Darknet Market mortality risks

Survival analysis of lifespans, deaths, and predictive factors of Tor-Bitcoin darknet markets
statistics, predictions, Bitcoin, Silk-Road, R
2013-10-302019-06-09 in progress certainty: possible importance: 7


I com­pile a dataset of 87 pub­lic Eng­lish-lan­guage dark­net mar­kets (DNMs) 2011–2016 in the vein of the fa­mous , record­ing their open­ings/­clos­ing and rel­e­vant char­ac­ter­is­tics. A sur­vival analy­sis in­di­cates the mar­kets fol­low a Type TODO lifes­pan, with a me­dian life of TODO months. Risk fac­tors in­clude TODO. With the best mod­el, I gen­er­ate es­ti­mates for the cur­rent­ly-op­er­at­ing mar­kets.

The most strik­ing as­pect of dark­net mar­kets (DNMs; on­line web­sites sell­ing drugs and other goods us­ing cryp­tocur­ren­cies), after the fact that they are so suc­cess­ful and ex­ist at all, is how much turnover there is. The ca­sual ob­server of DNMs will quickly be­come con­fused by the sheer num­ber of DNMs over time, and their short life­times. How many are there? What pre­dicts longer or shorter life­times? Why are they so tran­sient? How do they die? Here I try to shed some light on these ques­tions by tab­u­lat­ing all known launched Eng­lish-lan­guage DNMs from the in­ven­tion of the busi­ness model by Silk Road 1 up through 2016. I am in­ter­ested in web­sites sell­ing drugs over Tor or i2p, us­ing cryp­tocur­ren­cies like Bit­coin/Lite­coin/­Do­ge­coin, al­low­ing mul­ti­ple sell­ers other than the site op­er­a­tors, and pro­vid­ing some sort of es­crow func­tion­al­i­ty. This ex­cludes clear­net sites like Top­ix, sin­gle-ven­dor shops like Mod­ern Cul­ture or Bungee54, card­ing shops like Tor Carders Mar­ket, host­ing ser­vices like Cryuserv or Bad Wolf, DNM-focused fo­rums like The Hub, and fo­rums for buy­ers & sell­ers to deal di­rectly with each other like The Ma­jes­tic Gar­den.

For­eign lan­guage mar­kets are ex­cluded be­cause I can­not nav­i­gate them1; Drug­Mar­ket, Bigshop & a few oth­ers are ex­cluded be­cause they re­port­edly have al­ways been a scam (sim­i­larly for most sites listed on the no­to­ri­ously wrong Hid­den Wik­i); the Ma­jes­tic Gar­den & Un­der­ground Mar­ket Board 3.0 are ex­cluded be­cause they are fo­rums & do not do es­crow for their users; Grand Trunk never left beta & had ac­tual sales.

Data

Vari­ables:

  • start/end dates are, when pos­si­ble, the date of the first & last known sales/with­drawals; oth­er­wise they are rounded to my first/last visit to them; or to the start/end of the month they ap­peared/dis­ap­peared
  • clo­sure: whether the shut down was due to law en­force­ment, pre­cip­i­tated by a hack or de-anonymiza­tion, a scam/theft by op­er­a­tors, or vol­un­tary (with­out known losses to users)
  • ar­rest­ed: whether the prin­ci­pal op­er­a­tor/own­er/­main­tainer of the mar­ket­place was ar­rested for run­ning it (this ex­cludes hired staff)
  • mul­ti­sig: whether 2-of-3 es­crow sup­port­ed; 2-of-2 and other ‘lite’ ver­sions are not con­sid­ered mul­ti­sig be­cause they still al­low for thefts
  • i2p: whether i2p is used in ad­di­tion/in­stead of Tor
  • hacks: num­ber of pub­licly known hacks re­sult­ing in leaks of user in­for­ma­tion, loss of funds, etc
  • doxed: whether a plau­si­ble can­di­date for site op­er­a­tors has been made pub­licly known by law en­force­ment or other peo­ple
  • code­base: the ori­gin of the source code for a site where any­thing is pub­licly known; ‘cus­tom’ sim­ply means the site op­er­a­tors seem to have writ­ten it them­selves
  • coin: prin­ci­pal cryp­tocur­rency of mar­ket­place; if mul­ti­ple coins are ac­cept­ed, I list the most promi­nent alt­coin
  • guns: whether firearms were sold, spec­i­fied in rules/poli­cies as al­lowed to be sold, or rules/poli­cies spec­i­fied there were no bans on item cat­e­gories
  • fraud: whether card­ing items like credit card dumps were sold etc (this does not in­clude fake IDs or in­for­ma­tional guides on how to com­mit fraud; the for­mer have uses be­sides card­ing, and the lat­ter are often out­dated or just scams)

Table

A ta­ble of 87 DNMs (up­dated 2019-06-09):

