Arrests

Due to length, this section has been split out as a separate page.

LE Reports

Security-wise, SR seems to be receiving passing grades from law enforcement agencies internally; a leaked FBI report mentioned no attacks against SR, an anonymous federal source reports frustration⁵ (although these sources may just be echoing public information⁶), anonymous anecdotes claim the DEA is stymied⁷, while a May 2012_12ya Australian document reportedly praised the security of seller packaging and general site security, with a pseudonymous SR forums user claiming to summarize it:

Recently, I gained access to an internal confidential report distributed to several Australia LE agencies and a few international anti-narcotic bodies regarding possible methods of combating illegal activities involving BC. Of course SR was a main feature of said report…So here are the nuts and bolts of the report, spread the information as far and wide as possible friends:

1. PGP is terrifying them, every new user who learns it and helps others learn, closes a possible loophole they were planning to exploit.

2. User ignorance of the technology being used (Tor, PGP etc) is their single best hope for any kind of serious action against the SR community.

3. Narcotic trade historically involves exploitation and violence. Users working together as a community for a greater good and towards the same goals has made all previous interdiction training basically obsolete. In other words, every user who helps newcomers learn how to be safe and secure especially through the use of PGP for all transactions and communication is a nail in LEO’s coffin.

4. A total lack of violence and exploitation is very much working in our favor. So in other words, the idea of a community working together to protect the new and vulnerable has been identified as a huge obstacle for any kind of serious attempt to stop SR.

5. Their morale regarding fighting SR and BC is very low at the moment, mainly because very few LEO have the capacity to comprehend how the whole system works, but unfortunately, recent media coverage demands some kind of action, so they are going to have to show the public they are doing something to combat SR, they just aren’t sure what yet.

Vulnerabilities

In particular, I am impressed that after years of operation as of April 2013_11ya, SR seems to have never been seriously hacked or broken into: in that time, there have been many hacks of other sites and >9 hacks of Bitcoin currency exchanges. There has been a perennial forum spam problem, and in late 2012_12ya, there was a SQL injection attack leading to images being corrupted with false addresses and a few people losing their money by not being suspicious, but that seems to be it. And SR is the biggest target out there besides MtGox, for multiple reasons—the sheer amounts that pass through it, the potential of it being a small team rather than a professional group (how do you hire penetration testers when you’re SR?), the unusual products you can order, the notoriety one would earn, and finally, the “lulz” value of their databases (suppose someone were able to harvest addresses & names that are foolishly sent to sellers in the clear & unencrypted; imagine the lulz value of releasing them all in a big dump! People would be wetting their pants worldwide, since despite all warnings, there are always a great number of users who will not bother encrypting their addresses.)

My belief is that SR can be taken down; however, I am not sure LE (law enforcement) has permission to use the tactics necessary—explaining the lack of suggested attacks or realistic attacks in the leaked FBI Bitcoin paper and summaries of the leaked Australian SR paper (respectively). My two suggested attacks are

1. DDoSing the SR site, rendering it unusable (and congesting the overall Tor network)

2. fake buyer & seller accounts leading up to a single large scam.

Attack #1 would make the site simply unusable, and can be done on any address SR runs on since the address has to be widely known or how will the buyers & sellers know where to go? This would require a few dozen nodes, at least, although I’m not actually sure how hard it is to DDoS a Tor hidden server—reportedly the DDoS which took down SR for weeks was being run by a single individual in their spare time⁸, and by the very nature of the Tor anonymizing network, it should be difficult to do anything at all about a DoS attack since how do you identify the end-nodes responsible, as opposed to the relays passing on their messages? And the obvious counter-measure, running through many .onion addresses, even one for every user, would substantially reduce the actual anonymity of the SR servers. That a weak DDoS attack was already so successful against SR raises serious doubts in my mind about the ability of hidden services to resist a real DDoS attack like by a medium-sized botnet.

Attack #2 would require a fairly substantial financial investment to pay the ~$500 deposit required of each seller account, but depending on how effective the final step is, may actually run at a profit: it’s not hard to get $500 of orders at any time, since you can build up a reputation, and then when you decide to burn the account, you can solicit orders for weeks due to shipping delays, and then delay the resolution even longer. Certainly the many FE scammers like Tony76, who have made off with hundreds of thousands of dollars, have demonstrated that this is perfectly doable and claims to the contrary are wishful thinking; and certainly LE is patient enough to do this tactic since it’s exactly what they did with Farmer’s Market & carder.su & other forums/sites too obscure to be remembered. Repeated, this would massively destroy buyers’ trust in SR, especially since there are usually only a few hundred active sellers at any point. (pine, commenting on how the competing darknet market Atlantis did in-browser encryption which I criticized as security theater & Hushmail redux, points out the Eternal September version of this scenario: the more newbie buyers who are too lazy or arrogant to use PGP (~90% of users, according to the Atlantis administrators in June 2013_11ya; >50%, according to a former SR1 seller; >30% of Sheep Marketplace users according to the seller “haydenP” on 2013-11-22; DPR2 estimated “between 8% and 12%” on SR2 on 2013-12-06; 90%, an Evolution/The Marketplace seller; <10%, an Agora seller; >75%, the Project Black Flag hacker; 46% & 52%, the Evolution seller fun-gee; 10%, GrandWizardsLair & 1-2% use multisig when available; a large fraction of AlphaBay users in 2016/2017 according to people who saw the leaked PMs) the more attractive an attack on SR becomes to pick up all the buyer addresses being sent in the clear and the more feasible a mass raid becomes.)

Fortunately, I don’t think LE is authorized to engage in cyberwar (#1) or mass entrapment & fraud (#2)—and who knows, maybe SR could survive both. We’ll see.

Quantitative

In my modafinil article I discussed some basic statistical techniques for optimizing orders under uncertainty: one-shot ordering, repeated ordering with free learning, & repeated ordering with expensive learning.

