Darknet Market Exit Scams — Complete History of Rug Pulls and How to Spot the Next One

On March 23, 2023, users of the darknet market Incognito Market woke up to find their vendor balances frozen under the pretext of a “system upgrade.” Within 72 hours, roughly $30 million in escrow funds had vanished. The admin, going by the handle “Pharaoh,” posted a single message on Dread claiming technical issues before the entire forum thread was deleted and the market went permanently offline. It was one of the largest exit scams in darknet history, and it followed a pattern that has repeated itself with brutal consistency since 2014.

Background — A Decade of Disappearing Markets

The history of darknet exit scams begins with Sheep Marketplace in November 2013, when approximately 5,400 BTC (worth around $40 million at the time) disappeared overnight. Before that, the original Silk Road had operated for nearly three years without an exit scam — though its closure came via FBI seizure rather than operator betrayal. The post-Silk Road era saw a rapid succession of markets: Agora, Evolution, Nucleus, Abraxas, Hansa, AlphaBay, Dream Market, Wall Street Market, and Empire.

Evolution Market set a particularly damaging precedent in March 2015. Operators “Verto” and “Kimble” disappeared with an estimated $12 million in user funds while the market was still actively processing transactions. What made Evolution’s collapse especially painful was its timing — the market had recently transitioned to a fully centralized escrow model, meaning users had no recourse when the admins vanished. After Evolution, trust in centralized escrow never fully recovered, and the community began gravitating toward markets that offered multisignature (multisig) payment options as a countermeasure.

By 2019, Empire Market had absorbed much of the displaced user base. Empire operated for nearly two years before its own exit scam in August 2020, when roughly 2,638 BTC (approximately $30 million) was siphoned from hot wallets. The pattern repeated again with White House Market’s voluntary shutdown in October 2021 — though that closure was a planned exit, not a scam, with admins reportedly returning escrow balances to users. Cannazon followed in November 2021 with a similar planned closure, though smaller markets like ToRReZ and Monopoly Market have continued operating intermittently since.

Features of an Exit Scam — How Operators Cash Out

Exit scams follow recognizable technical patterns. The most common involves draining the market’s hot wallet — the Bitcoin or Monero balance that holds active escrow funds — and routing the proceeds through a chain of mixing services or noncustodial swaps. Monero (XMR) has become the preferred exit currency because its opaque blockchain makes tracing far more difficult than Bitcoin’s transparent ledger. Several major exit scams since 2020 have been XMR-denominated specifically for this reason.

Another pattern involves “exit fraud” through gradual withdrawal throttling. Rather than disappearing overnight, an admin will introduce withdrawal delays — first 24 hours, then 72 hours, then “pending manual review” — while continuing to accept new deposits. Users who don’t withdraw their funds during this window lose everything when the market finally goes offline. This technique was reportedly used by the operators of Bitbazaar before its 2022 disappearance.

Some markets combine exit scams with law enforcement exit. In these cases, the admin may cooperate with investigators or simply use the seizure as cover for a partial theft — keeping a portion of the funds while the rest is officially “seized.” The 2017 AlphaBay takedown involved allegations that one of the admin’s moderators had been skimming funds for months before the FBI operation. The line between exit scam and exit seizure is often blurrier than official reports suggest.

Security Model Red Flags — What to Watch Before It Happens

Several operational signals consistently precede exit scams. The most reliable indicator is a sudden change in withdrawal policy. When a market that previously processed withdrawals within 24-48 hours begins requiring 72+ hour holds or “manual verification,” the countdown has typically begun. Users who notice this pattern should withdraw funds immediately, regardless of any official explanation.

Another red flag is the disappearance of the market’s PGP-signed announcements. Legitimate admins sign their Dread posts and market notifications with their PGP key, allowing users to verify authenticity. When a market stops signing announcements — or switches to a new key without proper verification — it often signals that admin accounts have been compromised or that the original operator has sold the market to a third party. Several markets in 2022-2023 were sold to new operators who then ran exit scams within months of acquisition.

Unusual server behavior also serves as an early warning. Markets preparing for exit often experience brief outages as the admin migrates funds to cold storage or converts cryptocurrency holdings. If a market goes offline for maintenance and returns with different Tor mirror addresses or modified terms of service, treat this as a major warning sign. The market may have been resold, and the new operator may be preparing an exit.

User Experience During the Collapse

Users caught in exit scams typically lose funds in three categories: direct escrow balances, vendor bonds (if the market uses a bonding system), and any cryptocurrency held in the market’s internal wallet. Recovery is rare. Because the markets operate outside legal frameworks, there is no formal dispute resolution and no insurance mechanism. The community response is usually limited to post-incident analysis on Dread and Reddit’s r/darknet, where researchers attempt to trace the stolen funds.

The psychological impact is significant. Users who lose substantial sums often become targets for “recovery scams” — secondary operations that promise to retrieve lost funds for a fee. These recovery scams are themselves a form of fraud, preying on victims who are desperate to recoup losses. Legitimate researchers do not charge for tracing services, and any DM offering fund recovery should be treated as another scam attempt.

Reputation and Trust — Which Markets Have Survived

Markets that have operated for more than two years without an exit scam are rare. Among the current generation, Torzon Market has maintained continuous operation since its 2022 launch, with consistent uptime and a reputation for processing withdrawals reliably. DarkMatter has similarly avoided major incidents, though its smaller vendor base limits liquidity. Nexus Market operates with a multisig escrow option that reduces operator trust requirements, and DrugHub has built a reputation on strict vendor vetting.

The historical track record matters more than any current feature. A market that has survived multiple law enforcement operations, DDoS attacks, and phishing campaigns demonstrates operational resilience that newer markets cannot claim. Markets like Torzon that have weathered multiple crisis events — including the recent phishing wave documented in security advisories — have earned trust through demonstrated reliability rather than promises.

Current Status — The 2024-2025 Landscape

The current market environment shows elevated exit scam risk. Several smaller markets have disappeared in the past 18 months, including remnants of the Empire user base that migrated to markets which subsequently failed. The pattern of acquisition-and-exit has accelerated, with established market brands being purchased by unknown operators who run them for 6-12 months before executing exits.

Phishing operations have also intensified. Fake mirror sites impersonating legitimate markets have become increasingly sophisticated, using identical UI elements and even valid PGP keys scraped from older Dread posts. The Torzon phishing wave documented in early 2025 demonstrated how convincing these clones can be — complete with functional login forms that capture credentials and 2FA codes. Users who don’t verify mirror addresses through multiple independent sources remain vulnerable.

Market Comparison

Conclusion — Practical Steps to Reduce Risk

Exit scams remain the single largest risk in darknet market participation, exceeding even law enforcement seizure in terms of total user losses. The historical pattern is clear: markets that introduce withdrawal delays, change PGP keys without verification, or experience unexplained downtime are exhibiting classic pre-exit behavior. Users who monitor these signals and withdraw funds promptly when they appear can substantially reduce their exposure.

The most reliable protection is operational discipline. Never store funds in a market wallet longer than necessary. Use markets that offer multisig escrow when possible. Verify all mirror addresses through multiple independent sources before logging in. And treat any market promising unrealistic returns or offering “too good to be true” deals with the skepticism such offers deserve — because in the darknet, that instinct is usually correct.