Mar­ket Start End Alive Clo­sure Ar­rested URL Mul­ti­sig I2P Bit­coin Lite­coin Do­ge­coin Dark­coin Code­base Guns Fraud Hacks Doxed Notes
Silk Road 1 2011-01-31 2013-10-02 FALSE raided TRUE silkroadvb5piz3r.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 2 TRUE SR1 tem­porar­ily sold guns as part of “the Ar­mory” but only for a brief time as sales were poor.
Black­Mar­ket Re­loaded 2011-06-30 2013-12-02 FALSE hacked FALSE r6rcmz6lga4i5vb4.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 1 FALSE back­opy stopped buy­ing on 2 Dec ag­gra­vated in part by a big theft, fully shut­down by 23 De­cem­ber. May re­open. BMR per­mit­ted gun sales, and also seems to have per­mit­ted credit card in­for­ma­tion sales, judg­ing by an­gry feed­back.
At­lantis 2013-03-26 2013-09-20 FALSE scam FALSE atlantisrky4es5q.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known FALSE FALSE 0 FALSE At­lantis’s shut­down seems, judg­ing by com­ments on Red­dit pages & All Things Vice to have ini­tially al­lowed with­drawals, but dis­abled it after a few days and then stole the re­main­ing de­posit­s+e­scrow+ven­dor-bonds.
Sheep Mar­ket­place 2013-02-28 2013-11-29 FALSE scam TRUE sheep5u64fi457aw.onion FALSE FALSE TRUE FALSE FALSE FALSE Nette FALSE TRUE 1 TRUE with­drawals were halted be­fore 29 Nov, but de­posits & sales were on­go­ing. I choose 29 Nov as the day where the Sheep scam be­came ir­refutable. Strictly speak­ing, an op­er­a­tor has not been ar­rested as of 2015-03-27, but the sus­pected op­er­a­tor is in le­gal trou­ble over mon­ey-laun­der­ing of large Bit­coin-re­lated sums.
Deep­bay 2013-06-30 2013-11-04 FALSE scam FALSE deepbay4xr3sw2va.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known FALSE FALSE 0 FALSE Dis­ap­peared with funds; based on a screen­shot of cat­e­gories, seems to have been al­most ex­clu­sively drugs.
Bud­ster 2013-10-10 2013-10-20 FALSE scam FALSE budsterga5hcdxjn.onion FALSE FALSE TRUE FALSE FALSE FALSE Word­Press FALSE FALSE 1 TRUE http­s://old.red­dit.­com/r/Bud­ster/­com­ments/1ove9w/has_any­one_­made_a_pur­chase_yet/c­cw8srh http­s://old.red­dit.­com/r/­Dark­Net­Mar­ket­s/­com­ments/1xy­ix­a/p­sa_­cyruserv_is_­down_­for_­good_bud­ster_taf_host­ing/ Bud­ster did not seem to use gen­uine mul­ti­sig and this en­abled the scam: http­s://old.red­dit.­com/r/SilkRoad­/­com­ments/1opmha/bud­ster_the_­world­s_­first_p2p_­mar­ket­place/
Project Black Flag 2013-10-14 2013-10-28 FALSE scam FALSE ajd4yqq7ngzmqo3p.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE TRUE 1 FALSE http­s://old.red­dit.­com/r/­Dark­Net­Mar­ket­s/­com­ments/1pegu­v/pbf_rip/ ; fo­rums: blackiiw5nozs6i5.onion; poli­cies stated on fo­rums (“Pro­hib­it­ed: Weapons, coun­ter­feit mon­ey, stolen goods, child pornog­ra­phy, post­ing other users in­for­ma­tion, at­tempt to cause harm, spam­ming.”)
Tor­Mar­ket 2013-11-07 2013-12-22 FALSE scam FALSE tormarkozaegyvco.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known FALSE TRUE 1 FALSE Part of the Tor­Mar­ket user list was leaked by DPR2 on SR2F; TM also ad­mit­ted other se­cu­rity is­sues, but fur­ther ru­mors that Tor­Mar­ket’s shut down was pre­cip­i­tated by a hack by “Pro­fe­sor­house” have not been sub­stan­ti­at­ed. TM may have used Bit­wasp, but it did­n’t seem to have Bit­wasp er­ror pages and does­n’t re­ally look like the usual Bit­wasp DNM.
Flo­Mar­ket 2013-12-01 2014-01-01 FALSE hacked FALSE fmkt3wixc772jxyj.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp 2 FALSE Ap­par­ently hacked 2013-12-20 (pre­vi­ously noted to be hack­able); with­drawals be­gan fail­ing on 2014-01-01 & Flo­Mar­ket an­nounced a sec­ond hack on 2014-01-06; for the op­er­a­tor’s ex­pla­na­tion, see his in­ter­view
Tor­tuga 2013-12-16 2014-01-05 FALSE vol­un­tary FALSE tortugauwngwecwd.onion FALSE FALSE TRUE FALSE FALSE FALSE Seag­ull 0 FALSE Ad­ver­tised in the SR2F on 2013-12-19; ad­ver­tised on the BMR fo­rums on 16 Dec. Up on 2014-01-01, down on 2014-01-09 & after­wards. No news about rea­sons for its clo­sure. No offi­cial rules on list­ings were posted be­fore it dis­ap­peared, prob­a­bly be­cause it was un­pop­u­lar enough that con­tent was not an is­sue.
Black­Box Mar­ket 2013-11-12 2014-02-01 FALSE vol­un­tary FALSE 77yqlxe7pnxhnxvi.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known TRUE TRUE 0 FALSE In­ter­est­ing site, but not sure it should be listed here. Start date based on Red­dit. Site stopped re­spond­ing 2014-02-01. On-site es­crow did not use mul­ti­sig (“We do not make use of the Es­crow ser­vices pro­vided by Bit­coin it­self as this as­so­ciates buy­ers and sell­ers.”) Poli­cies based on the fact that BBM could not know what was be­ing sold on it and so de facto per­mit­ted both cat­e­gories.
Grey­Road 2014-01-04 2014-02-01 FALSE vol­un­tary FALSE greyroaderw4qymd.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known TRUE TRUE 0 FALSE Went pub­lic 2013-01-04 (2), op­er­a­tor claims to have been sell­ing for a while but re­fuses to pro­vide any specifics & very few sell­ers on mar­ket so open­ing date is used; fo­rums: grforums5qwzbhkl.onion. URL stopped work­ing 2014-02-01
Can­tina 2014-01-20 2014-02-07 FALSE hacked FALSE vsudl2g3em6qhcw4.onion FALSE FALSE TRUE FALSE FALSE FALSE Nette TRUE TRUE 3 TRUE Can­tina spammed ven­dors on SR2F on 2014-01-20; ear­li­est known men­tion of the mar­ket. It was re­peat­edly hacked & doxed. Can­tina had no stated poli­cies, but it did have a cat­e­gory for guns and given the ‘Data’ cat­e­gories & gen­eral lack of ethics & greed, highly likely would have per­mit­ted card­ing had it not died so ig­no­min­ious­ly.
Break­ing Bad 2014-02-01 2014-02-06 FALSE vol­un­tary FALSE breakingnartglxd.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE An­nounced on Red­dit; site went down 6 Feb­ru­ary, owner ex­plained shut­down due to “Lack of in­ter­est from ven­dors, con­stant hate mail, down­votes and claims on se­cu­rity vul­ner­a­bil­i­ties”
Black Gob­lin Mar­ket 2014-02-03 2014-02-04 FALSE hacked FALSE ua4aptglh45m5p6b.onion FALSE FALSE TRUE FALSE FALSE FALSE Dru­pal TRUE TRUE 0 TRUE An­nounced on Red­dit; I de-anonymized the site, so it shut down. The “Black Gob­lin Rules” page does not men­tion any ban of guns or card­ing.
Cannabis Road 2014-02-03 2014-02-07 FALSE hacked FALSE ji4wrifhsnawaw7t.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 TRUE An­nounced on The Hub; thor­oughly hacked & de-anonymized
Utopia 2014-02-03 2014-02-11 FALSE raided TRUE ggvow6fj3sehlm45.onion FALSE FALSE TRUE FALSE FALSE FALSE CakePHP TRUE TRUE 0 TRUE fo­rums: ysas7uv4drg7rlwv.onion; forms opened in early Jan­u­ary, site opened to ex-BMR sell­ers late Jan­u­ary, gen­eral buy­ers only al­lowed in Feb­ru­ary. Dutch seizure no­tice posted ~7:30AM EST, fol­lowed by 5 ar­rests in Nether­lands & Ger­many
Black Ser­vices Mar­ket 2013-12-02 2014-02-01 FALSE scam FALSE thebsm6okkbx7fik.onion FALSE FALSE TRUE FALSE FALSE FALSE OS­class TRUE TRUE 0 FALSE Start date based on old­est list­ing when I checked on 2013-12-26; last ad­min fo­rum post 18 Jan & PMs to him dis­abled, re­ports of es­crow prob­lems in late Jan/early Feb, many com­plaints on fo­rums; site went down 2014-02-14
Red Sun Mar­ket­place 2014-03-20 2014-03-23 FALSE hacked FALSE redsun4lvjrxwwuy.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE TRUE 1 FALSE An­nounced on Red­dit; hacked (SQli etc); fo­rum: forumsyccj7ekvvv.onion. Sur­viv­ing ma­te­ri­als don’t say whether guns were per­mit­ted, but given the op­er­a­tor’s in­ter­est in re­cruit­ing fake ID ven­dors it seems more likely than not that card­ing sales would have been al­lowed.
Buy­It­Now 2013-04-30 2014-02-17 FALSE vol­un­tary FALSE buyitnowquyft7dx.onion FALSE FALSE TRUE FALSE FALSE FALSE Word­Press TRUE FALSE 0 FALSE Site did not re­spond on 2014-02-17 or after­wards; no re­ports on shut­down rea­son or whether it was a scam. Poli­cies not spec­i­fied, but many list­ings for guns, and none of any kind re­lated to card­ing.
