Worked example · 2015-03

Evolution Darknet Market Exit Scam — 2015-03

Loss

over $12M by merchants' estimates [krebs15]; Bitcoin Magazine put it at an estimated 40,000 BTC, about $12M at the time [bm15]. Both are secondhand estimates. Evolution's operators stopped withdrawals and took the market offline in March 2015 with users' escrowed bitcoin [krebs15].

OAK Techniques observed

OAK-T5.005 (Treasury Management Exit — the operators, as the marketplace's central escrow custodians, controlled all user funds held in Evolution's escrow system and swept them in a coordinated exit event). OAK-T8.005 (Operational-Security Procedural Failure — the operators disappeared without being publicly identified at the time; their operational security during the platform's operation was sufficient to evade identification, but the exit-scam event itself was a catastrophic OPSEC failure in the attacker-jurisdiction sense — the operators demonstrated that the escrow model was a standing custodial-extraction surface). OAK-T6.001 (Source-Verification Mismatch — the marketplace's escrow claims and "secure" transaction promises were not independently verifiable; the escrow was a single-operator-controlled hot-wallet pool).

Attribution

unattributed — the market's administrators, who went by "Kimble" and "Verto", disappeared with the escrow funds and were not identified. An anonymous buyer told Krebs the pair had also designed and operated the Tor Carding Forum [krebs15]; this is unverified.

Corrected 2026-10-11

loss given as merchant estimates (over $12M / ~40,000 BTC) instead of 42,000 BTC; removed the unsourced 48-hour sweep, "Silk Road 3.0" ranking, Russian-ecosystem attribution and launch-date claims.

Key teaching point

Evolution is the canonical darknet-market exit scam — the structural demonstration that centralized marketplace escrow is a standing T5.005 surface. The incident is the darknet-market equivalent of the GBL exchange exit scam (2013, T11.005.001): a centralized platform whose operator-controlled escrow pool holds customer funds, with no independent custody verification, where the operator can freeze withdrawals and sweep the escrow at any time. The Evolution case validated the Silk Road precedent: decentralized custody (buyer-seller direct with on-chain escrow contracts) is structurally safer than centralized marketplace escrow — but darknet markets after Evolution continued to favour centralized escrow because it simplified the buyer-seller trust model.