­agged images, and mal­ware.
EXXTACY 2014-03-23 2014-03-24 FALSE hacked FALSE j3gwwsnswrg7dtf4.onion FALSE FALSE TRUE FALSE FALSE FALSE Dru­pal 0 TRUE Announced & de-anonymized on Red­dit. No infor­ma­tion about poli­cies is avail­able, although since it seems to’ve been run by San­i­tar­i­um, it likely had what­ever they did. Died before any rules announced or mir­rors made.
Mr Nice Guy 2014-03-29 2014-04-20 FALSE vol­un­tary FALSE niceguymn4plorwb.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE FALSE 0 TRUE Announced on Red­dit; forum: ngforumjj4dkis7w.onion. IP was leak­ing.
Tor­Bay 2013-12-18 2014-04-20 FALSE vol­un­tary FALSE tyedahhf56xli7xp.onion FALSE FALSE TRUE FALSE FALSE FALSE hyops FALSE TRUE 0 TRUE Start date based on Red­dit announce­ment; ceased respond­ing in April 2014, after list­ings had fallen to near-ze­ro.
Dark­Bay 2014-01-30 2014-05-01 FALSE vol­un­tary FALSE darkbay4rwgvdkqn.onion TRUE FALSE TRUE FALSE FALSE FALSE unknown FALSE TRUE 0 TRUE Announced on Red­dit; forums: 7y26aczl3wdyujkc.onion; for­mer­ly, UltraVioletCity/ultracityi2gdwhq.onion. “There is very lit­tle restric­tion here, we only ask that you do not sell firearms (ri­fles, pis­tols, auto­matic weapons etc) or child pornog­ra­phy (pho­tographs, videos etc).” Merged with Androm­e­da?
Pigeon Mar­ket 2014-04-14 2014-05-07 FALSE vol­un­tary FALSE pigeonkcmw5h44lq.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Unknown what hap­pened to funds.
Free Mar­ket 2015-01-14 2015-02-26 FALSE vol­un­tary FALSE tfmarket6iaddx45.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 0 FALSE Announced on Red­dit
Tor­tuga 2 2014-04-23 2014-06-17 FALSE vol­un­tary FALSE l6hkncqo46wgzx7y.onion TRUE TRUE FALSE TRUE FALSE FALSE Dru­pal FALSE FALSE 0 FALSE Announced on Red­dit; i2p: wtat6dgz57j5xllu2j7htb7aydq5rgls6edg7e6lf2tumqn5ej3a.b32.i2p/tortuga-marketplace.i2p; mul­ti­sig; ; unknown what hap­pened to funds.
Deep­zon 2014-05-14 2014-07-13 FALSE vol­un­tary FALSE deepzondhyl3yaro.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Sup­port’s respon­se: “Guns/Weapons are allowed, we thought that would be clear, as we are hav­ing the cat­e­gory ‘Weapons’ list­ed. CC-Dumps are also allowed.”’ ; unknown what hap­pened to funds.
Silk Street 2014-04-08 2014-08-04 FALSE scam FALSE silkr2xyqsu73qhh.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE FALSE 0 FALSE Announced on The Hub; no reports of with­drawals, so marked false. No explicit poli­cies, but UI shows many empty cat­e­gories but no empty cat­e­gories for fraud or gun items, so I pre­sume those were not per­mit­ted.
Under­ground Mar­ket 2014-04-09 2014-08-26 FALSE vol­un­tary FALSE unground6baopdio.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE Announced on Red­dit; forums: vxcwhb4lzqltfauq.onion. Shut down cit­ing “not enough cus­tomers”.
Cannabis Road 2 2014-03-28 2014-08-25 FALSE hacked FALSE cannabiskofvl7pa.onion TRUE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 FALSE Forum: forumzxmoorof4ja.onion; forum opened 2014-02-26, but site was not oper­a­tional. The soft-launch/raffle announced 2014-03-28 seems a good start date. Was hacked & lost >$123,384 from escrow (while mul­ti­sig was avail­able, very few buy­ers used it).
Pan­dora 2013-10-21 2014-08-19 FALSE scam FALSE pandorajodqp5zrr.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE TRUE 2 FALSE See “For­bid­den Items on PANDORA. Pan­dora has had 2 hacks: the first was a using an admin account, and the sec­ond was a loss of half the cen­tral­ized escrow (re­paid by levy­ing extra­or­di­nary trans­ac­tion fees). The oper­a­tor even­tu­ally locked out all seller accounts around 19/2014-08-20 (defi­nitely by 1 Sep­tem­ber) and dis­abled with­drawals & the site forums, but con­tin­ued accept­ing deposits from buy­ers; he may also have cap­tured login cre­den­tials and robbed accounts on other mar­ket­places accord­ing to sev­eral sell­ers. Tar­geted in Oper­a­tion Ony­mous but had already turned scam­mer.
Pirate Mar­ket 2013-11-29 2014-08-15 FALSE scam FALSE yjhzeedl5osagmmr.onion TRUE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Start date based on Red­dit. Orig­i­nally Road­Silk; mul­ti­sig. Site report­edly began block­ing with­drawals ~2014-08-15 while still accept­ing deposits, with the Pirate Mar­ket forum being shut down sev­eral days lat­er.
Free­dom Mar­ket 2014-09-16 2014-09-25 FALSE vol­un­tary FALSE freedom3qg7hmtxn.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE FALSE 0 FALSE Announced on Red­dit; went down with­out notice some­time before 2014-09-25. Site rules: “If the item does­n’t hurt oth­ers, you can sell it.”; the cat­e­gories included “Forg­eries” but noth­ing else, so card­ing prob­a­bly counted as ‘hurt­ing oth­ers’.
1776 2014-04-19 2014-10-02 FALSE vol­un­tary FALSE n6tzonxy7sod7eqt.onion FALSE FALSE TRUE FALSE FALSE FALSE ASP.NET FALSE FALSE 0 FALSE Announced by Deep­DotWeb & on Red­dit. Not Bit­wasp, given the trace­back on error pages. No pol­icy doc­u­men­ta­tion. Dis­ap­peared start­ing 2014-10-03.