White Rab­bit 2013-12-23 2014-02-01 FALSE scam FALSE rabbittorvr74veg.onion FALSE TRUE FALSE TRUE FALSE FALSE un­known TRUE TRUE 0 TRUE Start date based on Red­dit posts. For­merly named “Rab­bit’s Mar­ket­place”. Un­able to find re­ports of suc­cess­ful sales on The Hub or Red­dit, and WR with­drawal has been bro­ken at least since 2014-02-21; no one has claimed with­drawals re­cent­ly. Dead date is based on the Feb­ru­ary news no­tice “There are prob­lems with pay­ment gate­way”. Fo­rum states only CP is banned (“Items which are not al­lowed: child porn (and other sick stuff).”) i2p: wrmarket.i2p. IP was found to be leak­ing.
Free­Bay 2013-12-01 2014-02-28 FALSE vol­un­tary FALSE freebay3yxuebsog.onion FALSE FALSE TRUE TRUE FALSE FALSE un­known FALSE TRUE 0 FALSE URL is also ap­par­ently litebay7vp5pm77f.onion (Free­Bay took Bit­coin, Lite­Bay took Lite­coin); open date is guess based on Red­dit post; site was not up on 2014-02-28 when I checked. Poli­cies not spec­i­fied, but many card­ing & no gun list­ings.
drugslist 2014-01-08 2014-02-28 FALSE scam FALSE drugslisvdknitqd.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 FALSE With­drawals be­gan fail­ing & ad­min ceased re­spond­ing in Feb­ru­ary 2014; date clo­sure to the fo­rum ad­min ac­coun­t’s last lo­gin.
Doge Road 2014-01-18 2014-03-13 FALSE scam FALSE dogeroadiqt6olb6.onion FALSE FALSE FALSE FALSE TRUE FALSE Bit­wasp FALSE TRUE 0 FALSE An­nounced on Red­dit; fo­rums: dogeroadqmu2yzcg.onion. Went down some­time in March 2014, may have gone bad in late Feb­ru­ary.
TorE­scrow 2014-02-02 2014-04-19 FALSE scam FALSE torescrow7upglhe.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known FALSE TRUE 0 FALSE Ini­tially just an es­crow, but TE ex­panded into a mar­ket. Fo­rums: 4rtvonaubslk7vvk.onion. TE seems to have per­mit­ted card­ing: “We do not al­low the sale of weapons, pornog­ra­phy, ebooks, pi­rated soft­ware or hits.”
Ar­mory Ven­dor Mar­ket 2014-02-06 2014-04-07 FALSE scam FALSE armoryx7kvdq3jds.onion FALSE FALSE FALSE FALSE FALSE TRUE Quick­.­Cart TRUE FALSE 1 FALSE An­nounced on Red­dit; their Cryuserv host­ing, ac­cord­ing to the hack­er, dated back to 2013-05-23 but it’s un­clear when they had their first sale. It an­nounced use of Dark­coin in March 2014.
Dark­net Na­tion 2014-02-19 2014-03-01 FALSE hacked FALSE 26a2ueoc3xxrrgs4.onion FALSE FALSE TRUE FALSE FALSE FALSE Joomla TRUE TRUE 0 TRUE An­nounced on Red­dit; Q&A. The site leaked its IP ad­dress. Down 2014-04-03; best guess, shut down some­time in March (the ad­min­is­tra­tor’s last post on The Hub was 2014-03-01.)
San­i­tar­ium Mar­ket 2014-02-20 2014-03-28 FALSE vol­un­tary FALSE sanitarium-market.i2p FALSE TRUE TRUE FALSE FALSE FALSE Bit­wasp 0 FALSE An­nounced on Red­dit; long ad­dress: dhd5okd2imkskbhsrlbs5c4nx3cdtmwpplvcei6o3l2sc35kt4ma.b32.i2p; Tor mir­ror: nyu7nlbj33ym2va3.onion. Un­reach­able by Deep­DotWeb 2014-03-28, and last sub­red­dit ac­tiv­ity was 2014-03-19. The op­er­a­tor claimed on 2014-02-24 to have in­te­grated mul­ti­sig but I can’t find any re­ports of use of it. No sur­viv­ing info in­di­cates whether weapons or card­ing were al­lowed.
Hansa 2014-03-09 2014-03-20 FALSE raided TRUE hansann7wim5ier2.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 TRUE An­nounced on Red­dit & de-anonymized; clo­sure date based on last trans­ac­tion by their IP. They planned to im­ple­ment mul­ti­sig but seem to have shut down be­fore it went live. Bit­wasp clas­si­fi­ca­tion based on two com­ments & screen­shot of lo­gin page. They ap­peared to be a vol­un­tary shut down but had been sub­verted by Dutch po­lice & mul­ti­sig dis­abled & turned into a hon­ey­pot for mon­i­tor­ing buyer ad­dress­es, seller ge­o­t­agged im­ages, and mal­ware.
EXXTACY 2014-03-23 2014-03-24 FALSE hacked FALSE j3gwwsnswrg7dtf4.onion FALSE FALSE TRUE FALSE FALSE FALSE Dru­pal 0 TRUE An­nounced & de-anonymized on Red­dit. No in­for­ma­tion about poli­cies is avail­able, al­though since it seems to’ve been run by San­i­tar­i­um, it likely had what­ever they did. Died be­fore any rules an­nounced or mir­rors made.
Mr Nice Guy 2014-03-29 2014-04-20 FALSE vol­un­tary FALSE niceguymn4plorwb.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE FALSE 0 TRUE An­nounced on Red­dit; fo­rum: ngforumjj4dkis7w.onion. IP was leak­ing.
Tor­Bay 2013-12-18 2014-04-20 FALSE vol­un­tary FALSE tyedahhf56xli7xp.onion FALSE FALSE TRUE FALSE FALSE FALSE hy­ops FALSE TRUE 0 TRUE Start date based on Red­dit an­nounce­ment; ceased re­spond­ing in April 2014, after list­ings had fallen to near-ze­ro.
Dark­Bay 2014-01-30 2014-05-01 FALSE vol­un­tary FALSE darkbay4rwgvdkqn.onion TRUE FALSE TRUE FALSE FALSE FALSE un­known FALSE TRUE 0 TRUE An­nounced on Red­dit; fo­rums: 7y26aczl3wdyujkc.onion; for­mer­ly, Ul­tra­Vi­o­letC­i­ty/ultracityi2gdwhq.onion. “There is very lit­tle re­stric­tion here, we only ask that you do not sell firearms (ri­fles, pis­tols, au­to­matic weapons etc) or child pornog­ra­phy (pho­tographs, videos etc).” Merged with An­drom­e­da?
Pi­geon Mar­ket 2014-04-14 2014-05-07 FALSE vol­un­tary FALSE pigeonkcmw5h44lq.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known TRUE TRUE 0 FALSE Un­known what hap­pened to funds.
Free Mar­ket 2015-01-14 2015-02-26 FALSE vol­un­tary FALSE tfmarket6iaddx45.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 0 FALSE An­nounced on Red­dit
Tor­tuga 2 2014-04-23 2014-06-17 FALSE vol­un­tary FALSE l6hkncqo46wgzx7y.onion TRUE TRUE FALSE TRUE FALSE FALSE Dru­pal FALSE FALSE 0 FALSE An­nounced on Red­dit; i2p: wtat6dgz57j5xllu2j7htb7aydq5rgls6edg7e6lf2tumqn5ej3a.b32.i2p/tortuga-marketplace.i2p; mul­ti­sig; ; un­known what hap­pened to funds.
Deep­zon 2014-05-14 2014-07-13 FALSE vol­un­tary FALSE deepzondhyl3yaro.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known TRUE TRUE 0 FALSE Sup­port’s re­spon­se: “Gun­s/Weapons are al­lowed, we thought that would be clear, as we are hav­ing the cat­e­gory ‘Weapons’ list­ed. CC-Dumps are also al­lowed.”’ ; un­known what hap­pened to funds.
Silk Street 2014-04-08 2014-08-04 FALSE scam FALSE silkr2xyqsu73qhh.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE FALSE 0 FALSE An­nounced on The Hub; no re­ports of with­drawals, so marked false. No ex­plicit poli­cies, but UI shows many empty cat­e­gories but no empty cat­e­gories for fraud or gun items, so I pre­sume those were not per­mit­ted.
Un­der­ground Mar­ket 2014-04-09 2014-08-26 FALSE vol­un­tary FALSE unground6baopdio.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE An­nounced on Red­dit; fo­rums: vxcwhb4lzqltfauq.onion. Shut down cit­ing “not enough cus­tomers”.
Cannabis Road 2 2014-03-28 2014-08-25 FALSE hacked FALSE cannabiskofvl7pa.onion TRUE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 FALSE Fo­rum: forumzxmoorof4ja.onion; fo­rum opened 2014-02-26, but site was not op­er­a­tional. The soft­-launch/raffle an­nounced 2014-03-28 seems a good start date. Was hacked & lost >$123,384₿2002014 from es­crow (while mul­ti­sig was avail­able, very few buy­ers used it).
Pan­dora 2013-10-21 2014-08-19 FALSE scam FALSE pandorajodqp5zrr.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE TRUE 2 FALSE See “For­bid­den Items on PANDORA. Pan­dora has had 2 hacks: the first was a rogue mod­er­a­tor us­ing an ad­min ac­count, and the sec­ond was a loss of half the cen­tral­ized es­crow (re­paid by levy­ing ex­tra­or­di­nary trans­ac­tion fees). The op­er­a­tor even­tu­ally locked out all seller ac­counts around 19/2014-08-20 (defi­nitely by 1 Sep­tem­ber) and dis­abled with­drawals & the site fo­rums, but con­tin­ued ac­cept­ing de­posits from buy­ers; he may also have cap­tured lo­gin cre­den­tials and robbed ac­counts on other mar­ket­places ac­cord­ing to sev­eral sell­ers. Tar­geted in Op­er­a­tion Ony­mous but had al­ready turned scam­mer.
Pi­rate Mar­ket 2013-11-29 2014-08-15 FALSE scam FALSE yjhzeedl5osagmmr.onion TRUE FALSE TRUE FALSE FALSE FALSE un­known TRUE TRUE 0 FALSE Start date based on Red­dit. Orig­i­nally Road­Silk; mul­ti­sig. Site re­port­edly be­gan block­ing with­drawals ~2014-08-15 while still ac­cept­ing de­posits, with the Pi­rate Mar­ket fo­rum be­ing shut down sev­eral days lat­er.
