Note: There is a newer update to this article, available here.
Even as dark market vendors are ensnared in sting operations, dark markets persist — now in their third generation, they’re smaller than ever but continue to adapt and evolve.
Operation Bayonet
Just over a year ago, a bright 25-year-old programmer named Alexandre Cazes hanged himself in a Bangkok prison cell. Known as kind, intelligent and soft-spoken by his family, Cazes was the kingpin behind AlphaBay Market, the world’s largest-ever dark web marketplace. At its height, AlphaBay Market boasted over 400,000 members. It offered a selection of products ranging from cocaine and fentanyl to compromised account credentials, firearms and fullz.
The financial success that Alphabay Market once enjoyed catapulted Alexandre Cazes from introverted teenager to international playboy. He drove exotic cars, owned lavish real-estate properties, and enjoyed short-lived encounters with multiple women. Cazes even documented his exploits on the controversial “PUA” or “pickup artist” forum, RooshvForum, under a pseudonym, where he shared stories of cheating on his Thai wife multiple times.
But in 2014, Cazes made a fatal OPSEC mistake. By including his personal clearnet e-mail address in automated welcome messages and password reset e-mails to AlphaBay Market users, Cazes provided law enforcement with a link to his online personas. That e-mail address, “pimp_alex_91@hotmail.com”, would tip off the investigators in the internationally-coordinated Operation Bayonet against dark web markets. Investigators were ultimately able to link that e-mail address to Cazes, who was charged with a multitude of crimes ranging from racketeering and money laundering to narcotics distribution and identity theft. These charges resulted from both the services offered by AlphaBay as well as the revenue generated by its activities. Hours short of his scheduled extradition from Thailand to the United States, Cazes took his own life. At its height, AlphaBay was over 10 times larger than Silkroad. Cazes had accumulated over $35 million in assets, which he split between multiple offshore accounts.
Operation Bayonet also took down Hansa, the second-largest dark net Market after AlphaBay, in July 2017. Despite these seizures, dark web criminal enterprises have not disappeared. The initial aftermath of the AlphaBay seizure led well-known personas on dark net markets to flock to an unlikely place. The r/DarkNetMarkets SubReddit, which has since been banned from Reddit for soliciting prohibited goods and services, served as the initial forum for AlphaBay refugees to regroup. Many of the new handles that began to converge upon dark web-themed subReddits were easily recognizable from AlphaBay. Well known drug vendors, fraudsters and even some former AlphaBay admins (such as “BigMuscles” and “Trappy”), could be seen posting on the site and answering questions from frantic users who suspected an exit scam. The former AlphaBay vendors soon disappeared from Reddit as news of AlphaBay’s takedown was announced. What would have before been an egregious violation of common sense OPSEC became the only way for the AlphaBay community to regroup, outside of direct communications. After the r/DarkNetMarkets SubReddit was banned in June 2018, a new [.]onion Reddit-like alternative gained visibility. Called Dread, the new community served as a landing pad for former AlphaBay and Hansa members.
How Markets Have Changed
The term “dark web” first entered the popular vernacular with the inception and eventual fall of Silkroad in 2013. Ross Ulbricht, the mastermind behind that marketplace, was also charged with a slew of crimes in the fashion of Alexandre Cazes. Unlike Cazes, Ulbricht is alive, spending the remainder of his lifetime at the Florence High Penitentiary in Colorado. At its height, Silkroad had over one million users. Silkroad’s fall gave way to large second-generation markets like AlphaBay and Hansa. It would only be a matter of time until those markets fell too.
Alphabay and its ilk comprised the second-generation of dark markets. After these markets were seized, the savviest of fraudsters often preferred to sell dumps directly to their most-trusted clients rather than to random customers of dark net marketplaces. With the inception of the Dread forum, criminals can network and form new relationships with potential customers, allowing for the opportunity of more direct sales.
In the example below, a vendor took to Dread to discuss his new business. The vendor says he is new but he probably sold on AlphaBay or Hansa before. Likely wary of law enforcement, he says that he will sell first to “trusted members” before opening his own shop. According to the indictment against Alexandre Cazes, several of the market’s drug vendors were ensnared in sting operations by buyers who were able to trace packages back to their owners.
“I’m just here for the drugs and chat,” said the member. “There’s a site-wide rule you must’ve missed: No on-site trades/transactions of any sort. But it’s not Reddit so no one’s getting in trouble except you lol.”
The post below, taken from Reddit, includes a link to the Dread onion forum and suggests Redditors who may violate Reddit’s new policies against the solicitation of forbidden goods do business there instead.
Some Dread members are attempting to sell their goods on Dread directly, although the site has a policy against such transactions. However, the new policy doesn’t forbid members from promoting their businesses on the site. The advertisement below, for UK fullz, prompts members to buy from him on the Wall Street Market, a smaller dark net market which is still operational after the seizures.
After the fall of AlphaBay, however, new “AlphaBay Clone” markets have also emerged.
Perhaps the most perplexing of these new markets is the so-called Empire Market. The resemblance between Empire and AlphaBay is uncanny. Empire market, much like AlphaBay, includes a nearly identical design.
The striking resemblance between the two markets begs the question of whether or not the new owners were once involved with AlphaBay’s administration. If this market is legitimate (rather than a honeypot), Empire’s administrators are probably living with an unhealthy level of paranoia.
The Dread forum has a section dedicated to the Empire Market titled “Why did Empire choose to clone AlphaBay and not Hansa.”
“AlphaBay was the most popular market at the time. We knew it better than Hansa. We liked the design so we brought it back.”
Empire Market’s admin is particularly reticent in their public discussions with forum members.
Empire Market currently has less than 1,500 members as opposed to AlphaBay’s once 400,000. Although most legitimate vendors are still trading within trusted groups, it’s not uncommon now to see a buyer post his or her Wickr or Jabber alias to discuss a transaction privately. However, less-experienced criminals are more likely to take a “leap of faith” opportunity cost in order to start making money. These fraudsters are therefore more likely to post a public advertisement on a forum such as Dread or on a newer market such as Empire. Regardless, criminals of all experience levels are wary now after the Interpol bust of all the major markets of yesteryear, and that definitely shows given the amount of members on Empire’s only 1,500.
The Dread forum also hosts advertisements for drug-specific shops such as the ones below.
What’s Next
It will take some time to see if markets like Empire will gain traction, and if new markets will come online. Dread threads dedicated to each market provide helpful insights into issues customers and vendors alike are having, which helps prospective buyers choose the markets they prefer. Although it’s too soon to say if new markets will ever rise to a fraction of the glory AlphaBay once enjoyed, Empire is certainly a market to watch.
The convergence of new, third-generation markets upon the dark web represents a paradigm shift in how goods are bought and sold on the dark web. However, history tells us that no market lasts forever. The first major dark web market, Silkroad, was taken down along with its kingpin. AlphaBay Market, successful as it was, did not survive either. If the new markets that are starting to materialize in response to the fall of AlphaBay do represent one thing, it’s criminals’ tenacity. Even as dark market vendors are ensnared in sting operations, even as their founders kill themselves—the dark web continues to adapt and evolve. Only time will tell as the game of “whack-a-mole” with new markets will continue as it has thus far.