In this case, it’s a single order, so one-short ordering it is. One-shot ordering simply counsels ordering from a mix of the cheapest and the safest seller—what maximizes one’s expected value (EV), which is just $\text{risk}\cdot \text{reward}=\text{EV}$. The reward is easy: total dose divided by total cost. The risk is harder: the sellers do not conveniently volunteer how likely you are to be scammed.

The obvious way to quantify risk is to just take the feedback at face-value: a 97% rating says I am taking a 3% chance I will be screwed over. Multiply that by the reward, sort to find the largest EV, and we’re done.

An objection: “Are you seriously saying that a seller with 1 bad review out of 100 is equally trustworthy as a seller with 3 bad reviews out of 300, and that both of them are less trustworthy than a vendor with 0 bad reviews out of 10?” It does seem intuitive that the 300 guy’s 99% is more reliable than the 100 guy’s 99%; the 10 guy may have a perfect 100% now, but could easily wind up with something much lower after he’s sold 100 or 300 things, and we would rather not be one of the buyers who causes those shifts downward.

So. Suppose we pretended reviews were like polling or surveys which are drawing votes from a population with an unknown number of bad apples. We could call it a draw from a binomial distribution. We’re not interested in the optimistic question of “how good could these sellers turn out to be?”, but rather we are interested in finding out how bad these sellers might truly be. What’s the worst plausible vendor future rating given their existing ratings? We can ask for a confidence interval and look at the lower bound. (Lower bounds remind us no vendor is 100% trustworthy, and indeed, pace the hope function, the higher their rating the greater their incentive to require FEs and disappear with one last giant haul; the actual SR feedback system seems to use some sort of weighted average.) This gives us the pessimistic percentage of feedback which we can then interpret as the risk that we will be one of those bad feedbacks, and then we can finally do the simple expected-value calculation of “μg/₿ times probability of being happy”. What are the results? The numbers were calculated as follows:

# Frequentist analysis:
# https://en.wikipedia.org/wiki/Binomial_proportion_confidence_interval#Clopper-Pearson_interval
y <- function(ugbtc,n,pct) {((binom.test(round((pct/100)*n),n,conf.level=0.90))$conf.int):1 * ugbtc}
# Binomial CI doesn't work on 0 data; what do we do? Punt with the age-old 50%/coin-flip/equal-indifference
# Why 90% CIs? Fake feedback skews the stats up and down, so we might as well get narrower intervals...
c(y(63,28,100), y(70,300,97.3), y(72,68,99.1), 90*0.5, y(81,300,93.7), y(85,76,100), y(93,300,98.7),
    y(94,173,93.4), y(100,10,100), 112*0.5, y(125,300,95.1), y(143 127,97.6), y(163,127,97.6), 175*0.5)
 [1]  56.60766  66.66799  67.11326  45.00000  73.58456  81.71468  90.18671
 [8]  84.31314  74.11344  56.00000 115.50641 134.43170 153.23333  87.50000

# Question: what if we use a Bayesian Jeffreys interval?
# https://en.wikipedia.org/wiki/Binomial_proportion_confidence_interval#Jeffreys_interval
install.packages("MKmisc")
library(MKmisc)
y <- function(ugbtc,n,percent) {binomCI(x=round((percent/100)*n),n=n,conf.level=0.90,
                                method ="jeffreys")$CI:1 * ugbtc }
c(y(63,28,100), y(70,300,97.3), y(72,68,99.1), 90*0.5, y(81,300,93.7), y(85,76,100), y(93,300,98.7),
     y(94,173,93.4), y(100,10,100), 112*0.5, y(125,300,95.1), y(143,127,97.6), y(163,127,97.6), 175*0.5)
 [1]  58.85933  66.81522  67.96488  45.00000  73.74114  82.88563  90.39917
 [8]  84.64024  82.92269  56.00000 115.75319 135.22059 154.13256  87.50000
# Answer: it's almost identical.

# If Bayesian and frequentist methods differed much, one would be wrong and no one would use it!
# let's look in further, how *exactly* do the ug/₿ ratings differ?
binom <- c(56.60766, 66.66799, 67.11326, 45.00000, 73.58456, 81.71468, 90.18671, 84.31314, 74.11344,
                       56.00000, 115.50641, 134.43170, 153.23333, 87.50000)
jeffreys <- c(58.85933, 66.81522, 67.96488, 45.00000, 73.74114, 82.88563, 90.39917, 84.64024,
                82.92269, 56.00000, 115.75319, 135.22059, 154.13256, 87.50000)
mapply(function(x,y) round((x-y)/y * 100,digits=2), binom, jeffreys)
#  [1]  -3.83  -0.22  -1.25   0.00  -0.21  -1.41  -0.24  -0.39 -10.62   0.00
# [11]  -0.21  -0.58  -0.58   0.00
## in 1 case, for Machine Maid, the ug/₿ estimates differ by 10.62%, which is interesting

(This demonstrates, incidentally, that feedback ratings don’t start yielding very high assurance until a surprisingly large number of reviews have been made.)

Now we have risk factored in from just the quantitative data of the feedback amount & percentage. But we must be more subjective with the other factors.

Qualitative

We have to look at more qualitative information and start comparing & ranking possibilities. There are a few criteria that one should value; in roughly descending order of importance:

1. old > new

2. high weighted-μg/₿

3. many reviews on SR & forums

4. no FE > FE

5. domestic > international

6. has feedback thread

For a first cut, we look at all items meeting #2, where a good cut off seems to be weighted-μg/₿>90; this is just EnterTheMatrix, juergen2001_23ya, VitaCat, and nipplesuckcanuck. A second cut is 2001_23ya for requiring FE;

So we’re down to VitaCat and EnterTheMatrix. On most of the listed metrics, they are about equal—EnterTheMatrix seems to have an edge in feedback due to greater volume, but it’s hard to say for sure. Going with VitaCat promises to save a little bit of money since his weighted-μg/₿ is ~10 greater. So our analysis winds up with the conclusion of ordering from VitaCat, who has a reasonable-looking profile:

And whose Maya listing looks perfectly acceptable:

Ordering

Was this the right choice? I have no idea. The best I can say is that checking the SR forums in December 2012_12ya, by which time any September order would have been delivered or not, there were no reports of that seller being a scammer or having engaged in a rip-and-run, while some of the lower-ranked sellers seem to have disappeared.