Silk Road 2 2013-11-06 2014-11-05 FALSE raided TRUE silkroad6ownowfk.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 2 TRUE Forum mod­er­a­tor Cir­rus advises con­sid­er­ing SR2 com­pro­mised (2013-12-22, ironic inas­much as Cir­rus was the LE under­cover agent who undid SR2 and helped with SR1); new oper­a­tors Defcon/Hux/etc deny it. Def­con announced the cold wal­let had been lost to DPR2, but then that it had been restored. SR2 expe­ri­enced repeated account bal­ance prob­lems, failed to ever imple­ment aut­o­fi­nal­ize or dis­pute res­o­lu­tion (forc­ing accu­mu­la­tion of orders’ bal­ances), and announced 2014-02-13 that all deposits & escrow had been stolen, fol­lowed by another hack in Sep­tem­ber 2014. Use of SR was not advised. Was raided by Oper­a­tion Ony­mous & Def­con arrest­ed.
Hydra 2014-03-27 2014-11-05 FALSE raided TRUE hydrampvvnunildl.onion TRUE FALSE FALSE TRUE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE Announced on The Hub; forum: hydrafmchvpq5yc6.onion. Oper­a­tor arrested in Hun­gary as part of Oper­a­tion Ony­mous. (Ap­par­ently unre­lated to the Russ­ian Hydra still in oper­a­tion as of Jan­u­ary 2019.)
Cloud-Nine 2014-02-11 2014-11-05 FALSE raided FALSE xvqrvtnn4pbcnxwt.onion TRUE FALSE TRUE FALSE FALSE FALSE Cloud-9 FALSE TRUE 0 FALSE Announced on Red­dit; on banned items. Raided in Oper­a­tion Ony­mous.
Blue Sky 2013-12-03 2014-11-05 FALSE raided FALSE blueskyplzv4fsti.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE FALSE 0 FALSE Or is the open­ing 2013-12-12? Raided in Oper­a­tion Ony­mous.
Tor­Bazaar 2014-01-26 2014-11-05 FALSE raided FALSE bazaarlv2a7i3uyn.onion TRUE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE Announced on The Hub; orig­i­nal cen­tral­ized escrow site: 3p42y56a76g6okuv.onion; forums: 22iwhc2luicynjqy.onion
Topix 2 2014-03-25 2014-11-05 FALSE vol­un­tary FALSE topixslhezyytrvm.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 0 FALSE Started Jan­u­ary 2014; opened to pub­lic 2014-09-28, pre­vi­ously was invite-on­ly; start date based on first sale listed in recen­t-feed­back page; appar­ently drug-only based on the list­ings. Shut down with­out notice after .
Alpaca Mar­ket­place 2014-04-20 2014-11-05 FALSE scam FALSE alpaca727o3c75xx.onion TRUE FALSE TRUE FALSE FALSE FALSE unknown TRUE FALSE 1 FALSE Announced on The Hub; poli­cies based on Secret Lab­o­ra­tory writeup Hacked mid-May 2014. Alpaca allows weapons (but not poisons/WMDs/hitmen) and appears to ban card­ing: “We do not allow items that are adver­tised as stolen.” Shut down after Oper­a­tion Ony­mous (seizure notice) with­out return­ing any funds.
Cannabis Road 3 2014-10-06 2014-11-05 FALSE scam FALSE cannabis37oj24rd.onion TRUE FALSE TRUE FALSE FALSE FALSE Alpaca FALSE FALSE 0 FALSE Forum: forumz2gljo2vhzb.onion. After CR2 was hacked, devel­oper “Crypto” dis­ap­peared; the remain­ing staff set up a new mar­ket­place hosted by Alpaca Mar­ket­place. Went down with Alpaca after Oper­a­tion Ony­mous
Androm­eda 2014-04-05 2014-11-18 FALSE scam FALSE andromedam363aux.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE For­merly Silk Road 3/silkroad3wqdnifp.onion; site has no con­nec­tion to SR1 or SR2. Forums: dvzuhtlteonn6mwd.onion. Androm­eda attempted to mask its exit scam as an Oper­a­tion Ony­mous but it was­n’t announced as seized and the bro­ken with­drawals & failed mim­icry show it’s bogus.
The Mar­ket­place 2013-11-28 2014-11-09 FALSE vol­un­tary FALSE themarketplace.i2p TRUE TRUE TRUE FALSE FALSE FALSE cus­tom FALSE TRUE 0 FALSE Start date from per­sonal com­mu­ni­ca­tion; Tor Proxy: 43y5mwjvhxd6zf7v.onion. The ToS ban CP, guns, and Bitcoin/dollar sales. Site went down 9 Novem­ber, with­out any fur­ther notice. (The use of mul­ti­sig means buy­ers & sell­ers can still com­plete the final trans­ac­tion­s.)
Onion­shop 2014-05-18 2014-09-17 FALSE hacked FALSE onionshopkue7sxr.onion FALSE FALSE TRUE FALSE FALSE FALSE TRUE TRUE 1 FALSE Announced on Red­dit; hacked 2014-09-17 (announce­ment, hacker)
TOM 2014-05-10 2014-12-18 FALSE scam FALSE tom3j5jkjl7327oc.onion TRUE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE FALSE 0 FALSE Forums: tomf2fo56wthggwk.onion. TOM dis­ap­peared with­out any announce­ments; Red­dit com­ments report deposits were not returned, so I mark TOM a scam.
Area51 2014-06-20 2015-01-24 FALSE scam FALSE fiftyonecrklhzhe.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE Spammed on The Hub; imple­men­ta­tion is PHP on Debian, admin states “area51 is com­plete self­coded and we have noth­ing to do with bit­wasp”. Cen­tral­ized escrow & no reports of deposits being returned.
Panacea 2014-10-27 2015-02-13 FALSE vol­un­tary FALSE panaceaz4give75l.onion TRUE FALSE TRUE FALSE FALSE FALSE Cloud-9 FALSE FALSE 1 TRUE Red­dit ANN; forums: flower777wpnxpkj.onion; cannabis-on­ly; admin “PyroWolf” was report­edly doxed by the cannabis seller East­Coast­Col­lec­tive (likely the oper­a­tor of CR2/CR3, and pos­si­bly CR1 as well), who he was a for­mer cus­tomer of. Clo­sure obscure - staff blames an AWOL devel­oper and the mul­ti­sig coins to be safe, but a throw­away claims to’ve hacked it.
