OAK — OnChain Attack Knowledge

Worked example · 2011-20

Darknet Marketplace Operations and Takedowns Cohort — 2011–2025 — 9 Landmarks

OAK Techniques observed
OAK-T5.005, OAK-T7.001, OAK-T7.002, OAK-T8.001
Attribution
unattributed (aggregate cohort of 9 darknet marketplace operations by multiple operators).
Loss
Aggregate operator revenue in the billions of dollars across the darknet-marketplace ecosystem since Silk Road's launch in 2011. Silk Road sales were about $1.2B (2011–2013) [cohsilk]; the earlier "$5B+" Hydra volume figure is unsourced here. Exit-scam losses to market users: Sheep Marketplace (admins claimed 5,400 BTC stolen by a vendor; users traced a flow of 39,918 BTC, about $40M; a ~$100M figure is an unverified estimate by online sleuths) [cohsheep]; Evolution (~$12M in escrow reported, not re-verified here); Wall Street Market (about $14.2M in cryptocurrency reportedly taken before the takedown) [cohwsm]. Law-enforcement-seized assets: Silk Road (144,000 BTC, about $28.5M, reported by the FBI 2013-10-25 [cohsilk2]), Hydra (543 BTC, over $25M, seized by German BKA [cohhydra]).
Key teaching point
Darknet marketplaces are the original crypto-native illicit-economy infrastructure — their operational model (escrow-based, commission-on-transaction, vendor-bond-gated) predates DeFi and established the structural on-chain patterns that later appeared in DeFi rug pulls and exit scams. The darknet-market lifecycle is well-characterised: launch → vendor/buyer liquidity accumulation → operator commission extraction (ongoing) → either law-enforcement takedown (Silk Road, AlphaBay, Hansa, Hydra) or operator exit scam (Sheep Marketplace, Evolution, Wall Street Market). The two termination modes have distinct on-chain signatures: takedowns produce law-enforcement-controlled seizure addresses and multi-year forfeiture proceedings; exit scams produce operator-cluster wallet drains followed by T7-pattern laundering. The Hansa covert-takeover operation (Dutch police operated the market from 2017-06-20 until the 2017-07-20 announcement [cohhansa]) is the canonical case of a darknet-market takedown producing an intelligence windfall rather than just an asset seizure.
Corrected 2026-10-11
Silk Road seizure is 144,000 BTC (not 174,000); Sheep Marketplace loss is contested (5,400 BTC claimed, ~39,918 BTC traced) rather than ~$100M; Hansa ran 2017-06-20 to 2017-07-20; Wall Street Market figures follow press reports; unsupported Dream Market, Quebec and 40,000-vendor claims removed or flagged.