I bought the 2-dose item since I couldn’t afford the 5-dose one. (It would’ve been useful but I wasn’t sure I wanted to sink in that much money, 2 doses should suffice, and it was highly likely that he would sell out before I had converted any more money into Bitcoin—as indeed he did sell out.) So instead I paid extra for tracking. Ordering was like any other SR order; I filled out the cart:

Was able to check the details to make sure everything was right:

Waited impatiently while it was processing to see if he would accept my overseas order:

And when he did, sat back and waited:

It came without any issue:

VoI: Ehrlich Test

We have one last question about ordering: should we buy an “Ehrlich test”?

An Ehrlich test is a reagant for indole alkaloids, a category which includes psychedelics like LSD & psilocybin. As such, it can be used as a kind of quality check. However, while any LSD product will probably trigger a positive, so will other chemicals; and the test itself may simply be wrong.

Is an Ehrlich test worth buying? This sounds like a classic Value of Information problem.

The only SR listing for an Ehrlich test is a Synaptic listing (a seller who I have already criticized for shoddy security practice) which both costs >$40 and has a highly negative review! Googling on the open web leads quickly to eztestkits selling for £4.99, which with S&H is probably $10-15, and Avalon Magic Plants for a similar price. Synaptic’s listing is clearly a fool’s buy (and I heard later he was banned), but the latter two may not be.

The fundamental question of a VoI analysis is: how would this information change your actions? If the test being positive rather than negative would not lead you to do anything differently, then the information has no (direct) value.

This leads to a quick answer: if I tested a VitaCat dose (destroying >$20 of LSD) and it was negative, would I throw the rest out? No. I would be too curious, and I would have spent too much to tranquilly chuck it based on one test which I do not trust as compared against a very reputable seller. (I would be too curious since I do not plan to order again.) Therefore, the VoI is zero; and a value of zero does not justify spending the money on buying a kit and wasting LSD and time. I would just find out the hard way.

BBC Questions

In mid-January 2012_12ya, a reporter from BBC Radio’s “5 Live Investigates” emailed me asking whether I’d answer questions for their 5 February show they were doing on Bitcoin & Silk Road; I agreed. The following is the transcript:

How did you find out about Silk Road?

I saw the original announcement of it on the Bitcoin forums when it was linked on Reddit. I figured it would fail, and then a few months later, I saw the Gawker article on it and apparently Silk Road was actually working!

What attracted you to using Silk Road?

Once I heard, I just had to look into it more—it was too interesting not to. Timothy May and other cypherpunks had been speculating about black market websites using cryptocurrency since the early ’90s, and here was a real live example. I looked at their offerings and saw they had some offers I might want at reasonable price, and that settled it for me.

What is the difference between ordering your drugs from Silk Road and getting them on the street?

Modafinil is pretty hard to get on the street because everyone gets it either with a prescription or from an online pharmacy, so I have no idea. While I was still checking out Silk Road, I asked a friend in college how much Adderall would be and he told me he could get them for $9-10 a pill (it was close to the end of the semester); it cost half that on Silk Road, so I went with them rather than him. I’ve always found it hard to resist a ‘bargain’.

How is Silk Road different to other websites where you can buy drugs?

My first-hand experience with modafinil is that I much prefer to buy on Silk Road than the pharmacies.

With them, your dollar payment can fail at any point. For example, MoneyGram once blocked a payment of mine. Very frustrating! Bitcoin is much more reliable: I can see where my bitcoins go until they enter Silk Road proper.

And then there’s the split between Silk Road itself and all the sellers, which makes things safer—everyone encrypts their physical address before submitting it to Silk Road, and the seller decrypts it himself. If Silk Road is untrustworthy, they can only steal my bitcoins but not my address; if the seller is untrustworthy, they can only steal my address and not my bitcoins. Whereas with the pharmacies, they both get my money and my address.

What have you ordered from the site and how often?

I don’t order very often because I like to thoroughly experiment with things, and my tests take a while to set up and run. I think so far I’ve done one order of Adderall, one order of armodafinil, and two orders of modafinil; another order of selegiline was canceled.

How important is anonymity to you? Do you think the technology really protects your identity?

It’s not very important because I have little interest in the drugs law enforcement is most interested in, like heroin or cocaine. Modafinil can be shipped without much danger, with Customs only seizing the package if they notice it and nothing more. Adderall isn’t very dangerous either—everyone knows it’s all over college campuses, so what are they going to do, arrest me? I don’t even have any Adderall left!

(To make a historical analogy, it’s like having some wine during Prohibition; no one thinks much of it, and the cops are busy with the gangsters.)

How important is Bitcoin?

I’d say the Bitcoin part is probably even more important than Tor. Law enforcement is not known for its NSA-style traffic analysis because it wouldn’t be usable in court³⁷, and the other benefit is that there’s no domain name to be seized or filtered; but neither of these is very important. They can be gotten around or dealt with.

But being able to get money to the sellers, and the sellers being able to turn it back into usable cash on Mt.Gox or another exchange, that is crucial. You cannot buy and sell drugs for free.

What do you think the future holds for Silk Road, do you think the authorities will shut it down or do you think it will continue to grow?