evo­lu­tion 2014-01-14 2015-03-14 FALSE scam FALSE k5zq47j6wd3wdvjq.onion FALSE FALSE TRUE FALSE FALSE FALSE Lar­avel TRUE TRUE 0 FALSE Announced on Red­dit 20 Jan, but forums claim first sale on 14 Jan­u­ary; forums: i25c62nvu4cgeqyz.onion; new url: nifgk5szbodg7qbo.onion; claimed mul­ti­sig but on fur­ther inves­ti­ga­tion, seems to be the weak kind. PHP frame­work. Site & forums went down 2015-03-18 but large with­drawals began fail­ing ~2015-03-14, mark­ing the start of the exit scam. For­mer employee claims $45,402,252 lost.
Iron­clad 2015-03-17 2015-03-25 FALSE scam FALSE ironcladcoc3chq6.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE ANN; forums: forum.ironcladcoc3chq6.onion. Dis­ap­peared with­out notice dur­ing the post-Evo­lu­tion chaos & Tor DoS attacks in March 2015; as a cen­tral­ized mar­ket, all escrow & deposits are pre­sumed stolen.
Kiss 2015-02-19 2015-05-16 FALSE scam FALSE kissmpg5zave56f4.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 FALSE ANN; forum: 6bssxspijk7n2ioh.onion; Kiss mod­er­a­tor claims hacked 2015-05-21 then oper­a­tor decided to exit-s­cam. I date to 2015-05-16, how­ev­er, as I was unable to log in start­ing then.
Black­Bank Mar­ket 2014-02-05 2015-05-18 FALSE scam FALSE wztyb7vlfcw6l4xd.onion TRUE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Active before its Red­dit announce­ment but no appar­ent sales. Forums: kth2mwuwlkezwziy.onion. For­bid­den items are listed on the wiki. BB went down with­out notice ~2015-05-18, with no com­mu­ni­ca­tions after­wards; com­pli­cat­ing the usual exit-s­cam story is that none of the bit­coins appear to have moved in weeks and the admin, many months ago, had alluded to seri­ous health issue.
Tor­nado 2015-05-12 2015-05-20 FALSE FALSE tornadoputkhrvfq.onion FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE ANN; forums: tortalkmcguzevvz.onion; went down ~20 May with­out any pub­lic com­ments.
Havana/Absolem 2015-04-13 2015-05-22 FALSE hacked FALSE havana3cofejesta.onion TRUE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE Opened ini­tially invite-code-only; forums: forumz4usxavgyri.onion; pen­tester whyusheep/hacksforcrack turned on Havana-Ab­solem, DoSing/hacking them; the admins gave up, talk­ing about per­haps try­ing a pri­vate mar­ket instead.
Agape 2015-05-29 2015-06-04 FALSE vol­un­tary FALSE agape3brimud5fk6.onion FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE ANN. Vol­un­tar­ily shut down due to lack of inter­est and “back­lash”.
Zanz­ibar Spice 2015-05-07 2015-06-14 FALSE vol­un­tary FALSE mithrakushhvfyto.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 0 FALSE ANN; server began throw­ing errors 2015-06-14 with no mar­ket com­mu­ni­ca­tion.
Dream Mar­ket 2013-11-15 2019-04-30 FALSE vol­un­tary FALSE ltxocqh4nvwkofil.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE TRUE 0 FALSE Site claims to’ve opened 2013-11-15; first men­tion of it I found was on 2014-01-07. Later moved to lchudifyeqm4ldjj.onion/. Shut­down back­ground: DoJ, Dark Owl
Agora 2013-12-03 2015-09-06 FALSE vol­un­tary FALSE agorahooawayyfoe.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE Forums: lacbzxobeprssrfx.onion. Agora banned guns 2015-07-15 after ~20 gun busts became known; nev­er­the­less, for most of its lifes­pan it allowed guns. Agora announced 2015-08-25 that it would be going offline indefi­nitely to deal with Tor deanonymiza­tion attacks; with­drawals were enabled and DNstats indi­cates the site went offline around 2015-09-06.
Out­law Mar­ket 2013-12-29 2017-05-16 FALSE hacked FALSE drugs26ucskmvcef.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE FALSE 3 FALSE Open date based on the date of the “Wel­come” post on the OM forum; appar­ently for­merly “Drugs’n’­Bets”. Site was hacked & user PMs released in 2013; site shut down 2014-07-31 after an attack blame on for­mer admins when “A SESSION-hack was per­formed and a cou­ple of datasets manip­u­lated but not much dam­age cre­ated”. They claim in it’s cus­tom soft­ware; this is con­firmed by a leak of PHP source which does not call any frameworks/CRMs. Poli­cies based on no appar­ent hits among mir­rors. Ex-staff insist it was not an exit scam but a gen­uine hack.
Mid­dle Earth Mar­ket­place 2014-06-22 2015-11-04 FALSE scam FALSE mango7u3rivtwxy7.onion FALSE FALSE TRUE FALSE FALSE FALSE Django FALSE TRUE 0 FALSE Announced on Red­dit. Exit-s­cammed some­time around Octo­ber-No­vem­ber 2015; some issues with with­drawals reported in late Octo­ber, then the site went down for ‘main­te­nance’ around 2015-11-04, and coins were defi­nitely being moved by the admins by 2015-11-06 .
Diabolus/SR3 2014-10-13 2017-02-12 FALSE FALSE qxvfcavhse45ckpw.onion FALSE FALSE TRUE FALSE FALSE TRUE cus­tom FALSE FALSE 0 FALSE Cannabis-on­ly. Unclear when it shut down so I assign it the same date as CM, which was oper­ated by the same team.