Summary

Timeline

When Event OAK ref
2011-02 → 2013-10 Silk Road: the first darknet marketplace at scale, operated by Ross Ulbricht ("Dread Pirate Roberts") on the Tor network; 1.23M transactions, 9,519,664 BTC in sales ($1.2B) [cohsilk]. FBI takedown October 2013; 144,000 BTC reported seized as Ulbricht's [cohsilk2]. Ulbricht convicted February 2015, sentenced to life without parole. The Silk Road operational model — Bitcoin escrow, vendor bonds, Tor hidden service, PGP-encrypted communications — became the template for every subsequent darknet market T7.001 + T5.005 (examples/2011-2013-silk-road.md)
2013-03 → 2013-11 Sheep Marketplace: one of the first Silk Road competitors; closed in late 2013 amid an alleged exit scam: admins blamed a vendor theft of 5,400 BTC, while users traced about 39,918 BTC (~$40M); the ~$100M figure is unverified [cohsheep]. The Sheep Marketplace exit scam established the darknet-market-exit pattern that would recur across Evolution, Wall Street Market, and later markets T11.005.002 + T5.005 (examples/2013-11-sheep-marketplace.md)
2014-01 → 2015-03 Evolution: darknet market operated by "Verto" and "Kimble"; operator exit-scammed in March 2015, stealing approximately $12M in escrowed Bitcoin. The operators disappeared with the funds and were never publicly identified — the largest unsolved darknet-market exit scam by operator-anonymity persistence T5.005 + T8.005 + T6.001 (examples/2015-03-evolution-darknet-exit-scam.md)
2014-12 → 2017-07 AlphaBay: the largest darknet market by volume post-Silk Road, operated by Alexandre Cazes (Canadian citizen living in Thailand). FBI-led Operation Bayonet coordinated with Thai Royal Police; Cazes was arrested in Thailand July 5, 2017, and died in Thai custody July 12, 2017 (DOJ: apparent suicide) [cohalpha]. AlphaBay had an estimated ~200,000 users at its 2015 peak per FBI-sourced reporting [cohalpha]; the earlier ~40,000-vendor figure and Quebec server detail are not supported by sources found. Operation Bayonet involved authorities from nine nations [cohalpha] T5.005 + T7.001 + T7.002
2016-01 → 2017-07 Hansa: Dutch police took control of Hansa on June 20, 2017 and ran it covertly until the takedown was announced on July 20, 2017 [cohhansa]. During the covert-operation window, Dutch police collected vendors' real IP addresses and some 10,000 delivery addresses, and reported 38,000 transactions identified by Europol, from users displaced from AlphaBay (believing Hansa was a safe alternative after AlphaBay's takedown). The covert takeover — coordinating AlphaBay and Hansa takedowns to create a migration funnel into a police-operated market — is the most sophisticated darknet-market law-enforcement operation on the public record T8.001 (credential-harvesting attribution windfall)
2013-11 → 2019-04 Dream Market: the longest-running darknet market at time of closure (5.5 years). Announced orderly shutdown in March 2019 with a redirect to a partner market. Dream Market's closing announcement and longevity claims in this row were not found in sources in this pass and are unverified. (The earlier reference to Operation DisrupTor was an anachronism; that operation post-dates Dream's 2019 closure) T5.005 (orderly-shutdown variant — rare counter-example to the exit-scam/takedown dichotomy)
2016-10 → 2019-05 Wall Street Market: the second-largest darknet market at time of takedown. German federal police arrested three suspected operators (aged 22, 29 and 31) on April 23–24, 2019 [cohwsm]. The operators reportedly took about $14.2M in cryptocurrency from users and vendors before the takedown [cohwsm] T5.005 + T7.001
2015-11 → 2022-04 Hydra: the largest darknet market by transaction volume in history, operating exclusively in Russian and serving Russia, Ukraine, Belarus, and Central Asia. German BKA seized Hydra's servers in Germany and 543 BTC (over $25M at seizure) in April 2022 [cohhydra]. U.S. Treasury OFAC simultaneously sanctioned Hydra and its associated cryptocurrency addresses. Hydra was the dominant infrastructure for Russian-language cybercrime, including ransomware proceeds laundering, stolen data sales, and narcotics trafficking T7.001 + T7.002 + T5.005
2022-11 → present Post-Hydra fragmentation: the takedown of Hydra fragmented the Russian-language darknet market into multiple smaller markets (Blacksprut, Mega, Kraken, OMG!OMG! Market) with increased operational security and cryptocurrency diversification (Bitcoin → Monero migration for escrow, USDT on TRON for settlements). This fragmentation is ongoing as of May 2026 and represents the current state of the darknet-market ecosystem T7.005 (privacy-chain migration)

Operational model and on-chain signature

Darknet marketplaces share a structural operational model with identifiable on-chain signatures:

  1. Escrow-based transactions: buyer → market escrow address → vendor (minus commission). The market's escrow addresses accumulate large, recurring deposits from geographically and behaviourally diverse addresses — a distinctive on-chain pattern.
  2. Vendor bond payments: vendors deposit a bond (typically 0.1–5 BTC depending on market tier) in a market-controlled address to be listed. Bond forfeiture on rule violation is the market's enforcement mechanism.
  3. Operator commission extraction: markets typically charge 2–8% per transaction. Commission is swept periodically from escrow addresses to operator-controlled consolidation addresses — the periodic-sweep pattern is the structural on-chain signal for darknet-market commission extraction.
  4. Termination mode bifurcation: law-enforcement takedowns produce a sudden cessation of escrow-address activity followed by seizure-transaction patterns (funds moved to government-controlled addresses); exit scams produce a sudden concentration of escrow balances followed by laundering-pattern transactions (mixer routing, CEX deposit layering).

Public references

Techniques demonstrated (4)