I would be fairly surprised if it was shut down; there’s no obvious way to do so. The real danger is internal: that the community itself might be skewed towards scammers and buyers just give up and buy somewhere else. It’s the same dilemma eBay faced: you don’t want to scare off the sellers by too many rules, but if you don’t do something, scammers will fleece the buyers. So far, the administrators have done a pretty good job of keeping everything running and maintaining the balance.

How important is the community side of Silk Road.

Extremely. The community is what determines whether Silk Road will decline or continue growing with the general growth of Bitcoin.

What sort of people use the site?

It’s hard to tell, but from reading the forums, it seems like it is mostly technically adept young people in Western Europe and America. Tor and Bitcoin and encryption are a challenge to use for most people, and older people have contacts they know how to use when they want various drugs.

Is Silk Road just about scoring drugs safely or you and other users feel you are making a greater statement about society the drugs law?

I know other users disagree and take it only as a useful service or something of a FU to The Man, but many of us do see it as a principled statement. I believe that I am capable of researching and evaluating drugs, that I can accept the risks, and see how they do or do not work, and that the government should not be coercively imposing its beliefs on me.

I am also horrified by the effects of the War on Drugs, which has been a greater disaster than Prohibition (which we at least had the sense to repeal after a few years). Buying on the Silk Road and writing about it is, if you will, my bit of patriotism. It’s not very heroic, and I’ve never claimed to be a hero or to be doing anything particularly noteworthy, but perhaps it will change someone’s mind—either that drugs are not so bad or that the War is not so practicable.

Mike Power Questions

NYT

On 16 December, Alan Feuer of The New York Times emailed me with some questions about the recent (2013-11-29) failure of Sheep MarketPlace & theft of its user funds. I answered as best I could:

1. Why in general were you skeptical about SMP’s survival in the first place? What about it struck you as unsustainable?

In general, DNMs are not very stable: the market dynamics that power them and render them self-regulating and made Silk Road such a wonderful way to buy drugs require specific conditions to work, but conditions are always changing. This doesn’t mean you can’t get drugs from them, any more than restaurants always going out of business means you can’t get good Mexican food when you want it, but it does mean that any particular DNM can’t be expected to hang around more than a year or two. The SR model, with a single centralized site both buyers and sellers have to trust, did work but that trust can be abused by the site operator³⁹. So inherently one expects DNMs to have fairly short lifetimes. (They are surprisingly like regular businesses or websites in this respect.)

Sheep MarketPlace in particular struck me as dubious because it was so obviously modeled after SR (indicating a lack of originality and possible get-rich-quick mentality), the operators did not speak English well (despite English being the international language of programmers), it was hardly used (meaning that there was no feedback and it had not withstood any hackers the way SR had), and it received the lion’s share of the post-SR market for no particular merit of its own other than its visual appearance and lingering distrust of BlackMarket Reloaded.

2. What do you feel is the most convincing evidence that Jiřikovský is/was connected to SMP?

The clearnet site. It was exactly the sort of rookie error I expected from someone with a casual attitude to security: that they could promote their site as they pleased, and as long as they maintained some level of plausible denialability, it was safe. Except security & anonymity are not a courtroom with all its legal niceties, circumstantial evidence is powerful, and once you began examining Tomas, everything falls into place. At that point, it’s almost irrelevant if you find something like, for example, Tomas being the first person online to discuss the existence of Sheep Marketplace (the same mistake Ross Ulbricht/“altoid” made, incidentally). You’ve already done most of the intellectual work necessary to identify the operator of SMP. Simply by being so closely associated with a server that could only have been set up by someone working with SMP, he forfeited most of his anonymity and claims to innocence.

(To understand what I mean by “most of the work”, it may be helpful to read my hopefully-entertaining essay on anonymity in Death Note.)

Incidentally, you should probably see the Reddit translation & discussion of Tomas’s interview with Lidové Noviny on SMP for Tomas’s general failure to respond to the presented evidence, failure to say who was running the clearnet site on his server if not him, and in some cases, like his early mention of SMP, clear lying.

3. I had a bit of difficultly understanding the facts and significance of the Clearnet site. Would you help me understand that?

See above. The clearnet site is very similar to how “altoid” posted on some forums about a new site called Silk Road, was the first identifiable person to ever discuss Silk Road, and then proved to be the account of a guy called Ross Ulbricht. It’s incredibly suspicious and exactly what you might expect the operator to do in an attempt to drum up interest and attract attention and so is the best starting point for an investigation. It’s not enough to prove in court he ran Silk Road—but we are not in court.

4. Is it your belief that the “heist” was in fact perpetrated by SMP’s admins themselves?

The heist was clearly perpetrated by the operator of SMP; even the SMP forum moderators admit as much.

If you mean the story about “EBOOK101” hacking the site… I am agnostic on the topic.

While it is a reasonable trigger for why Tomas might decide to grab the money and run, and we saw a similar hack prompt backopy to decide to close down BMR fully, the problem with the story is that no one seems to have ever dealt with an EBOOK101, EBOOK101 has not left any taunting messages or clues like the BMR hacker did, and SMP in retrospect seems to have been orchestrating the scam for at least a week in advance by shutting down withdrawals (on the pretext of adding tumbling), coaxing people into depositing even more money, and delaying tactics like adding a fancy countdown timer.

And in any event, it’s mostly a moot point: SMP stole far more money from its users than EBOOK101 was supposed to have. And suppose the story were true—Tomas’s willingness to immediately give up after the hack suggests to me that he would not have been continuing SMP much longer regardless…

5. And your take on the FBI’s role in all of this?

I only know what my informant has told me; since he presented a convincing case for Tomas to me which he did not have to, I assumed he was also telling me the truth about him telling the FBI and them being very interested in what he had to say. So I assumed that they were on the case and understood the need for prompt action. But the FBI has issued no statements on the topic, I have not contacted Christopher Tarbell myself, and thus far there have been no arrests or other law enforcement action I am aware of. I am a little bewildered by the complete silence. So I no longer have any idea on their role. For all I know, they’ve completely given up. Or maybe they’ll announce arrests tomorrow. You should ask Tarbell.