Free­dom Mar­ket 2014-09-16 2014-09-25 FALSE vol­un­tary FALSE freedom3qg7hmtxn.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE FALSE 0 FALSE An­nounced on Red­dit; went down with­out no­tice some­time be­fore 2014-09-25. Site rules: “If the item does­n’t hurt oth­ers, you can sell it.”; the cat­e­gories in­cluded “Forg­eries” but noth­ing else, so card­ing prob­a­bly counted as ‘hurt­ing oth­ers’.
1776 2014-04-19 2014-10-02 FALSE vol­un­tary FALSE n6tzonxy7sod7eqt.onion FALSE FALSE TRUE FALSE FALSE FALSE ASP.NET FALSE FALSE 0 FALSE An­nounced by Deep­DotWeb & on Red­dit. Not Bit­wasp, given the trace­back on er­ror pages. No pol­icy doc­u­men­ta­tion. Dis­ap­peared start­ing 2014-10-03.
Silk Road 2 2013-11-06 2014-11-05 FALSE raided TRUE silkroad6ownowfk.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 2 TRUE Fo­rum mod­er­a­tor Cir­rus ad­vises con­sid­er­ing SR2 com­pro­mised (2013-12-22, ironic inas­much as Cir­rus was the LE un­der­cover agent who un­did SR2 and helped with SR1); new op­er­a­tors De­f­con/Hux/etc deny it. De­f­con an­nounced the cold wal­let had been lost to DPR2, but then that it had been re­stored. SR2 ex­pe­ri­enced re­peated ac­count bal­ance prob­lems, failed to ever im­ple­ment aut­o­fi­nal­ize or dis­pute res­o­lu­tion (forc­ing ac­cu­mu­la­tion of or­ders’ bal­ances), and an­nounced 2014-02-13 that all de­posits & es­crow had been stolen, fol­lowed by an­other hack in Sep­tem­ber 2014. Use of SR was not ad­vised. Was raided by Op­er­a­tion Ony­mous & De­f­con ar­rest­ed.
Hy­dra 2014-03-27 2014-11-05 FALSE raided TRUE hydrampvvnunildl.onion TRUE FALSE FALSE TRUE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE An­nounced on The Hub; fo­rum: hydrafmchvpq5yc6.onion. Op­er­a­tor ar­rested in Hun­gary as part of Op­er­a­tion Ony­mous. (Ap­par­ently un­re­lated to the Russ­ian Hy­dra still in op­er­a­tion as of Jan­u­ary 2019.)
Cloud-Nine 2014-02-11 2014-11-05 FALSE raided FALSE xvqrvtnn4pbcnxwt.onion TRUE FALSE TRUE FALSE FALSE FALSE Cloud-9 FALSE TRUE 0 FALSE An­nounced on Red­dit; on banned items. Raided in Op­er­a­tion Ony­mous.
Blue Sky 2013-12-03 2014-11-05 FALSE raided FALSE blueskyplzv4fsti.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known FALSE FALSE 0 FALSE Or is the open­ing 2013-12-12? Raided in Op­er­a­tion Ony­mous.
Tor­Bazaar 2014-01-26 2014-11-05 FALSE raided FALSE bazaarlv2a7i3uyn.onion TRUE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE An­nounced on The Hub; orig­i­nal cen­tral­ized es­crow site: 3p42y56a76g6okuv.onion; fo­rums: 22iwhc2luicynjqy.onion
Topix 2 2014-03-25 2014-11-05 FALSE vol­un­tary FALSE topixslhezyytrvm.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 0 FALSE Started Jan­u­ary 2014; opened to pub­lic 2014-09-28, pre­vi­ously was in­vite-on­ly; start date based on first sale listed in re­cen­t-feed­back page; ap­par­ently drug-only based on the list­ings. Shut down with­out no­tice after .
Al­paca Mar­ket­place 2014-04-20 2014-11-05 FALSE scam FALSE alpaca727o3c75xx.onion TRUE FALSE TRUE FALSE FALSE FALSE un­known TRUE FALSE 1 FALSE An­nounced on The Hub; poli­cies based on Se­cret Lab­o­ra­tory writeup Hacked mid-May 2014. Al­paca al­lows weapons (but not poisons/WMDs/hitmen) and ap­pears to ban card­ing: “We do not al­low items that are ad­ver­tised as stolen.” Shut down after Op­er­a­tion Ony­mous (seizure no­tice) with­out re­turn­ing any funds.
Cannabis Road 3 2014-10-06 2014-11-05 FALSE scam FALSE cannabis37oj24rd.onion TRUE FALSE TRUE FALSE FALSE FALSE Al­paca FALSE FALSE 0 FALSE Fo­rum: forumz2gljo2vhzb.onion. After CR2 was hacked, de­vel­oper “Crypto” dis­ap­peared; the re­main­ing staff set up a new mar­ket­place hosted by Al­paca Mar­ket­place. Went down with Al­paca after Op­er­a­tion Ony­mous
An­drom­eda 2014-04-05 2014-11-18 FALSE scam FALSE andromedam363aux.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known TRUE TRUE 0 FALSE For­merly Silk Road 3/silkroad3wqdnifp.onion; site has no con­nec­tion to SR1 or SR2. Fo­rums: dvzuhtlteonn6mwd.onion. An­drom­eda at­tempted to mask its exit scam as an Op­er­a­tion Ony­mous but it was­n’t an­nounced as seized and the bro­ken with­drawals & failed mim­icry show it’s bo­gus.
The Mar­ket­place 2013-11-28 2014-11-09 FALSE vol­un­tary FALSE themarketplace.i2p TRUE TRUE TRUE FALSE FALSE FALSE cus­tom FALSE TRUE 0 FALSE Start date from per­sonal com­mu­ni­ca­tion; Tor Proxy: 43y5mwjvhxd6zf7v.onion. The ToS ban CP, guns, and Bit­coin/­dol­lar sales. Site went down 9 No­vem­ber, with­out any fur­ther no­tice. (The use of mul­ti­sig means buy­ers & sell­ers can still com­plete the fi­nal trans­ac­tion­s.)
Onion­shop 2014-05-18 2014-09-17 FALSE hacked FALSE onionshopkue7sxr.onion FALSE FALSE TRUE FALSE FALSE FALSE TRUE TRUE 1 FALSE An­nounced on Red­dit; hacked 2014-09-17 (an­nounce­ment, hacker)
TOM 2014-05-10 2014-12-18 FALSE scam FALSE tom3j5jkjl7327oc.onion TRUE FALSE TRUE FALSE FALSE FALSE Bit­wasp FALSE FALSE 0 FALSE Fo­rums: tomf2fo56wthggwk.onion. TOM dis­ap­peared with­out any an­nounce­ments; Red­dit com­ments re­port de­posits were not re­turned, so I mark TOM a scam.
Area51 2014-06-20 2015-01-24 FALSE scam FALSE fiftyonecrklhzhe.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE Spammed on The Hub; im­ple­men­ta­tion is PHP on De­bian, ad­min states “area51 is com­plete self­coded and we have noth­ing to do with bit­wasp”. Cen­tral­ized es­crow & no re­ports of de­posits be­ing re­turned.
Panacea 2014-10-27 2015-02-13 FALSE vol­un­tary FALSE panaceaz4give75l.onion TRUE FALSE TRUE FALSE FALSE FALSE Cloud-9 FALSE FALSE 1 TRUE Red­dit ANN; fo­rums: flower777wpnxpkj.onion; cannabis-on­ly; ad­min “Py­roWolf” was re­port­edly doxed by the cannabis seller East­Coast­Col­lec­tive (likely the op­er­a­tor of CR2/CR3, and pos­si­bly CR1 as well), who he was a for­mer cus­tomer of. Clo­sure ob­scure - staff blames an AWOL de­vel­oper and the mul­ti­sig coins to be safe, but a throw­away claims to’ve hacked it.
evo­lu­tion 2014-01-14 2015-03-14 FALSE scam FALSE k5zq47j6wd3wdvjq.onion FALSE FALSE TRUE FALSE FALSE FALSE Lar­avel TRUE TRUE 0 FALSE An­nounced on Red­dit 20 Jan, but fo­rums claim first sale on 14 Jan­u­ary; fo­rums: i25c62nvu4cgeqyz.onion; new url: nifgk5szbodg7qbo.onion; claimed mul­ti­sig but on fur­ther in­ves­ti­ga­tion, seems to be the weak kind. PHP frame­work. Site & fo­rums went down 2015-03-18 but large with­drawals be­gan fail­ing ~2015-03-14, mark­ing the start of the exit scam. For­mer em­ployee claims $45,402,252₿130,0002015 lost.
Iron­clad 2015-03-17 2015-03-25 FALSE scam FALSE ironcladcoc3chq6.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE ANN; fo­rums: forum.ironcladcoc3chq6.onion. Dis­ap­peared with­out no­tice dur­ing the post-Evo­lu­tion chaos & Tor DoS at­tacks in March 2015; as a cen­tral­ized mar­ket, all es­crow & de­posits are pre­sumed stolen.
Kiss 2015-02-19 2015-05-16 FALSE scam FALSE kissmpg5zave56f4.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 FALSE ANN; fo­rum: 6bssxspijk7n2ioh.onion; Kiss mod­er­a­tor claims hacked 2015-05-21 then op­er­a­tor de­cided to ex­it-s­cam. I date to 2015-05-16, how­ev­er, as I was un­able to log in start­ing then.
Black­Bank Mar­ket 2014-02-05 2015-05-18 FALSE scam FALSE wztyb7vlfcw6l4xd.onion TRUE FALSE TRUE FALSE FALSE FALSE un­known TRUE TRUE 0 FALSE Ac­tive be­fore its Red­dit an­nounce­ment but no ap­par­ent sales. Fo­rums: kth2mwuwlkezwziy.onion. For­bid­den items are listed on the wiki. BB went down with­out no­tice ~2015-05-18, with no com­mu­ni­ca­tions after­wards; com­pli­cat­ing the usual ex­it-s­cam story is that none of the bit­coins ap­pear to have moved in weeks and the ad­min, many months ago, had al­luded to se­ri­ous health is­sue.
Tor­nado 2015-05-12 2015-05-20 FALSE FALSE tornadoputkhrvfq.onion FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE ANN; fo­rums: tortalkmcguzevvz.onion; went down ~20 May with­out any pub­lic com­ments.