Nucleus Mar­ket­place 2014-10-24 2016-04-13 FALSE scam FALSE nucleuspf3izq7o6.onion FALSE FALSE TRUE TRUE FALSE TRUE Lar­avel TRUE TRUE 0 FALSE Went down 2016-04-13 accord­ing to DNstats & Red­dit. Appar­ent non-move­ment of mar­ket coins has prompted spec­u­la­tion about arrests, but no busts has been announced as of 2016-08-18.
Abraxas 2014-12-13 2015-11-05 FALSE scam FALSE abraxasdegupusel.onion FALSE FALSE TRUE FALSE FALSE TRUE Lar­avel FALSE TRUE 0 FALSE forums: abraxasgacelesox.onion Went down 2015-11-05 accord­ing to DNstats and sev­eral months later the wal­let may’ve been drained.
AlphaBay 2014-12-22 2017-07-05 FALSE raided TRUE pwoah7foa6au2pul.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE Announced on Red­dit
Silk Road Reloaded 2015-01-13 2016-02-27 FALSE FALSE silkroadreloaded.i2p FALSE TRUE TRUE TRUE TRUE TRUE cus­tom FALSE TRUE 0 FALSE Full I2P address: hyn3mwmyeovcn2paujxur2eury2ufqpoahvbbqshfoggljn25tra.b32.i2p. I’m uncer­tain when it closed - last sub­red­dit activ­ity 2016-02-27 but may have still been alive as of May 2016 or lat­er.
Tochka 2015-01-30 TRUE FALSE tochka3evlj3sxdv.onion FALSE FALSE TRUE TRUE TRUE TRUE cus­tom FALSE FALSE 0 FALSE Announced on Red­dit; site rules ban “Coun­ter­feit doc­u­ments” which I inter­pret as ban­ning card­ing in gen­er­al.
Crypto Mar­ket 2015-02-14 2017-02-12 FALSE scam FALSE cryptomktgxdn2zd.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE ANN; CM is run on / by Dia­bo­lus and not entirely sep­a­rate. Accord­ing to DNstat­s.net, Crypto Mar­ket was last observed up on 2017-02-12, but there are com­plaints in Jan­u­ary 2017 on Red­dit so I’m not sure when it really went down. In any case, the escrow funds appar­ently were not returned.
Mr Nice Guy 2 2015-02-21 2015-10-14 FALSE scam FALSE niceguyfa3xkuuoq.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 0 TRUE Oper­a­tor claims dox­ing was just of “a vol­un­teer”. Went down Octo­ber 14, 2015 accord­ing to DNstats.
The­Re­alDeal 2015-04-09 2016-10-22 FALSE FALSE trdealmgn4uvm42g.onion TRUE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE Inter­view, ANN; forums: forum5cijl4suew6.onion. Mul­ti­ple staffers were arrested & the site went down for a while but came back up, lead­ing to ques­tions about whether it had been sub­vert­ed. Last observed by DNstat­s.net on 2016-10-22. Unclear why it shut down: LE, exit scam, or oth­er­wise? Or to what extent its mul­ti­sig worked.
Oxy­gen 2015-04-16 2015-08-27 FALSE scam FALSE o2oxycuvnwxhv73e.onion TRUE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE TRUE 1 FALSE ANN. Was hacked around Jan­u­ary 2015 by a ven­dor exploit­ing an early final­iza­tion bug to scam cus­tomers. Went down 2015-08-27 accord­ing to DNstats.
East India Com­pany 2015-04-28 2016-01-01 FALSE scam FALSE g4c35ipwiutqccly.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 FALSE ANN; EU-on­ly. Claims to’ve lost $9,958 to a hacker in early August 2015. EIC went down ~2016-01-01–2016-01-02 for a week or so, then a main­te­nance mes­sage, then came back up but with­drawals failed; final­ly, went down for good 2016-02-01 accord­ing to DNstats.
Haven 2015-05-05 2015-06-06 FALSE scam FALSE havenpghmfqhivfn.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE ANN Went down 2015-06-06 accord­ing to DNstats; not much dis­cus­sion of its clo­sure.
Anar­chia 2015-05-07 2016-05-09 FALSE FALSE tkmlejimlt72jnkm.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE ANN. Still around 2015-07-09 judg­ing from spam for it; may have gone down 2016-05-09 for unclear rea­sons. No dis­cus­sion of its clo­sure on Red­dit, DDW, The Hub, or I can find in Google.
Dark­net Heroes League 2015-05-27 2017-08-05 FALSE hacked FALSE darkheroesq46awl.onion FALSE FALSE TRUE FALSE FALSE FALSE 0 FALSE Not explic­itly announced. Dis­ap­peared after vul­ner­a­bil­i­ties & IP dis­closed.
Posei­don 2015-06-02 2015-06-29 FALSE scam FALSE poseidonzskufuwb.onion FALSE FALSE TRUE FALSE FALSE FALSE TRUE TRUE 0 TRUE Server de-anonymized by The­Re­alDeal ~2015-06-02 & was in Latvia. From the few men­tions of it after­wards, Posei­don appar­ently dis­abled with­drawals and then dis­ap­peared within a few months.
Ama­zon Dark 2015-06-08 2015-10-25 FALSE scam FALSE amazon435hm6h3ye.onion TRUE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE ANN. Around 2015-10-22–2015-10-25, com­plaints began appear­ing about admin­is­tra­tors not respond­ing & with­drawals fail­ing; for­mer spokesper­son says it was an exit scam; went down 2015-10-28, accord­ing to DNstats.
Sim­ply Bear 2015-06-20 2015-10-21 FALSE scam FALSE llog4svhkcb5txld.onion FALSE FALSE TRUE FALSE FALSE FALSE FALSE TRUE 0 FALSE ANN. Went down 2015-10-21 accord­ing to DNstats; no men­tions of whether it might’ve shut down ear­lier any­where else.
Hori­zon Mar­ket 2015-05-23 2015-07-08 FALSE scam FALSE horizon77qneerav.onion FALSE FALSE TRUE FALSE FALSE FALSE TRUE TRUE 0 FALSE Was French-only until mid-June 2015; open­ing date based on ear­lier last-seen dates for the low­est­-num­bered ven­dors. Dis­ap­peared some­time before 2015-07-08, accord­ing to the DDW changelog.