I’m curious what you think about the subreddit postings by the two hackers who ostensibly “chased” the thief through cyberspace. Was it real chase against the wrong perpetrator or another part of Jiřikovský’s ruse?

It was a real chase, but neither of them are very familiar with blockchain analysis, and so they wound up eventually reaching false conclusions like “Sheep stole 97k bitcoins”.

This is a common problem with blockchain analysis. People at first think that Bitcoin transactions are completely anonymous, then when they learn the truth, they vulgarly go to the opposite extreme and assume that because every transaction is public, it’s completely trackable and there is no privacy and analysis is a simple matter of following transactions—not realizing that at every transaction, you have to make a mental leap and assume you are still following the same person or bitcoins, an assumption which is fragile, easily broken, and difficult to ever justify.⁴⁰

Also did your informant tell you why he/she reached out to you instead of him posting the suspicions about SMP online himself?

Well, he didn’t post publicly at the time because he didn’t want to interfere with the FBI investigation. Why didn’t he post after Tomas had been doxed by the other Redditor, when I felt free to post his results? I’m not sure. I get the impression he doesn’t much care about publicity or helping out the DNM communities, so while he allowed me to post what I knew, he felt no particular need to post anything himself. As well, my precommitment and reputation meant that any posting would mean more coming from me.

Capital

On 2013-02-07, I answered some questions from Paul-Philipp Hanske of the German magazine Capital about the DNMs and Sheep in particular:

So, I would take the liberty of asking some questions about the SMP scam and black markets in general. As I told it before: many thanks in advance for answering them…

According to this report the chase for the thief went wrong. What’s your estimation? What happened?

What happened was simple: the bitcoins got moved around, and at some point, the thief was given unlinked bitcoins, without the hobbyists realizing it. The problem with the blockchain is that people start off thinking Bitcoin is completely anonymous; when they realize they are wrong, they flip to assuming it’s completely public & transparent & any transaction can be easily understood, which is less wrong but still not right. At any transaction, control can be transferred without any visible sign. The transaction could have been to an online wallet, an exchange, a prediction market, a DNM, a laundry/mixer, Shared Send, etc. The blockchain merely records transactions among addresses and it does not give you any meaning beyond that. People forget the limitations and escalating uncertainty, and so the Sheep chasers found themselves at a BTC-E cold wallet address. Presumably the Sheep thief then withdrew bitcoins (being paid from the then-hot-wallet) or sold & withdrew some fiat or both.

If the chasers traced the wrong amount of bitcoins: how could the thief hide such a big amount? Do you think he sold it?

The amount in Bitcoins can be easily hidden: just scatter it among multiple addresses to make the balances small enough they would not draw any attention. I don’t know if he sold it. I think he should not sell much, as to handle a large amount would require an exchange which might require paperwork & using his real identity; but then, I would not have wasted hundreds of bitcoins trying to send such a huge sum through the Bitcoin Fog mix, so I do not think the Sheep thief is the most rational or knowledgeable person around.

what’s your estimation how much was stolen?

The best estimate right now seems to be ~₿39k, although some of this may have been what the hacker (apparently a Profesorhouse) earned.

Is there still strong evidence that Jiřikovský is part of the scam?

The evidence remains largely the same, I think. Jiřikovský backed down on his threats of legal action against a Czech redditor, and he gave a strange interview with a Czech papers which struck me as ignoring most of the circumstantial evidence, arrogant, and making incoherent/wrong technological claims. I have heard of no related arrests, but that doesn’t mean much: Ross Ulbricht wasn’t arrested for almost a year after paying for a hit with his Australian bank account, after all, and many investigations take longer.

If he (or his group) would be part of it: isn’t it now terribly dangerous for them? A lot of people are angry…

Probably. But it’s unlikely anyone will act on speculation.

What’s your latest estimation about the role of the FBI in this case?

I don’t think they’re doing much but waiting. If there’s active investigations, I’d guess all the work is being done by agencies in the EU with physical access.

Do you think anyone complained to the police because of the scam?

No. I’m impressed that Plutopete has the chutzpah to challenge the Silk Road seizure, but I still can’t see anyone actually complaining to the police about losses on an illegal DNM.

One last question concerning black markets: I’m very fascinated by operators of these websites. What do you think is their motivation? Only earning money?

Of the operators of the ~20 sites active at this moment, the majority seem to be entirely non-ideological and pragmatic: a few seem to have mixed motives relating to cryptopunk or marijuana or public service, and SR2’s DPR2/Defcon/Hux may be libertarians (assuming they’re not just imitating Ulbricht), but the rest? They’re in it for the money.

One of the interesting parts of the post-SR fallout and the new crop of marketplaces is seeing to what extent SR’s longevity was due to Ulbricht’s principles. It may be that we overestimated the value of running a marketplace, that the incentives to scam first-generation marketplaces (without multi-signature escrow) are too great.

Or also some libertarian beliefs as Ross Ulbricht claimed to have?

I don’t see any reason for skepticism about that.

In general: how strong do you think is the connection between black markets and libertarian thinking?

It was strong in the beginning, but like Bitcoin itself, I think it’s become too popularized to remain strongly ideological. I suspect most users strongly agree with the libertarian position on the War on Drugs, but maybe not much beyond that.

What do you think is the best black markets in the moment?

From a design perspective, I’m interested in The Marketplace for pioneering what I think may be the next step forward for DNMs, multi-signature escrow; they’ve used it longest, and from a security perspective, that puts them ahead of almost all of their competitors. From a more practical perspective, SR2 still seem to have the widest selection and most business, although their problems with getting basic functionality working has driven off a lot of buyers & sellers.