Ha­vana/Ab­solem 2015-04-13 2015-05-22 FALSE hacked FALSE havana3cofejesta.onion TRUE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE Opened ini­tially in­vite-code-only; fo­rums: forumz4usxavgyri.onion; pen­tester whyusheep­/hacks­for­crack turned on Ha­vana-Ab­solem, DoS­ing/hack­ing them; the ad­mins gave up, talk­ing about per­haps try­ing a pri­vate mar­ket in­stead.
Agape 2015-05-29 2015-06-04 FALSE vol­un­tary FALSE agape3brimud5fk6.onion FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE ANN. Vol­un­tar­ily shut down due to lack of in­ter­est and “back­lash”.
Zanz­ibar Spice 2015-05-07 2015-06-14 FALSE vol­un­tary FALSE mithrakushhvfyto.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 0 FALSE ANN; server be­gan throw­ing er­rors 2015-06-14 with no mar­ket com­mu­ni­ca­tion.
Dream Mar­ket 2013-11-15 2019-04-30 FALSE vol­un­tary FALSE ltxocqh4nvwkofil.onion FALSE FALSE TRUE FALSE FALSE FALSE un­known FALSE TRUE 0 FALSE Site claims to’ve opened 2013-11-15; first men­tion of it I found was on 2014-01-07. Later moved to lchudifyeqm4ldjj.onion/. Shut­down back­ground: DoJ, Dark Owl
Agora 2013-12-03 2015-09-06 FALSE vol­un­tary FALSE agorahooawayyfoe.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE Fo­rums: lacbzxobeprssrfx.onion. Agora banned guns 2015-07-15 after ~20 gun busts be­came known; nev­er­the­less, for most of its lifes­pan it al­lowed guns. Agora an­nounced 2015-08-25 that it would be go­ing offline in­defi­nitely to deal with Tor deanonymiza­tion at­tacks; with­drawals were en­abled and DNstats in­di­cates the site went offline around 2015-09-06.
Out­law Mar­ket 2013-12-29 2017-05-16 FALSE hacked FALSE drugs26ucskmvcef.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE FALSE 3 FALSE Open date based on the date of the “Wel­come” post on the OM fo­rum; ap­par­ently for­merly “Drugs’n’­Bets”. Site was hacked & user PMs re­leased in 2013; site shut down 2014-07-31 after an at­tack blame on for­mer ad­mins when “A SESSION-hack was per­formed and a cou­ple of datasets ma­nip­u­lated but not much dam­age cre­ated”. They claim in an in­ter­view it’s cus­tom soft­ware; this is con­firmed by a leak of PHP source which does not call any frameworks/CRMs. Poli­cies based on no ap­par­ent hits among mir­rors. Ex-staff in­sist it was not an exit scam but a gen­uine hack.
Mid­dle Earth Mar­ket­place 2014-06-22 2015-11-04 FALSE scam FALSE mango7u3rivtwxy7.onion FALSE FALSE TRUE FALSE FALSE FALSE Django FALSE TRUE 0 FALSE An­nounced on Red­dit. Ex­it-s­cammed some­time around Oc­to­ber-No­vem­ber 2015; some is­sues with with­drawals re­ported in late Oc­to­ber, then the site went down for ‘main­te­nance’ around 2015-11-04, and coins were defi­nitely be­ing moved by the ad­mins by 2015-11-06 .
Di­a­bo­lus/SR3 2014-10-13 2017-02-12 FALSE FALSE qxvfcavhse45ckpw.onion FALSE FALSE TRUE FALSE FALSE TRUE cus­tom FALSE FALSE 0 FALSE Cannabis-on­ly. Un­clear when it shut down so I as­sign it the same date as CM, which was op­er­ated by the same team.
Nu­cleus Mar­ket­place 2014-10-24 2016-04-13 FALSE scam FALSE nucleuspf3izq7o6.onion FALSE FALSE TRUE TRUE FALSE TRUE Lar­avel TRUE TRUE 0 FALSE Went down 2016-04-13 ac­cord­ing to DNstats & Red­dit. Ap­par­ent non-move­ment of mar­ket coins has prompted spec­u­la­tion about ar­rests, but no busts has been an­nounced as of 2016-08-18.
Abraxas 2014-12-13 2015-11-05 FALSE scam FALSE abraxasdegupusel.onion FALSE FALSE TRUE FALSE FALSE TRUE Lar­avel FALSE TRUE 0 FALSE fo­rums: abraxasgacelesox.onion Went down 2015-11-05 ac­cord­ing to DNstats and sev­eral months later the wal­let may’ve been drained.
Al­phaBay 2014-12-22 2017-07-05 FALSE raided TRUE pwoah7foa6au2pul.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE An­nounced on Red­dit
Silk Road Re­loaded 2015-01-13 2016-02-27 FALSE FALSE silkroadreloaded.i2p FALSE TRUE TRUE TRUE TRUE TRUE cus­tom FALSE TRUE 0 FALSE Full I2P ad­dress: hyn3mwmyeovcn2paujxur2eury2ufqpoahvbbqshfoggljn25tra.b32.i2p. I’m un­cer­tain when it closed - last sub­red­dit ac­tiv­ity 2016-02-27 but may have still been alive as of May 2016 or lat­er.
Tochka 2015-01-30 TRUE FALSE tochka3evlj3sxdv.onion FALSE FALSE TRUE TRUE TRUE TRUE cus­tom FALSE FALSE 0 FALSE An­nounced on Red­dit; site rules ban “Coun­ter­feit doc­u­ments” which I in­ter­pret as ban­ning card­ing in gen­er­al.
Crypto Mar­ket 2015-02-14 2017-02-12 FALSE scam FALSE cryptomktgxdn2zd.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE ANN; CM is run on / by Di­a­bo­lus and not en­tirely sep­a­rate. Ac­cord­ing to DNstat­s.net, Crypto Mar­ket was last ob­served up on 2017-02-12, but there are com­plaints in Jan­u­ary 2017 on Red­dit so I’m not sure when it re­ally went down. In any case, the es­crow funds ap­par­ently were not re­turned.
Mr Nice Guy 2 2015-02-21 2015-10-14 FALSE scam FALSE niceguyfa3xkuuoq.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 0 TRUE Op­er­a­tor claims dox­ing was just of “a vol­un­teer”. Went down Oc­to­ber 14, 2015 ac­cord­ing to DNstats.
The­Re­alDeal 2015-04-09 2016-10-22 FALSE FALSE trdealmgn4uvm42g.onion TRUE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE In­ter­view, ANN; fo­rums: forum5cijl4suew6.onion. Mul­ti­ple staffers were ar­rested & the site went down for a while but came back up, lead­ing to ques­tions about whether it had been sub­vert­ed. Last ob­served by DNstat­s.net on 2016-10-22. Un­clear why it shut down: LE, exit scam, or oth­er­wise? Or to what ex­tent its mul­ti­sig worked.
Oxy­gen 2015-04-16 2015-08-27 FALSE scam FALSE o2oxycuvnwxhv73e.onion TRUE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE TRUE 1 FALSE ANN. Was hacked around Jan­u­ary 2015 by a ven­dor ex­ploit­ing an early fi­nal­iza­tion bug to scam cus­tomers. Went down 2015-08-27 ac­cord­ing to DNstats.
East In­dia Com­pany 2015-04-28 2016-01-01 FALSE scam FALSE g4c35ipwiutqccly.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom FALSE FALSE 1 FALSE ANN; EU­-on­ly. Claims to’ve lost $9,958₿302015 to a hacker in early Au­gust 2015. EIC went down ~2016-01-01–2016-01-02 for a week or so, then a main­te­nance mes­sage, then came back up but with­drawals failed; fi­nal­ly, went down for good 2016-02-01 ac­cord­ing to DNstats.
Haven 2015-05-05 2015-06-06 FALSE scam FALSE havenpghmfqhivfn.onion FALSE FALSE TRUE FALSE FALSE FALSE cus­tom TRUE TRUE 0 FALSE ANN Went down 2015-06-06 ac­cord­ing to DNstats; not much dis­cus­sion of its clo­sure.
An­ar­chia 2015-05-07 2016-05-09 FALSE FALSE tkmlejimlt72jnkm.onion FALSE FALSE TRUE FALSE FALSE FALSE Bit­wasp TRUE TRUE 0 FALSE ANN. Still around 2015-07-09 judg­ing from spam for it; may have gone down 2016-05-09 for un­clear rea­sons. No dis­cus­sion of its clo­sure on Red­dit, DDW, The Hub, or I can find in Google.
Dark­net He­roes League 2015-05-27 2017-08-05 FALSE hacked FALSE darkheroesq46awl.onion FALSE FALSE TRUE FALSE FALSE FALSE 0 FALSE Not ex­plic­itly an­nounced. Dis­ap­peared after vul­ner­a­bil­i­ties & IP dis­closed.
Po­sei­don 2015-06-02 2015-06-29 FALSE scam FALSE poseidonzskufuwb.onion FALSE FALSE TRUE FALSE FALSE FALSE TRUE TRUE 0 TRUE Server de-anonymized by The­Re­alDeal ~2015-06-02 & was in Latvia. From the few men­tions of it after­wards, Po­sei­don ap­par­ently dis­abled with­drawals and then dis­ap­peared within a few months.
Ama­zon Dark 2015-06-08 2015-10-25 FALSE scam FALSE amazon435hm6h3ye.onion TRUE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE ANN. Around 2015-10-22–2015-10-25, com­plaints be­gan ap­pear­ing about ad­min­is­tra­tors not re­spond­ing & with­drawals fail­ing; for­mer spokesper­son says it was an exit scam; went down 2015-10-28, ac­cord­ing to DNstats.
Sim­ply Bear 2015-06-20 2015-10-21 FALSE scam FALSE llog4svhkcb5txld.onion FALSE FALSE TRUE FALSE FALSE FALSE FALSE TRUE 0 FALSE ANN. Went down 2015-10-21 ac­cord­ing to DNstats; no men­tions of whether it might’ve shut down ear­lier any­where else.
Hori­zon Mar­ket 2015-05-23 2015-07-08 FALSE scam FALSE horizon77qneerav.onion FALSE FALSE TRUE FALSE FALSE FALSE TRUE TRUE 0 FALSE Was French-only un­til mid-June 2015; open­ing date based on ear­lier last-seen dates for the low­est­-num­bered ven­dors. Dis­ap­peared some­time be­fore 2015-07-08, ac­cord­ing to the DDW changelog.