See also (changelog), DNstats2, the DNM mar­ket list, and the Hid­den Wiki (last updated 2014-08-30).

DNM life­times, sorted by when a mar­ket opened, col­ored by how it closed.

I may add to the table other vari­ables; pos­si­bly use­ful ones:

  • 2-fac­tor-au­then­ti­ca­tion
  • Ven­dor PGP enforced
  • FE sta­tus
  • ide­ol­o­gy: whether the oper­a­tor seems ide­o­log­i­cal (I sus­pect SR1 may have lasted longer than most post-SR1 mar­kets because Ulbricht’s agorist ide­ol­ogy meant he was not profit-mo­ti­vated & refused to do an exit scam or shut­down when SR1 was being extorted and may even have been run­ning at loss; but after watch­ing mar­kets in 2014-2015, it seems that such a vari­able is unlikely to be use­ful: Ulbricht is the only one clearly ide­o­log­i­cal, and the rest seem to be aping it or too quiet to tell. Just because the oper­a­tors say some­thing does­n’t mean they believe it, and many say noth­ing.)
  • vol­ume (at what time?)
  • how much money was lost when the site scammed or was hacked (only rea­son­ably known for a few scam­s…)
  • appar­ent nation­al­ity of oper­a­tor
  • media cov­er­age
  • num­ber of employ­ees (can offi­cial claims be trust­ed?)
  • manda­tory role sep­a­ra­tion (ful­ly-sep­a­rate buyer/seller/admin/staff accounts)

Analysis

TODO:

“The death rate of bit­wasp mar­ket­places will always be higher because it low­ers the bar­rier of entry to start­ing and launch­ing your own BTC mar­ket­place so less tech­ni­cal peo­ple with lesser funds to start the mar­ket­place will use it and that demo­graphic has a higher chance of fail­ure.”

From a pre­dic­tive stand­point, it does­n’t much mat­ter why Bit­wasp cor­re­lates with shorter life­times - whether it’s through greater like­li­hood of being hacked or self­-s­e­lec­tion by weak-willed/poor/uncommitted/incompetent oper­a­tors. As long as it does, it’ll improve pre­dic­tions by pre­dict­ing shorter life­times for Bit­wasp-us­ing mar­ket­places, and so it’s less safe for buy­ers: even if the mar­ket­place is using mul­ti­sig, there’s still some lim­ited scope for an exit scam; it wastes one’s invest­ment in learn­ing how to use a mar­ket­place; and sell­ers lose any bond they put up. (Mul­ti­sig is great and I’ve been advo­cat­ing for it for a long time, but it’s not a sil­ver bul­let.)

In any case, I can try check­ing if using Bit­wasp cor­re­lates with being hacked, not just shut down. The sam­ple is cur­rently small enough that the results won’t mean much regard­less, though.

library(XML)
library(RCurl)
html <- getURL("https://www.gwern.net/DNM-survival#table")
black <- readHTMLTable(html, colClasses = c("factor", as.Date, as.Date, "logical", "factor", "logical", "character", "logical", "logical", "logical", "logical", "logical", "logical", "factor", "logical", "logical", "integer", "logical", "character"))[[1]]
black[black$Codebase=="",]$Codebase <- "unknown"
black$Start <- as.Date(black$Start); black$End <- as.Date(black$End)
black[is.na(black$End),]$End <- Sys.Date() # assuming the table is up to date
black$Age <- black$End - black$Start
black$Age <- as.integer(black$End - black$Start)

# for some markets, these values are impossible to find: they were never decided on, or the market is gone
# there's only a few, so I'm not sure the complexity of multiple-imputation is worthwhile (MICE objects work with almost no libraries...)
# so for the 2 relevant columns so far, I do a simple impute of the median/mode value
black[is.na(black$Fraud),]$Fraud <- as.logical(median(black$Fraud, na.rm=T))
black[is.na(black$Guns),]$Guns   <- as.logical(median(black$Fraud, na.rm=T))

