2019 Darknet Market Turmoil: Seizures, Exit Scams and DDoS Disruptions
Summary
A 2019 overview traces darknet market closures, alleged exit scams, law-enforcement seizures and arrests, DDoS disruptions, and shifts to alternative services, while noting uncertainty around some claims and the volatile status of active markets.
Key points
- Europol reported a multinational operation that led to 61 arrests and the confiscation of 50 dark-web accounts; the article says a connection to Dream Market was not confirmed.
- Dream Market announced its closure after prolonged DDoS attacks. Users reported withdrawal problems and moderator scams, while claims of law-enforcement infiltration remained unconfirmed.
- Wall Street Market administrators and a moderator were arrested after an estimated $11–15 million exit scam. The article describes investigators using wallet tracing, provider records, and access evidence in the investigation.
- Finnish Customs, working with French police, seized the Valhalla (Silkkitie) marketplace. DeepDotWeb administrators were arrested over alleged kickbacks for referring users to darknet markets.
- DDoS attacks and suspected phishing disrupted markets and user support. Empire users reported wallet losses, while claims that the market had exit-scammed and that its 2FA was easily bypassed were attributed to others.
- Libertas moved from Tor to I2P and then shut down, citing low I2P use. The article describes continued market turnover and direct encrypted trading as users sought alternatives.
Article Details
- Event Type
- Roundup of darknet marketplace disruptions, alleged exit scams, and law enforcement seizures and arrests.
- Impact
- Authorities seized marketplaces and arrested people connected to Wall Street Market and other investigations. Wall Street Market users reportedly lost access to funds during an alleged exit scam, while DDoS attacks and market closures disrupted access and pushed users toward other marketplaces or direct encrypted communications. The article also describes continuing uncertainty about the status of several markets.
MITRE ATT&CK
People
Jonathan KALLAIdentified as WSM administrator and arrested by German authorities in connection with the marketplace investigation; the article says he later admitted being the administrator known as Kronos.Klaus-Martin FROSTIdentified as WSM administrator and arrested by German authorities in connection with the marketplace investigation; the article gives theone as his moniker.Marcos Paulo De Oliveira-AnnibaleIdentified in the article as WSM moderator Med3l1n; arrested by German authorities after allegedly blackmailing vendors and buyers.Tibo LOUSEEIdentified as WSM administrator and arrested by German authorities in connection with the marketplace investigation; the article gives coder420 as his moniker.
Threat Actors
coder420The article identifies coder420 as the moniker of WSM administrator Tibo LOUSEE.Jonathan KALLANamed as a WSM administrator arrested in connection with the marketplace investigation and alleged exit scam; the article identifies Kronos as his moniker.Klaus-Martin FROSTNamed as a WSM administrator arrested in connection with the marketplace investigation and alleged exit scam; the article identifies theone as his moniker.KronosThe article identifies Kronos as the moniker of WSM administrator Jonathan KALLA.Marcos Paulo De Oliveira-AnnibaleThe article identifies him as WSM moderator Med3l1n and reports that he allegedly blackmailed vendors and buyers.Med3l1nThe article identifies Med3l1n as the moniker of Marcos Paulo De Oliveira-Annibale, who allegedly blackmailed WSM vendors and buyers.theoneThe article identifies theone as the moniker of WSM administrator Klaus-Martin FROST.Tibo LOUSEENamed as a WSM administrator arrested in connection with the marketplace investigation and alleged exit scam; the article identifies coder420 as his moniker.
Products
DeepDotWebOn the 6th of May, two DeepDotWeb (DDW) administrators were arrested facing charges of kickbacks by earning millions in commission by referring users to specific darknet marketplaces.DreadFigure 2 Source: Dread Forum on Tor (/post/52f54402d99bd51d4b74)Dream MarketDream Market Announces Closure & Never ReturnsLibertasLibertas Moved to I2P Then Shutdown due to InactivityValhallaFinnish Customs Seizes Valhalla (Silkkitie)Wall Street MarketWall Street Market Exit Scams Then BKA Announces Seizure
Countries
BrazilWithin days, Med3l1n, identified as Marcos Paulo De Oliveira-Annibale, 29, of Sao Paulo, Brazil, was arrested by German authorities along with the three market administrators, all from Germany: GermanyWithin days, Med3l1n, identified as Marcos Paulo De Oliveira-Annibale, 29, of Sao Paulo, Brazil, was arrested by German authorities along with the three market administrators, all from Germany: Netherlandsattempts succeeded, but days later, Med3l1n also published an IP address for a server located in the Netherlands and login credentials for the WSM backend on a popular darknet forum knownas Dread.United StatesAll three face charges in both Germany and the United States after a series of missteps in their operational security led authorities to their IP and physical addresses.