See also Deep­DotWe­b’s list (changelog), DNstats2, the DNM mar­ket list, and the Hid­den Wiki (last up­dated 2014-08-30).

DNM life­times, sorted by when a mar­ket opened, col­ored by how it closed.

I may add to the ta­ble other vari­ables; pos­si­bly use­ful ones:

  • 2-fac­tor-au­then­ti­ca­tion
  • Ven­dor PGP en­forced
  • FE sta­tus
  • ide­ol­o­gy: whether the op­er­a­tor seems ide­o­log­i­cal (I sus­pect SR1 may have lasted longer than most post-SR1 mar­kets be­cause Ul­bricht’s agorist ide­ol­ogy meant he was not profit-mo­ti­vated & re­fused to do an exit scam or shut­down when SR1 was be­ing ex­torted and may even have been run­ning at loss; but after watch­ing mar­kets in 2014-2015, it seems that such a vari­able is un­likely to be use­ful: Ul­bricht is the only one clearly ide­o­log­i­cal, and the rest seem to be ap­ing it or too quiet to tell. Just be­cause the op­er­a­tors say some­thing does­n’t mean they be­lieve it, and many say noth­ing.)
  • vol­ume (at what time?)
  • how much money was lost when the site scammed or was hacked (only rea­son­ably known for a few scam­s…)
  • ap­par­ent na­tion­al­ity of op­er­a­tor
  • me­dia cov­er­age
  • num­ber of em­ploy­ees (can offi­cial claims be trust­ed?)
  • manda­tory role sep­a­ra­tion (ful­ly-sep­a­rate buy­er/seller/ad­min/staff ac­counts)

Analysis

TODO:

“The death rate of bit­wasp mar­ket­places will al­ways be higher be­cause it low­ers the bar­rier of en­try to start­ing and launch­ing your own BTC mar­ket­place so less tech­ni­cal peo­ple with lesser funds to start the mar­ket­place will use it and that de­mo­graphic has a higher chance of fail­ure.”

From a pre­dic­tive stand­point, it does­n’t much mat­ter why Bit­wasp cor­re­lates with shorter life­times - whether it’s through greater like­li­hood of be­ing hacked or self­-s­e­lec­tion by weak-willed/poor/un­com­mit­ted/in­com­pe­tent op­er­a­tors. As long as it does, it’ll im­prove pre­dic­tions by pre­dict­ing shorter life­times for Bit­wasp-us­ing mar­ket­places, and so it’s less safe for buy­ers: even if the mar­ket­place is us­ing mul­ti­sig, there’s still some lim­ited scope for an exit scam; it wastes one’s in­vest­ment in learn­ing how to use a mar­ket­place; and sell­ers lose any bond they put up. (Mul­ti­sig is great and I’ve been ad­vo­cat­ing for it for a long time, but it’s not a sil­ver bul­let.)

In any case, I can try check­ing if us­ing Bit­wasp cor­re­lates with be­ing hacked, not just shut down. The sam­ple is cur­rently small enough that the re­sults won’t mean much re­gard­less, though.

library(XML)
library(RCurl)
html <- getURL("https://www.gwern.net/DNM-survival#table")
black <- readHTMLTable(html, colClasses = c("factor", as.Date, as.Date, "logical", "factor", "logical", "character", "logical", "logical", "logical", "logical", "logical", "logical", "factor", "logical", "logical", "integer", "logical", "character"))[[1]]
black[black$Codebase=="",]$Codebase <- "unknown"
black$Start <- as.Date(black$Start); black$End <- as.Date(black$End)
black[is.na(black$End),]$End <- Sys.Date() # assuming the table is up to date
black$Age <- black$End - black$Start
black$Age <- as.integer(black$End - black$Start)

# for some markets, these values are impossible to find: they were never decided on, or the market is gone
# there's only a few, so I'm not sure the complexity of multiple-imputation is worthwhile (MICE objects work with almost no libraries...)
# so for the 2 relevant columns so far, I do a simple impute of the median/mode value
black[is.na(black$Fraud),]$Fraud <- as.logical(median(black$Fraud, na.rm=T))
black[is.na(black$Guns),]$Guns   <- as.logical(median(black$Fraud, na.rm=T))

# for competing-risks modeling
levels(black$Closure) <- c("unknown", "hacked", "raided", "scam", "voluntary") # sets "" to "unknown"
black <- black[order(black$Start),]

library(survival)
# plot(survfit(Surv(Age, Alive, type="right") ~ 1, data=black), xlab="Days active", ylab="Fraction of markets still active")

