Drugs, guns, credit card details and malware are what most people typically associate with the darknet. All of which are certainly present. But market volatility is one feature of the darknet which is less frequently discussed.
Ever since Silk Road was shut down by the FBI in 2013, darknet markets have come and gone, rising in prominence before falling into obscurity. Some, such as AlphaBay or Hansa last for several years; others last only a few months. But no matter how large a market is, the result is always the same. The market shuts down, leaving its users in flux and creating volatility within the darknet community.
Sometimes these shutdowns are the result of a market admin choosing to quit while they are ahead. Often, this takes the form of exit scamming, where the admins shut down their market and steal all the cryptocurrency held in escrow. While escrow was originally intended to enforce honour among thieves, it has also increased volatility by incentivising exit scams.
In other cases, these shutdowns stem from law enforcement operations. Market admins recognise that they are a target for law enforcement: the longer a market is active, the greater the risk to those running it. Faced with this dilemma, most admins choose to exit scam before they can be caught; essentially jumping before they are pushed.
Apollon’s exit
Another factor which increases market volatility is the continual DDoS attacks which target darknet platforms. Often, these attacks are so persistent they take multiple darknet platforms offline for weeks at a time.
This was the case at the start of 2020 when persistent DDoS attacks caused significant market volatility. Popular markets including Apollon and Empire, as well as popular forums such as Dread (the darknet’s Reddit), were all taken offline for extended periods. During this time, users were forced onto smaller markets or into buying from vendors directly without the protection of escrow. It is unclear who was behind these attacks, but the broad targeting of all major darknet platforms potentially indicates law enforcement involvement.
By late January, these attacks had begun to subside and on 28 January, Dread resurfaced after 20 days of downtime. However, the darknet community was soon hit by another crisis: on the same day as the reappearance of Dread, a post was made claiming that Apollon was exit scamming. Subsequently, numerous vendors were locked out of their accounts, meaning they could not withdraw their cryptocurrency from the market. Moreover, users were still able to log in and make escrow payments for products, allowing the admin to maximise their market holdings.
Within days of this post, the DDoS attacks started again, albeit on a smaller scale. Most major forums were taken offline, as were some markets. The prevailing opinion among users is that these were carried out by the Apollon admins to prevent news of their exit scam from spreading. With major forums offline and a popular market potentially exit scamming, the darknet was left in chaos.
Empire’s gain
Once the DDoS attacks once again began to abate, it became clear the preceding volatility had caused a significant shift in market dynamics. Prior to its exit scam, Apollon had been competing with Empire to be the most popular darknet market. Indeed, many users preferred Apollon due to its more consistent uptime. Recent estimates placed its market value at over $10 billion. With Apollon out of the way, however, it became clear that Empire now has no serious rivals.
The Empire admin recently announced they now have over 1 million users. This achievement is particularly impressive given the market’s general unreliability. Despite being active for over two years, Empire is often unavailable for hours at a time and admin support regarding disputes is virtually non-existent. The fact that Empire remains so popular despite these issues illustrates just how poor the quality of market competition currently is on the darknet. In the short-term, this is unlikely to change. But in the long-term, as noted above, the market will either be taken down by law enforcement or the admins will choose to exit scam.
Smaller markets have also been affected by Apollon’s exit scam and the subsequent volatility. White House, originally considered a second-tier market in terms of popularity, has seen a rise in both vendors and users. It is now potentially the second most popular market, although it still lags far behind Empire. There has also been a glut of new markets appearing, including Cypher, Kingdom and Europa. Of these, Europa is noteworthy as it permits the sale of firearms and appears to be growing rapidly, although this is not always a guarantee of longevity.
These effects are a normal reaction to market volatility on the darknet. When a popular market shuts down, its users disperse. This results in either rival markets gaining in popularity, or new markets appearing to meet the increased demand. Eventually, users coalesce around a few key markets, which gain increasing popularity and the cycle begins again.
Temporary solutions to permanent problems
It is widely accepted among the darknet community that markets are not a permanent fixture. Nevertheless, this cycle of volatility is particularly damaging for vendors. Due to the need for anonymity, a good reputation for vendors, built up through reviews and ratings, is essential to success. Consequently, there is a need for vendor reputation not to be tied to a specific market that will ultimately prove unreliable.
One recent solution to this problem has been Recon, the much-anticipated market search engine service created by the founder of Dread. Recon allows users to search for a specific product or vendor across a range of markets, both past and present. A profile is generated for each vendor, providing an average rating and total number of sales across all markets they are active on. This will make it easier for users to locate reliable vendors, despite the ever-present market volatility. However, Recon will also likely be targeted by law enforcement, either through DDoS attacks or to track specific vendors of interest. Moreover, for all its benefits to both vendors and users, Recon does not address the fundamental issue of market volatility.
Another possible solution is private vendor shops and vendors selling directly to users through instant messaging platforms. The rise in this amongst vendors insulates them from the costs of market admins taking commission and means they are less beholden to unreliable markets. However, most vendors will need to build up a strong reputation on conventional markets before they can successfully operate independently. Consequently, this solution largely favours established vendors, who face a similar dilemma to market admins and may also choose to quit while they are ahead.
What’s to come in Q2?
Illegal markets selling drugs, guns, credit card details and malware will always be associated with the darknet. However, it is worth noting how this hidden world of commerce is still subject to the same market forces as legitimate businesses around the globe. Reputation and trust are paramount.
As demonstrated by the first few weeks of 2020, market volatility on the darknet is likely to persist. The use of escrow is necessary for building trust between anonymous individuals, but it also facilitates exit scamming. Coupled with the ever-present risk of law enforcement attention, there is a clear incentive for admins to pre-emptively shutdown their markets before they are caught. Recently, another smaller market, Avaris, shutdown without any warning. That this is not at all unusual on the darknet illustrates just how pervasive market volatility is.
Even if a shutdown proves only temporary, any market that does resurface is generally avoided by users due to the fears of law enforcement ‘honey-traps’. The role this paranoia plays in increasing market volatility is arguably the most enduring triumph of law enforcement operations. Were Empire to shut down in a similar manner, the impact would prove far more significant and the endless cycle of market volatility would begin again.