# for competing-risks modeling
levels(black$Closure) <- c("unknown", "hacked", "raided", "scam", "voluntary") # sets "" to "unknown"
black <- black[order(black$Start),]

library(survival)
# plot(survfit(Surv(Age, Alive, type="right") ~ 1, data=black), xlab="Days active", ylab="Fraction of markets still active")

# generate fancy timeline of DNM openings/closing:
library(ggplot2)
png(file="~/wiki/images/silkroad/marketlifetimes.png", width = 1200, height = 2500)
ggplot(black, aes(colour=Closure)) +
    geom_segment(aes(x=Start, xend=End, y=sort(decreasing=TRUE, reorder(Market,Start)), yend=sort(decreasing=TRUE, reorder(Market,Start))), size=3) +
    xlab("Open") + ylab("Market") + theme(legend.position="bottom", axis.text=element_text(hjust=1, size=20)) + scale_y_discrete(labels = sort(decreasing=TRUE, reorder(black$Market, black$Start)))
invisible(dev.off())

library(lubridate)
cmodel <- coxph(Surv(Age, Alive) ~ year(black$Start) + Multisig + I2P + Bitcoin+Litecoin+Dogecoin+Darkcoin + Codebase + Guns + Fraud + Hacks + Doxed, data = black, control=coxph.control(iter.max=10000)); cmodel

with(black, survdiff(Surv(Age,Alive)~as.factor(year(Start))))

cmodel2 <- coxph(Surv(Age, Alive) ~ as.factor(year(black$Start)) + ridge(Multisig, I2P, Bitcoin,Litecoin,Dogecoin,Darkcoin, Codebase, Guns, Fraud, Hacks, Doxed), data = black); summary(cmodel2)

cmodel <- coxph(Surv(Age, Alive) ~ strata(year(black$Start)), data = black); cmodel

black$URL <- black$Notes <- black$Market <- NULL

Exam­ple com­pet­ing-risks model using startup data:

# http://blogs.wsj.com/venturecapital/2014/11/20/techstars-graduates-success-rates-what-the-numbers-show/
# data:application/octet-stream;charset=utf-8,Year%2C2007%2C2008%2C2009%2C2010%2C2011%2C2012%2C2013%2C2014%0AActive%2C2%2C2%2C7%2C15%2C36%2C68%2C121%2C120%0AFailed%2C3%2C4%2C5%2C11%2C9%2C10%2C5%2C0%0AAcquired%2C5%2C4%2C7%2C5%2C14%2C15%2C4%2C1
rates <- read.csv(stdin(),header=TRUE)
Year,2007,2008,2009,2010,2011,2012,2013,2014
Active,2,2,7,15,36,68,121,120
Failed,3,4,5,11,9,10,5,0
Acquired,5,4,7,5,14,15,4,1

library(reshape2)
rates2 <- melt(rates)
colnames(rates2) <- c("Status", "Year", "Count")
rates2$Year <- as.integer(substring(as.character(rates2$Year), 2))
startups <- NULL
for (i in 1:nrow(rates2)) { startups <- rbind(data.frame(Status = rep(rates2[i,]$Status, rates2[i,]$Count), Year=rep(rates2[i,]$Year, rates2[i,]$Count)), startups) }
library(survival)
startups$Alive <- startups$Status == "Active"
startups$Age <- 2014 - startups$Year
sf <- survfit(Surv(Age, Alive, type="right") ~ 1, data=startups); summary(sf)
#  time n.risk n.event survival  std.err lower 95% CI upper 95% CI
#     0    473     120  0.74630 0.020007     0.708099      0.78656
#     1    352     121  0.48976 0.023007     0.446680      0.53699
#     2    222      68  0.33974 0.022007     0.299236      0.38573
#     3    129      36  0.24493 0.020778     0.207412      0.28924
#     4     70      15  0.19245 0.020269     0.156552      0.23657
#     5     39       7  0.15790 0.020407     0.122571      0.20342
#     6     20       2  0.14211 0.021202     0.106083      0.19038
#     7     10       2  0.11369 0.024715     0.074248      0.17409
plot(sf)
# https://i.imgur.com/76B7AxN.png

library(cmprsk)
sc <- cuminc(startups$Age, startups$Status, cencode="Active"); sc
# Estimates and Variances:
# $est
#                       1            2           3           4           5           6
# 1 Acquired 0.0134537767 0.0791545678 0.172799416 0.223444079 0.321616811 0.397350061
# 1 Failed   0.0141745147 0.0579750421 0.118175302 0.229593560 0.299716940 0.375450190
#
# $var
#                         1              2              3             4             5             6
# 1 Acquired 3.62406271e-05 0.000301240943 0.000805565675 0.00118663857 0.00205862260 0.00275961348
# 1 Failed   3.97263451e-05 0.000220342717 0.000570181024 0.00140171794 0.00200661959 0.00272841167
plot(sc, lty=1, color=c(3,2))
# https://i.imgur.com/Tafk9B0.png

DNMs:

library(cmprsk)
blackc <- with(black, cuminc(Age, Closure, cencode="alive")); blackc
# Estimates and Variances:
# $est
#                       200           400           600           800          1000          1200
# 1 unknown   0.01136363636 0.02272727273 0.03409090909 0.07954545455 0.10227272727 0.11363636364
# 1 hacked    0.11363636364 0.11363636364 0.11363636364 0.11363636364 0.12500000000 0.12500000000
# 1 raided    0.01136363636 0.06818181818 0.06818181818 0.06818181818 0.07954545455 0.07954545455
# 1 scam      0.25000000000 0.35227272727 0.39772727273 0.39772727273 0.39772727273 0.39772727273
# 1 voluntary 0.22727272727 0.26136363636 0.26136363636 0.27272727273 0.27272727273 0.27272727273
#
# $var
#                         200             400             600             800            1000            1200
# 1 unknown   0.0001292408729 0.0002616701315 0.0003911601132 0.0008988554115 0.0011441139596 0.0013003690983
# 1 hacked    0.0011623540396 0.0011623540396 0.0011623540396 0.0011623540396 0.0012886980693 0.0012886980693
# 1 raided    0.0001292408729 0.0007494488199 0.0007494488199 0.0007494488199 0.0009089372449 0.0009089372449
# 1 scam      0.0021690847025 0.0026530347066 0.0028036544633 0.0028036544633 0.0028036544633 0.0028036544633
# 1 voluntary 0.0020307752901 0.0022406509916 0.0022406509916 0.0023107700306 0.0023107700306 0.0023107700306

plot(blackc, lty=1, color=c(1:5), xlab="Days")

