2025 Takedowns and Exit Scams Fragmented Dark-Web Crime Forums and Markets
Summary
A 2025 review of law-enforcement takedowns, arrests, exit scams, and platform crackdowns that fragmented underground forums and markets and pushed some criminal activity to other platforms.
Key points
- A multinational operation targeted XSS in 2025, leading to an administrator’s arrest and seizure of the forum’s infrastructure; users later dispersed to other forums.
- BreachForums faced repeated seizures and shutdowns, while uncertainty over successor sites heightened users’ concerns about law-enforcement monitoring and honeypots.
- Authorities seized Archetyp Market infrastructure and arrested a suspected administrator; Abacus Market instead appeared to disappear with users’ funds after withdrawal problems.
- Telegram bans disrupted channels and services linked to illicit activity, while criminal actors also used encrypted messaging, private forums, and surface-web sites.
- The article says shorter-lived markets, exit-scam risk, and platform migration make underground activity more fragmented and harder for analysts to monitor.
Article Details
- Event Type
- Review of 2025 law-enforcement takedowns, marketplace exit scams, and platform enforcement affecting dark-web forums and illicit markets.
- Impact
- The takedowns and scams disrupted criminal forums and marketplaces, led to arrests and potential collection of user data, and caused financial losses for market users. Criminal communities remained active but became more fragmented, distrustful, and likely to move across forums and mainstream platforms.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | breached[.]vc | Domain associated with BreachForums v1, a forum used for data-breach leaks, credential trading, and related cybercrime. |
| DOMAIN | breachforums[.]st | Domain of a BreachForums-branded criminal forum described as a successor to earlier versions. |
People
Threat Actors
Products
DiscordWhen Tor markets are unstable, actors move to, encrypted messaging apps (Telegram, Signal, Threema), private Discord servers and niche forums and invite-only groups or even surface web sites.MyBBOne BreachForums instance announced it was closing after operators claimed law enforcement had exploited a 0-day in MyBB (their forum software) to gain access.SignalWhen Tor markets are unstable, actors move to, encrypted messaging apps (Telegram, Signal, Threema), private Discord servers and niche forums and invite-only groups or even surface web sites.TelegramBut they were only part of a much larger story that included major markets like Archetyp and Abacus, plus “shadow markets” on platforms like Telegram.ThreemaWhen Tor markets are unstable, actors move to, encrypted messaging apps (Telegram, Signal, Threema), private Discord servers and niche forums and invite-only groups or even surface web sites.
Countries
FranceLaw enforcement agencies in France and Ukraine, supported by Europol, targeted XSS after a multi-year investigation which began in 2021.GermanyFrom June 11–13, 2025, Operation Deep Sentinel, led by Germany’s BKA and supported by Europol, Eurojust, Homeland Security Investigation (HSI) and law enforcement from five other countries, executed a coordinatedNetherlandsServers were seized in the Netherlands, digital assets frozen, and the suspected site administrator, a 30-year-old German, was arrested in Barcelona.UkraineLaw enforcement agencies in France and Ukraine, supported by Europol, targeted XSS after a multi-year investigation which began in 2021.