Where did the most vendors go to? (it would be great if this market would be so big that you could also browse for German vendors… ;)

It’s hard to estimate since I haven’t yet extracted counts of products and vendors, but the biggest sites seem to be SR2, Agora, Pandora, Blue Sky, and The Marketplace. I’m sure there are German sellers on some of them.

The authorities are really upset about the Tor/deep-net-market-thing. What can they do against it? Do they have any possibilities? Do you think the deep-net-market-scene will still exist in 5 years?

Even if Tor turns out to be irredeemably compromised, there’s still I2P, and beyond I2P, there’s also Freenet. When current markets are busted or go down, given how many people have tasted the forbidden fruit, there will still be plenty of demand for replacements. I expect there will still be a DNM scene in 5 years using one of the networks, and if there isn’t, it’ll be because some technically superior approach has obsoleted all the current markets. (Periodically people sketch out designs for fully distributed DNMs; none of them have made any serious progress, but on the other hand, people were speculating about digital currencies for many years before Bitcoin came along…)

Vice

Jordan Pearson, “Motherboard”, 2015-03-19:

What is your motivation for releasing the torrent file [of the Evolution marketplace and forums]? How will this help with the Evo fallout? What was your role on Evo (vendor? mod?)

Scrapes of the market are useful for people trying to cope with the fallout. If you need to look up a vendor’s contact info so you can email them, or if you didn’t save the PGP key of your favorite vendor & want to verify the Agora one isn’t a fake, or can’t quite remember their name though you’d recognize their listings… Plus, since everyone knows I scrape, they’ll be asking me to look things up or for copies, and it’s easier to make a torrent.

I had no role on Evo (I was, if anything, a critic). I am an independent writer/researcher and I scrape all the markets for research.

How long were you scraping Evo for?

Pretty much from when it opened to buyers to when it shut down a few days ago: 2014-01-21 to 2015-03-17.

And during this time you noticed some stuff that alerted you to the notion that the admins could pull an exit scam? What was that?

Exit scams are always a possibility for centralized-escrow markets. (Evolution had a multisig option, but it was not true multisig and no one used it.) I was always particularly distrustful of Evolution because their well-known roots in carding/fraud & allowing listings like poisons & guns meant they both had no morals and were particularly likely to be infiltrated or busted; either way, loss of coins was a major risk. I expected them to die well before this, however, and even odds of it dying by LE raid.

You’re a researcher-why help people track down their dealers?

Because it’s helpful. I have the mirrors, so I might as well do something useful with them.

These dealers are ostensibly moving to different markets, some of which are popping up right now (ie. Ironclad). What do you think of that? A lot of chatter right now about moths rushing to the latest flame in terms of scammy sites.

That’s always a problem when a big market goes down—the sudden diaspora can overload the older trustworthy markets, and the newer untrustworthy ones see a large inflow. eg. SR1 indirectly knocked out BMR and led to the rise of Sheep. Right now the big question is whether Agora will last: they are older than Evolution, IIRC, and must be tempted to exit scam for the same reasons, especially since the LE attention on Evolution will be forced to move onto Agora. If they stay open, they’re the market of choice for everyone, but if they disappear too, people will be forced to choose from among the existing small markets—Nucleus, Abraxas, Diabolus, Black Bank, Middle Earth, Kiss, Outlaw, etc. If the smaller markets are ambitious, this will be their golden opportunity to ascend and become the new top market, but of course, they could discover the risk feels too much and the centralized escrow is too tempting… We went through a few iterations of this after SR1 before things stabilized under the Agora/Evolution duopoly.

(LE is another question-mark; by now, with Evolution over a year old and TCF before that and at least 3 vendors busted, they should have managed to infiltrate at least one employee into Evolution, but we won’t know for months whether they had enough to bust anyone else before Evolution closed and effectively terminated their investigations.)

Forbes

Thomas Fox-Brewster, 2015-03-23:

Some dealers I’ve spoken to think setting up a bespoke market is the way to go. Think that’s the case? Are you planning to set one up if you don’t have one already?

By bespoke market, I assume you mean a vendor shop. Those are definitely dead ends—they do not solve the trust issues of rating and escrow. (For example, one scam is to set up a vendor shop and tell customers to use an obscure third-party escrow service; naturally, this escrow service is run by the same people, and when the mark sends the bitcoins to buy something, they keep it.) They also aggravate issues of hacks, since a drug vendor is not likely to also be a great web programmer & sysadmin. Vendor shops have never scaled, and never will without solving decentralized markets.

Can we trust any of the big markets anymore?

You could never trust any of the big markets. Evo exit scamming is just people waking up from their dreams and learning from history the hard way. All this has happened before, and will happen again.

Is the dream of a decentralised market even close to happening?

I don’t think so. Open Bazaar, last I heard, had next to no anonymity and I don’t know how far any of the others have gotten. If they did exist, I’m not sure anyone would use them; they will likely be intrinsically hard to use, like multisig, and may see the same lack of adoption. They work in theory but not practice. Market exit scams, for all the hyperbolic media coverage, are simply an ordinary and acceptable cost of doing business.

Separately, why do most dealers I speak with use Lelantos?

Gmail etc are well-known for handing over email information to law enforcement; Safe-mail used to be popular but people seem to have finally realized that any security there is illusory and it’s another Hushmail in the making; Rise-up is a bit hard to get accounts on; and Tormail has been gone for years. So I guess Lelantos is just the best balance available?

“J’accuse!”

In March 2013_11ya, I learned of a rumor that a particular fake ID seller on SR1, “KingOfClubs”, was actually a federal mole. It came from a person who claimed that the carding forum carder.su which had been busted in early 2012, was undone by an agent who infiltrated it over 2 years as a user named “celtic” by selling high-quality fake IDs to members (according to Wired’s July 2013_11ya coverage, Celtic was a real carder who had been busted & his identity assumed). This is perfectly plausible as one of the standard law enforcement strategies to take down carding or drug forums is infiltrating forums (eg. ShadowCrew, CardersMarket, CarderPlanet, fakeplastic.net), taking them over, or even setting up their own fake forums as honeypots (the “Carder Profit” forum).