# generate fancy timeline of DNM openings/closing:
library(ggplot2)
png(file="~/wiki/images/silkroad/marketlifetimes.png", width = 1200, height = 2500)
ggplot(black, aes(colour=Closure)) +
    geom_segment(aes(x=Start, xend=End, y=sort(decreasing=TRUE, reorder(Market,Start)), yend=sort(decreasing=TRUE, reorder(Market,Start))), size=3) +
    xlab("Open") + ylab("Market") + theme(legend.position="bottom", axis.text=element_text(hjust=1, size=20)) + scale_y_discrete(labels = sort(decreasing=TRUE, reorder(black$Market, black$Start)))
invisible(dev.off())

library(lubridate)
cmodel <- coxph(Surv(Age, Alive) ~ year(black$Start) + Multisig + I2P + Bitcoin+Litecoin+Dogecoin+Darkcoin + Codebase + Guns + Fraud + Hacks + Doxed, data = black, control=coxph.control(iter.max=10000)); cmodel

with(black, survdiff(Surv(Age,Alive)~as.factor(year(Start))))

cmodel2 <- coxph(Surv(Age, Alive) ~ as.factor(year(black$Start)) + ridge(Multisig, I2P, Bitcoin,Litecoin,Dogecoin,Darkcoin, Codebase, Guns, Fraud, Hacks, Doxed), data = black); summary(cmodel2)

cmodel <- coxph(Surv(Age, Alive) ~ strata(year(black$Start)), data = black); cmodel

black$URL <- black$Notes <- black$Market <- NULL

Ex­am­ple com­pet­ing-risks model us­ing startup data:

# http://blogs.wsj.com/venturecapital/2014/11/20/techstars-graduates-success-rates-what-the-numbers-show/
# data:application/octet-stream;charset=utf-8,Year%2C2007%2C2008%2C2009%2C2010%2C2011%2C2012%2C2013%2C2014%0AActive%2C2%2C2%2C7%2C15%2C36%2C68%2C121%2C120%0AFailed%2C3%2C4%2C5%2C11%2C9%2C10%2C5%2C0%0AAcquired%2C5%2C4%2C7%2C5%2C14%2C15%2C4%2C1
rates <- read.csv(stdin(),header=TRUE)
Year,2007,2008,2009,2010,2011,2012,2013,2014
Active,2,2,7,15,36,68,121,120
Failed,3,4,5,11,9,10,5,0
Acquired,5,4,7,5,14,15,4,1

library(reshape2)
rates2 <- melt(rates)
colnames(rates2) <- c("Status", "Year", "Count")
rates2$Year <- as.integer(substring(as.character(rates2$Year), 2))
startups <- NULL
for (i in 1:nrow(rates2)) { startups <- rbind(data.frame(Status = rep(rates2[i,]$Status, rates2[i,]$Count), Year=rep(rates2[i,]$Year, rates2[i,]$Count)), startups) }
library(survival)
startups$Alive <- startups$Status == "Active"
startups$Age <- 2014 - startups$Year
sf <- survfit(Surv(Age, Alive, type="right") ~ 1, data=startups); summary(sf)
#  time n.risk n.event survival  std.err lower 95% CI upper 95% CI
#     0    473     120  0.74630 0.020007     0.708099      0.78656
#     1    352     121  0.48976 0.023007     0.446680      0.53699
#     2    222      68  0.33974 0.022007     0.299236      0.38573
#     3    129      36  0.24493 0.020778     0.207412      0.28924
#     4     70      15  0.19245 0.020269     0.156552      0.23657
#     5     39       7  0.15790 0.020407     0.122571      0.20342
#     6     20       2  0.14211 0.021202     0.106083      0.19038
#     7     10       2  0.11369 0.024715     0.074248      0.17409
plot(sf)
# https://i.imgur.com/76B7AxN.png

library(cmprsk)
sc <- cuminc(startups$Age, startups$Status, cencode="Active"); sc
# Estimates and Variances:
# $est
#                       1            2           3           4           5           6
# 1 Acquired 0.0134537767 0.0791545678 0.172799416 0.223444079 0.321616811 0.397350061
# 1 Failed   0.0141745147 0.0579750421 0.118175302 0.229593560 0.299716940 0.375450190
#
# $var
#                         1              2              3             4             5             6
# 1 Acquired 3.62406271e-05 0.000301240943 0.000805565675 0.00118663857 0.00205862260 0.00275961348
# 1 Failed   3.97263451e-05 0.000220342717 0.000570181024 0.00140171794 0.00200661959 0.00272841167
plot(sc, lty=1, color=c(3,2))
# https://i.imgur.com/Tafk9B0.png

DNMs:

library(cmprsk)
blackc <- with(black, cuminc(Age, Closure, cencode="alive")); blackc
# Estimates and Variances:
# $est
#                       200           400           600           800          1000          1200
# 1 unknown   0.01136363636 0.02272727273 0.03409090909 0.07954545455 0.10227272727 0.11363636364
# 1 hacked    0.11363636364 0.11363636364 0.11363636364 0.11363636364 0.12500000000 0.12500000000
# 1 raided    0.01136363636 0.06818181818 0.06818181818 0.06818181818 0.07954545455 0.07954545455
# 1 scam      0.25000000000 0.35227272727 0.39772727273 0.39772727273 0.39772727273 0.39772727273
# 1 voluntary 0.22727272727 0.26136363636 0.26136363636 0.27272727273 0.27272727273 0.27272727273
#
# $var
#                         200             400             600             800            1000            1200
# 1 unknown   0.0001292408729 0.0002616701315 0.0003911601132 0.0008988554115 0.0011441139596 0.0013003690983
# 1 hacked    0.0011623540396 0.0011623540396 0.0011623540396 0.0011623540396 0.0012886980693 0.0012886980693
# 1 raided    0.0001292408729 0.0007494488199 0.0007494488199 0.0007494488199 0.0009089372449 0.0009089372449
# 1 scam      0.0021690847025 0.0026530347066 0.0028036544633 0.0028036544633 0.0028036544633 0.0028036544633
# 1 voluntary 0.0020307752901 0.0022406509916 0.0022406509916 0.0023107700306 0.0023107700306 0.0023107700306

plot(blackc, lty=1, color=c(1:5), xlab="Days")

# confidence intervals:

plot(blackc, col=c(1:5), lty=1, xlab="Days", curvlab=c('hacked','raided','scam','voluntary'))
for (i in 1:4){
    cltype <- names(blackc)[i]
    ctm <- blackc[[cltype]]$time
    cest <- blackc[[cltype]]$est
    cvar <- blackc[[cltype]]$var
    clo <- cest ^ exp(-1.96*sqrt(cvar)/(cest*log(cest)))
    chi <- cest ^ exp(1.96*sqrt(cvar)/(cest*log(cest)))
    lines(ctm[2:length(ctm)], chi[2:length(ctm)], col=i, lty=2, lwd=0.7)
    lines(ctm[2:length(ctm)],clo[2:length(ctm)] , col=i, lty=2, lwd=0.7)
}

for (FAIL in c("raided", "hacked", "scam", "voluntary")) {
    cat(FAIL,":\n")
    print(with(black, crr(Age, Closure, cencode="alive", maxiter=100,
                    cov1= black[,c("Multisig", "Hacks", "Doxed", "Fraud", "Guns", "I2P", "Bitcoin", "Litecoin", "Dogecoin", "Darkcoin")],
                    failcode=FAIL)))
    cat("\n")
    }
# raided :
# convergence:  TRUE
# coefficients:
#  Multisig     Hacks     Doxed     Fraud      Guns       I2P   Bitcoin  Litecoin  Dogecoin  Darkcoin
#   0.98020   0.32990   1.17200  -0.04558  -0.24180 -17.32000 -15.50000 -11.17000 -28.49000 -27.65000
# standard errors:
#  [1] 0.9436 0.4524 0.8089 0.8893 1.0400 1.4230 2.1440 1.3780 2.8650 2.4430
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  3.0e-01  4.7e-01  1.5e-01  9.6e-01  8.2e-01  0.0e+00  4.9e-13  4.4e-16  0.0e+00  0.0e+00
#
# hacked :
# convergence:  TRUE
# coefficients:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#   0.4371   0.7562   1.0860   0.4956   0.8256 -11.6700   2.8160 -10.2200  -8.0430 -10.9900
# standard errors:
#  [1] 0.7206 0.3491 0.7689 0.6925 0.7205 0.8449 1.4230 1.2160 2.1830 0.9428
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  0.54000  0.03000  0.16000  0.47000  0.25000  0.00000  0.04800  0.00000  0.00023  0.00000
#
# scam :
# convergence:  TRUE
# coefficients:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
# -0.10720  0.08057 -0.59050  0.43420 -0.71390 -1.00200 -2.03000 -1.22200 -0.67940  0.29050
# standard errors:
#  [1] 0.5164 0.2175 0.5461 0.3790 0.3868 1.1430 0.6974 0.8939 0.7397 0.4950
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#   0.8400   0.7100   0.2800   0.2500   0.0650   0.3800   0.0036   0.1700   0.3600   0.5600
#
# voluntary :
# convergence:  TRUE
# coefficients:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  -0.7029  -2.1160   0.2623  -0.9765   0.2492   2.1520   3.5960   1.8850  -7.7330 -13.3800
# standard errors:
#  [1] 0.5779 0.8878 0.6494 0.4879 0.4364 0.4149 1.3520 0.5346 1.9310 0.7828
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  2.2e-01  1.7e-02  6.9e-01  4.5e-02  5.7e-01  2.1e-07  7.8e-03  4.2e-04  6.2e-05  0.0e+00