# confidence intervals:

plot(blackc, col=c(1:5), lty=1, xlab="Days", curvlab=c('hacked','raided','scam','voluntary'))
for (i in 1:4){
    cltype <- names(blackc)[i]
    ctm <- blackc[[cltype]]$time
    cest <- blackc[[cltype]]$est
    cvar <- blackc[[cltype]]$var
    clo <- cest ^ exp(-1.96*sqrt(cvar)/(cest*log(cest)))
    chi <- cest ^ exp(1.96*sqrt(cvar)/(cest*log(cest)))
    lines(ctm[2:length(ctm)], chi[2:length(ctm)], col=i, lty=2, lwd=0.7)
    lines(ctm[2:length(ctm)],clo[2:length(ctm)] , col=i, lty=2, lwd=0.7)
}

for (FAIL in c("raided", "hacked", "scam", "voluntary")) {
    cat(FAIL,":\n")
    print(with(black, crr(Age, Closure, cencode="alive", maxiter=100,
                    cov1= black[,c("Multisig", "Hacks", "Doxed", "Fraud", "Guns", "I2P", "Bitcoin", "Litecoin", "Dogecoin", "Darkcoin")],
                    failcode=FAIL)))
    cat("\n")
    }
# raided :
# convergence:  TRUE
# coefficients:
#  Multisig     Hacks     Doxed     Fraud      Guns       I2P   Bitcoin  Litecoin  Dogecoin  Darkcoin
#   0.98020   0.32990   1.17200  -0.04558  -0.24180 -17.32000 -15.50000 -11.17000 -28.49000 -27.65000
# standard errors:
#  [1] 0.9436 0.4524 0.8089 0.8893 1.0400 1.4230 2.1440 1.3780 2.8650 2.4430
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  3.0e-01  4.7e-01  1.5e-01  9.6e-01  8.2e-01  0.0e+00  4.9e-13  4.4e-16  0.0e+00  0.0e+00
#
# hacked :
# convergence:  TRUE
# coefficients:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#   0.4371   0.7562   1.0860   0.4956   0.8256 -11.6700   2.8160 -10.2200  -8.0430 -10.9900
# standard errors:
#  [1] 0.7206 0.3491 0.7689 0.6925 0.7205 0.8449 1.4230 1.2160 2.1830 0.9428
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  0.54000  0.03000  0.16000  0.47000  0.25000  0.00000  0.04800  0.00000  0.00023  0.00000
#
# scam :
# convergence:  TRUE
# coefficients:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
# -0.10720  0.08057 -0.59050  0.43420 -0.71390 -1.00200 -2.03000 -1.22200 -0.67940  0.29050
# standard errors:
#  [1] 0.5164 0.2175 0.5461 0.3790 0.3868 1.1430 0.6974 0.8939 0.7397 0.4950
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#   0.8400   0.7100   0.2800   0.2500   0.0650   0.3800   0.0036   0.1700   0.3600   0.5600
#
# voluntary :
# convergence:  TRUE
# coefficients:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  -0.7029  -2.1160   0.2623  -0.9765   0.2492   2.1520   3.5960   1.8850  -7.7330 -13.3800
# standard errors:
#  [1] 0.5779 0.8878 0.6494 0.4879 0.4364 0.4149 1.3520 0.5346 1.9310 0.7828
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  2.2e-01  1.7e-02  6.9e-01  4.5e-02  5.7e-01  2.1e-07  7.8e-03  4.2e-04  6.2e-05  0.0e+00

Time-vary­ing con­founds: Mul­ti­sig, RoI, σ, hacked, doxed, sales… Solve with mul­ti­-s­tate mod­els? http://cran.r-project.org/web/packages/msm/vignettes/msm-manual.pdf / http://web.inter.nl.net/users/rgeskus/CompRisk.pdf

Predictions

# Generate predictions of shutdown in next 6 / 12 months for the still-running marketplaces:

# You are not expected to understand this ugly hack. I don't either. But it *seems* to work...
# for background, see https://www.gwern.net/Google-shutdowns & https://www.gwern.net/Silk-Road#the-bet-bmr-or-sheep-to-die-in-a-year-by-oct-2014
library(rms)
conditionalProbability <- function (d, followupUnits, cmodel) {
    chances <- rep(NA, nrow(d)) # stash results

    for (i in 1:nrow(d)) {

        # extract chance of particular subject surviving as long as it has:
        beginProb <- survest(cmodel, d[i,], times=(d[i,]$Age))$surv
        if (length(beginProb)==0) { beginProb <- 1 } # set to a default

        tmpFollowup <- followupUnits # reset in each for loop
        while (TRUE) {
            # extract chance of subject surviving as long as it has + an arbitrary additional time-units
            endProb <- survest(cmodel, d[i,], times=(d[i,]$Age + tmpFollowup))$surv
            # survival curve may not reach that far! 'survexp returns 'numeric(0)' if it doesn't;
            # so we shrink down 1 day and try again until 'survexp' *does* return a usable answer
            if (length(endProb)==0) { tmpFollowup <- tmpFollowup - 1} else { break }
        }