He thought that the seller had a similar modus operandi, making the following comparisons:

1. celtic sold fake custom IDs from 15 states; the seller likewise sells these specific states

2. celtic sold a large variety of IDs; the seller sells a wider variety than others,

3. celtic advertised with lengthy detailed descriptions; the seller has descriptions which are much more than a few lines, like some other SR sellers

4. celtic sold expensive high-quality IDs, with difficult new security features; likewise

5. celtic advertised his wares as “novelty IDs”

6. celtic implied he was Russian

7. celtic asked for the necessary information to be sent via email and required 2 email addresses

8. celtic had his non-anonymous payments sent within Nevada

9. celtic had operated on the forum for over 2 years; the seller was at the 1 year mark.

They also mentioned that after contacting the SR admins, they were blocked from accessing SR under that or other accounts.

Objections

This rumor struck me as unusually detailed, plausible, and interesting. It would also be cool to scoop an investigation. So I looked into the matter more deeply; I started by compiling an archive of all KoC’s listings, reviews on Reddit, and listings by other ID sellers for comparison (archive; contains MAFF & MHT), and noted the following:

1. the carder.su mole supposedly sold 15 states’ IDs and so does KoC. But KoC’s current profile lists only the following:

   Product	Price
   Montana Driver’s License (Holograms + Scannable)	₿6.61
   Indiana Driver’s License (Holograms + Scannable)	₿6.61
   Wisconsin Driver’s License (Holograms + Scannable)	₿6.61
   Alaska Driver’s License (Holograms + Scannable)	₿6.61
   New California Drivers License (Holograms + Scans)	₿6.61
   Rhode Island Driver’s License (Hologram+Scannable)	₿6.60
   Idaho Driver’s License (Holograms + Scannable)	₿6.60
   Tennessee Driver’s License (Holograms + Scannable)	₿6.60
   Arizona Driver’s License (Holograms + Scannable)	₿6.60
   New York Driver’s License (Hologram + Scannable)	₿6.60
   Ontario Driver’s License (Raised Lettering, Scans)	₿6.60
   New Texas Drivers License(Raised LTR, Holo, Scans)	₿6.60
   Texas Drivers License (Holograms + Scannable)	₿6.60
   subtotal: 13
   New South Wales Driving License (Holograms+Scans)	₿6.61
   Manitoba Driver’s License (Scannable Tracks 1,2,3)	₿6.60
   Quebec Driver’s License (Scannable Magstripe1,2,3)	₿6.60
   Alberta Driver’s License (Holo, Raised LTR, Scans)	₿6.60
   UK Driving License (Holograms + Scannable)	₿6.60
   subtotal: 5
   total: 18 (excludes combo offers)

   No matter how you sum it, that’s not 15 states.

2. It’s not clear that celtic or KoC’s variety is unusual. For example, in the indictment 2 of the defendants, Haggerty or “Wave” & John Doe or “Gruber”, actually sound almost identical to this “celtic”: they counterfeited driver’s licenses in 15 states; this does not seem consistent with their story and undermines the value of any observation of KoC selling 15 states since that’s at least 2 people who also sold for 15 states—suggesting that 15 states is simply what is easily handled by available equipment/techniques, are favored due to having many residents being tourists, or something like that.

3. On the SR side of things, KoC does not seem all that unusual. Some sellers talk a lot and sell a lot, others don’t. For example, the seller namedeclined has something like 21 different items in the forgery & fake ID sections, and is positively prolix about one I randomly clicked on, his fake Geico insurance card.

4. If his cards were being done with government equipment, or top of the line anyway, they ought to be excellent and might as well be cheap to attract as many suspects as possible. But there are many complaints in the SR forums & Reddit that his rather expensive cards weren’t very good and in some cases were very poor. He also isn’t all that cool with customers, easily losing his temper. All this is reflected in his feedback score, which is not terrible but also is not great.

5. KoC using the term “novelty ID” doesn’t mean much. As far as I know, all the Chinese/Asian sellers use that excuse as well: “oh, they’re not fake IDs, they’re novelty IDs; we can’t be blamed if our customers misuse them.”

6. KoC doesn’t make it sound like he’s Russian. He comes off as American, and his listings imply he’s shipping domestically.

7. obviously in buying custom fake IDs, customers need to provide the relevant info like age and a photo of the person who will be using the ID. KoC provides a public key, accepts encrypted private messages on SR for the form, and links repeatedly to a hidden service for image uploads; he does list a tormail.org email address as an option, but you can just connect to tormail.org’s hidden service (that’s the point of it) and send an email via them. You would have to be lazy or foolish to send such an email from your regular email address before he would have access to your email, and there is no mention of requiring 2 email addresses

8. while KoC seems to have accepted Western Union, Moneygram, and Moneypak early on (like a mole might), he seems to have dropped them entirely: his profile specifically disclaims accepting anything but bitcoin. Why would a mole do that?

9. Many sellers are less than 2-3 years old, since SR is still relatively new and it wasn’t clear early on that it would survive or be worth doing business on; given that new sellers probably drop quickly as they stop selling for various reasons (they were scammers, it turned out to be too much work, whatever), we would expect to see mostly medium-aged accounts selling.

Two additional points I would make:

• while the media does confirm that carder.su members used fake IDs, this is common to many or all carding forums; more importantly, I cannot confirm their account of the demise of carder.su based on the 2012_12ya indictment, and no one in Google mentions any “celtic” in combination with carder.su. The redactions make it difficult to be sure, but they do not seem to have usually redacted the usernames or pseudonyms or nicks (eg. pg40), and in the lists of redacted defendants’ offenses, few short-names come off with large quantities of forged items or other such violations. While the Farmers Market indictment listed enough details that I could be sure that it was mostly due to Hushmail rolling over (as indeed proved to be the case), here I’m not sure of anything; the indictment goes into the wrong details for me to feel I can infer anything.