Time-vary­ing con­founds: Mul­ti­sig, RoI, σ, hacked, doxed, sales… Solve with mul­ti­-s­tate mod­els? http://cran.r-pro­jec­t.org/we­b/­pack­ages/msm/vi­gnettes/msm-man­u­al.pdf / http://we­b.in­ter.n­l.net/user­s/rgeskus/­Com­pRisk.pdf

Predictions

# Generate predictions of shutdown in next 6 / 12 months for the still-running marketplaces:

# You are not expected to understand this ugly hack. I don't either. But it *seems* to work...
# for background, see https://www.gwern.net/Google-shutdowns & https://www.gwern.net/Silk-Road#the-bet-bmr-or-sheep-to-die-in-a-year-by-oct-2014
library(rms)
conditionalProbability <- function (d, followupUnits, cmodel) {
    chances <- rep(NA, nrow(d)) # stash results

    for (i in 1:nrow(d)) {

        # extract chance of particular subject surviving as long as it has:
        beginProb <- survest(cmodel, d[i,], times=(d[i,]$Age))$surv
        if (length(beginProb)==0) { beginProb <- 1 } # set to a default

        tmpFollowup <- followupUnits # reset in each for loop
        while (TRUE) {
            # extract chance of subject surviving as long as it has + an arbitrary additional time-units
            endProb <- survest(cmodel, d[i,], times=(d[i,]$Age + tmpFollowup))$surv
            # survival curve may not reach that far! 'survexp returns 'numeric(0)' if it doesn't;
            # so we shrink down 1 day and try again until 'survexp' *does* return a usable answer
            if (length(endProb)==0) { tmpFollowup <- tmpFollowup - 1} else { break }
        }

        # if 50% of all subjects survive to time t, and 20% of all survive to time t+100, say, what chance
        # does a survivor - at exactly time t - have of making it to time t+100? 40%: 0.20 / 0.50 = 0.40
        chances[i] <- endProb / beginProb
    }
    return(chances)
}
# we can't regress on '~ 1' because `survest` crashes inside `conditionalProbability` (‽),
# so let's just toss in all the covariates to make it work despite none of them being well-justified...
cpmodel <- cph(Surv(Age, Alive) ~ Multisig + Litecoin+Dogecoin+Darkcoin + Guns + Fraud, data = black, x=TRUE, y=TRUE, surv=TRUE)
# report in %s rather than raw probabilities for easier reading
black$SixMonth <- round(digits=1, conditionalProbability(black, round(365/2), cpmodel) * 100)
black$OneYear  <- round(digits=1, conditionalProbability(black,          365, cpmodel) * 100)

## Predictions from 2015-01-02:
subset(black, Alive, select=c("Market", "SixMonth", "OneYear"))
#                      Market SixMonth OneYear
# 56             Dream Market    100.0   100.0
# 57                    Agora     65.6    65.6
# 58            Outlaw Market     72.3    72.3
# 59                evolution     17.5    17.5
# 60         BlackBank Market     13.1    13.1
# 61                   Area51     57.7    28.1
# 62 Middle Earth Marketplace     56.8    28.8
# 63                 Diabolus     34.7     0.0
# 64      Nucleus Marketplace     15.7     0.0
# 65                  Panacea     89.7    34.4
# 66                  Abraxas     85.9    51.2
# 67                 AlphaBay     92.5    48.4
## Evaluation: Agora/evolution/BlackBank/Area51/MEM/Nucleus/Panacea/Abraxas were all dead by August 2016.

## Predictions from 2016-08-18:
#                   Market SixMonth OneYear
# 67          Dream Market    100.0   100.0
# 69         Outlaw Market      0.0     0.0
# 74              AlphaBay    100.0     0.0
# 76                Tochka     53.7    53.7
# 77                Crypto     58.3    58.3
# 79           TheRealDeal      4.1     4.1
# 84 Darknet Heroes League     44.7    44.7

See Also

Appendix

Return & volatility

dead <- as.Date(c("2013-10-02","2013-12-02","2013-09-20","2013-11-29","2013-11-04",
                  "2013-10-20","2013-10-28","2013-12-22","2014-01-01","2014-01-05",
                  "2014-02-01","2014-02-01","2014-02-07","2014-02-06","2014-02-04",
                  "2014-02-07","2014-02-11","2014-02-01","2014-03-23","2014-02-17",
                  "2014-03-24","2014-02-28","2014-03-13","2014-02-01","2014-02-28",
                  "2014-03-28","2014-03-01","2014-04-07","2014-04-19","2014-04-20",
                  "2014-04-20","2014-03-20"))
live <- as.Date("2014-04-24") # yesterday, default for live markets
volatility <- read.csv("http://btcvol.info/csv",
                       colClasses=c("Date","numeric","numeric","numeric", "numeric"))

# 30-day return
sapply(dead, function(d) { post   <- volatility[volatility$date==d,]$price;
                           pre    <- volatility[volatility$date==(d - 30),]$price;
                           return <- ((post - pre)/pre);
                           round(return, digits=3) } )
 [1] -0.216  4.170  0.103  4.759  0.859  0.327  0.506 -0.173 -0.258  0.127  0.056  0.056 -0.182
[14] -0.033 -0.104 -0.182 -0.233  0.056 -0.014 -0.263 -0.031 -0.351 -0.047  0.056 -0.351 -0.129
[27] -0.334 -0.275 -0.145 -0.129 -0.129 -0.056
sapply(live, function(d) { post   <- volatility[volatility$date==d,]$price;
                           pre    <- volatility[volatility$date==(d - 30),]$price;
                           return <- ((post - pre)/pre);
                           round(return, digits=3) } )
[1] -0.141

# 30-day volatility
sapply(dead, function(d) { round(volatility[volatility$date==d,]$volatility, digits=3) } )
 [1] 0.018 0.102 0.024 0.093 0.035 0.056 0.063 0.127 0.118 0.109 0.047 0.047 0.030 0.031 0.043 0.030
[17] 0.032 0.047 0.046 0.040 0.045 0.048 0.057 0.047 0.048 0.052 0.049 0.046 0.074 0.075 0.075 0.050
tail(volatility$volatility,n=1)
[1] 0.07408

  1. There are a fair num­ber. An in­com­plete list as of mid-2014:

    • Finnish: Silkki­tie: http://silkkitiehdg5mug.onion
    • French: French Dark Place 2.0: http://ruzh5shkcme2tpfk.onion
    • Pol­ish: Tore­pub­lic Mar­ket: http://nco5ranerted3nkt.onion/forum/market.php; Fo­rum: http://nco5ranerted3nkt.onion/forum/
    • Rus­sian: Ramp: http://ramp2bombkadwvgz.onion
    • Rus­sian: Hy­dra Mar­ket: http://hydraruehsdjjfud.onion/ (not to be con­fused with the Hun­gar­ian Hy­dra busted in Ony­mous)
    • Ital­ian: http://babylonxjrtdyomy.onion (Baby­lon was raided in late July 2015)
    • Swedish: flugsvamp: http://yakwbcn5ou2wkzfx.onion
    • Magic Shop
    ↩︎
  2. His­tor­i­cal archive of DNstat­s’s sta­tis­tics is avail­able in my .↩︎