        # if 50% of all subjects survive to time t, and 20% of all survive to time t+100, say, what chance
        # does a survivor - at exactly time t - have of making it to time t+100? 40%: 0.20 / 0.50 = 0.40
        chances[i] <- endProb / beginProb
    }
    return(chances)
}
# we can't regress on '~ 1' because `survest` crashes inside `conditionalProbability` (‽),
# so let's just toss in all the covariates to make it work despite none of them being well-justified...
cpmodel <- cph(Surv(Age, Alive) ~ Multisig + Litecoin+Dogecoin+Darkcoin + Guns + Fraud, data = black, x=TRUE, y=TRUE, surv=TRUE)
# report in %s rather than raw probabilities for easier reading
black$SixMonth <- round(digits=1, conditionalProbability(black, round(365/2), cpmodel) * 100)
black$OneYear  <- round(digits=1, conditionalProbability(black,          365, cpmodel) * 100)

## Predictions from 2015-01-02:
subset(black, Alive, select=c("Market", "SixMonth", "OneYear"))
#                      Market SixMonth OneYear
# 56             Dream Market    100.0   100.0
# 57                    Agora     65.6    65.6
# 58            Outlaw Market     72.3    72.3
# 59                evolution     17.5    17.5
# 60         BlackBank Market     13.1    13.1
# 61                   Area51     57.7    28.1
# 62 Middle Earth Marketplace     56.8    28.8
# 63                 Diabolus     34.7     0.0
# 64      Nucleus Marketplace     15.7     0.0
# 65                  Panacea     89.7    34.4
# 66                  Abraxas     85.9    51.2
# 67                 AlphaBay     92.5    48.4
## Evaluation: Agora/evolution/BlackBank/Area51/MEM/Nucleus/Panacea/Abraxas were all dead by August 2016.

## Predictions from 2016-08-18:
#                   Market SixMonth OneYear
# 67          Dream Market    100.0   100.0
# 69         Outlaw Market      0.0     0.0
# 74              AlphaBay    100.0     0.0
# 76                Tochka     53.7    53.7
# 77                Crypto     58.3    58.3
# 79           TheRealDeal      4.1     4.1
# 84 Darknet Heroes League     44.7    44.7

See Also

Appendix

Return & volatility

dead <- as.Date(c("2013-10-02","2013-12-02","2013-09-20","2013-11-29","2013-11-04",
                  "2013-10-20","2013-10-28","2013-12-22","2014-01-01","2014-01-05",
                  "2014-02-01","2014-02-01","2014-02-07","2014-02-06","2014-02-04",
                  "2014-02-07","2014-02-11","2014-02-01","2014-03-23","2014-02-17",
                  "2014-03-24","2014-02-28","2014-03-13","2014-02-01","2014-02-28",
                  "2014-03-28","2014-03-01","2014-04-07","2014-04-19","2014-04-20",
                  "2014-04-20","2014-03-20"))
live <- as.Date("2014-04-24") # yesterday, default for live markets
volatility <- read.csv("http://btcvol.info/csv",
                       colClasses=c("Date","numeric","numeric","numeric", "numeric"))

# 30-day return
sapply(dead, function(d) { post   <- volatility[volatility$date==d,]$price;
                           pre    <- volatility[volatility$date==(d - 30),]$price;
                           return <- ((post - pre)/pre);
                           round(return, digits=3) } )
 [1] -0.216  4.170  0.103  4.759  0.859  0.327  0.506 -0.173 -0.258  0.127  0.056  0.056 -0.182
[14] -0.033 -0.104 -0.182 -0.233  0.056 -0.014 -0.263 -0.031 -0.351 -0.047  0.056 -0.351 -0.129
[27] -0.334 -0.275 -0.145 -0.129 -0.129 -0.056
sapply(live, function(d) { post   <- volatility[volatility$date==d,]$price;
                           pre    <- volatility[volatility$date==(d - 30),]$price;
                           return <- ((post - pre)/pre);
                           round(return, digits=3) } )
[1] -0.141

# 30-day volatility
sapply(dead, function(d) { round(volatility[volatility$date==d,]$volatility, digits=3) } )
 [1] 0.018 0.102 0.024 0.093 0.035 0.056 0.063 0.127 0.118 0.109 0.047 0.047 0.030 0.031 0.043 0.030
[17] 0.032 0.047 0.046 0.040 0.045 0.048 0.057 0.047 0.048 0.052 0.049 0.046 0.074 0.075 0.075 0.050
tail(volatility$volatility,n=1)
[1] 0.07408

  1. There are a fair num­ber. An incom­plete list as of mid-2014:

    • Finnish: Silkki­tie: http://silkkitiehdg5mug.onion
    • French: French Dark Place 2.0: http://ruzh5shkcme2tpfk.onion
    • Pol­ish: Tore­pub­lic Mar­ket: http://nco5ranerted3nkt.onion/forum/market.php; Forum: http://nco5ranerted3nkt.onion/forum/
    • Rus­sian: Ramp: http://ramp2bombkadwvgz.onion
    • Rus­sian: Hydra Mar­ket: http://hydraruehsdjjfud.onion/ (not to be con­fused with the Hun­gar­ian Hydra busted in Ony­mous)
    • Ital­ian: http://babylonxjrtdyomy.onion (Baby­lon was raided in late July 2015)
    • Swedish: flugsvamp: http://yakwbcn5ou2wkzfx.onion
    • Magic Shop
    ↩︎
  2. His­tor­i­cal archive of DNstat­s’s sta­tis­tics is avail­able in my .↩︎