Worked example · 2013-11

Sheep Marketplace exit scam — Bitcoin — 2013-11 to 2013-12

Loss

Blockchain tracking showed a flow of 39,918 BTC matching Sheep Marketplace's holdings, about $40 million at roughly $1,086/BTC ([nextgovsheep]). The operators claimed a vendor stole only 5,400 BTC ([nextgovsheep]). Larger figures (a Reddit user's claim of about 96,000 BTC laundered) are unverified user claims ([welivesheep]). No recovery reported.

OAK Techniques observed

OAK-T11.005.002 (Fake-Custodian / Fake-Asset-Manager Fraud — the Sheep Marketplace operator presented the platform as a legitimate darknet marketplace with the normal custody-and-escrow assurances of the darknet-marketplace model, but the "escrow" was entirely at the operator's discretion; the platform was a fake-custodian vehicle from which the operator could exit with user-held Bitcoin at will). OAK-T5.005 (Treasury-Management Exit — the operator exercised legitimate-appearing authority over platform-held escrow balances to execute a single large exit event, draining user deposits held in the marketplace's Bitcoin escrow wallets; structurally the earliest cleanly-documented darknet-marketplace exit-scam pattern).

Attribution

pseudonymous. The operator was never publicly identified in the cited reporting; authorities did not comment on whether they were investigating ([nextgovsheep]). A Reddit user's claim that the suspect was in the Czech Republic is unverified ([welivesheep]). The case sits cleanly in the genuinely-unattributed segment of the 2013 darknet-marketplace record.

Corrected 2026-10-11

Loss restated as 39,918 BTC (~$40M) per blockchain tracking, not 39,000-96,000 BTC / $20M-$96M; the operator claim was that a vendor (EBOOK101) stole 5,400 BTC; the 96,000 BTC figure is an unverified user claim.

Key teaching point

Sheep Marketplace is the canonical 2013 worked example of the darknet-marketplace exit scam — the pattern in which a darknet-marketplace operator accumulates user escrow deposits over months of platform operation, then exits with the entire escrow balance in a single event, blaming the loss on an external compromise while the on-chain evidence indicates operator-side theft. The case is the earliest cleanly-documented instance of the structurally-recurrent T11.005.002 + T5.005 chain in the darknet-marketplace context, predating the Evolution Marketplace exit (2015) and setting the template for darknet-marketplace exit scams that continued through the 2014-2020 record.