• At least one of their claims seems false: yes, SR might ban an account for filing a false report against a seller. But it can’t lock you out based on your IP or something like that; the Tor hidden service architecture simply doesn’t allow for that, as far as I know. The most it could do is maybe set a cookie and not let anyone with a cookie from a banned account log in or register an account, but that is trivially bypassed by deleting all cookies or using an incognito mode or using a different browser.

A counter-objection is that celtic-KoC might have deliberately dropped Nevada IDs and non-bitcoin payment to throw off anyone familiar with the previous identity. But in this scenario, presumably the absence would be for public consumption and anyone requesting either would get what they asked for as they became juicy targets for his investigation. This can be easily tested just by asking; so 2 throwaway accounts messaged KoC on those issues:

1. First conversation:

   • “I know they’re not listed, but would it be possible for you to do either a Utah or Nevada license? (Ideally with UV and hologram.)”

   • “I won’t be able to do Nevada but I may be able to do Utah with UV and holos, i’ll get back to you in the next couple days on that”

2. Second:

   • “bro how are you, do you make Nevada license and do you accept WU OR MG thanks”

   • “I don’t do Nevada DL’s at the moment but I can do a bunch of different states that aren’t listed, what else are you interested in? I don’t accept WU or MG but if you go under the ‘Money’ section of SR and go to the vendor ‘FreeMoney’ he will be able to exchange your WU or MG or Moneypak for ₿. Regards.”

While his consistent disavowal of both non-bitcoin payments and making Nevada licenses might simply be trying to be consistent in his persona, that would imply considerable paranoia on his part about being recognized—and makes this possibility that much more unlikely.

Predictions

When will we know? The carder.su indictment was signed 2012-01-10. The earliest dates mentioned in it are in 2007_17ya, but most of the early dates seem to be in 2009_15ya, in line with a >2 year infiltration which suggests a 2-3 year lag (or possibly as much as 5 years). The KoC account is listed as 1 year old and consistent with that, he has initial forum posts dating back to March 2012_12ya. That suggests any busts will come March 2014–2015, up to 2017. (I can’t guess whether the hypothetical SR bust would be faster or slower than carder.su: SR is much more secure and decentralized from a seller’s point of view, so one might expect it to take longer; but SR is also much higher profile as far as I can tell and so one could expect there to be much more pressure to deliver some sort of victory.)

What’s my current opinion? Reading through all of the above, thinking about the difficulties of attacking SR (KoC can only have access to small fry buyers, not SR staff like Dread Pirate Roberts), I feel that I can only assign 20% to a prediction that by March 2015, “there will have been a bust (>10 named defendants) related to forged IDs eg. driver’s licenses, linked to the SR vendor KoC”.

We’ll see.

Resolution?

In October 2013_11ya, SR1 was raided and its operator Ross Ulbricht was arrested; a few months later, several employees were also arrested.

Part of the initially released evidence was a photograph of several fake IDs for Ulbricht purchased on SR1 (which he seems to have used for buying server hosting) which had been intercepted by Customs around 2013-07-10. This was striking, and some people claimed the IDs in the photo looked like KoC’s IDs. This was confirmed in a December 2014 filing in his trial⁴²

Is this confirmation? Well, the filing does not describe KoC as a CI or UC, but it also does not describe how the KoC package was intercepted other than “as part of a routine border search”, which sounds implausible for any fake ID shipment (fake IDs should not trigger any drug dogs and are likely shipped in envelopes rather than bulkier packages) and especially implausible in that it just so happens to be a shipment to a person of interest; if Ulbricht’s name had been entered in some sort of screening database, that would be plausible but the filing specifically mentions the package was addressed to a “Josh”; and the early July 2013_11ya date seems a bit too soon for the SR1 server imaging in June 2013_11ya to have de-anonymized Ulbricht to the point where his physical address was known and his mail could be screened. KoC being a CI/UC would resolve the question immediately, but direct evidence of this is absent.

So I think the exact role KoC played in the fall of SR1 remains uncertain.

Model

My strategy is to model Silk Road’s growth as linear in dollar amounts, but with different amounts of bitcoins each day depending on the exchange rate, subtract a daily operating cost, and then sum the commissions.

So say that on 2012-01-01, SR did $10k of business, and the exchange rate was 1:100, so ₿100 in turnover, and SR gets an average commission of 7.4%, so it would get ₿7.4.

To do this, I need to estimate the revenue each day, the expenses each day, the commission each day, and the exchange rate each day. Then I can multiply revenue by commission, subtract the expense, and sum the left overs to get an estimate of the total bitcoins available to DPR which he could (or could not) have spent.

Expenses

1. Employees: we know that Libertas and one or two others were employed at salaries of $1-2k per week. I’ll assume there were 2 others, and each was paid the max of $2k per week, which means total daily employee expenses is $\frac{(2\cdot 2000)}{7}$ = $571 per day. (Unfortunately, the indictment doesn’t give any clear indication of their numbers, just referring to them as ‘they’.)

   This is a conservative estimate since I’m pretty sure that SR was a one-man operation until probably in 2012_12ya.

2. The servers: we know there were at least 2 servers (the main site, and the forums). The task of hosting the sites does not seem to be too bandwidth or disk-space intensive, and servers are extremely cheap these days. The use of DataClub.biz and GigaTux suggest DPR was using cheap VPSes. I’ll estimate a monthly expense of $500 ($250 a piece) which per day is $16.

   This is also very conservative.

3. DPR: his rent of $1,000/month has been widely bruited about, and in general he reportedly spent little. Makes sense to me, I’ve met and seen the rooms of a few well-paid geeks in SF like DPR, and I would believe them if they said they didn’t spend much money on anything but rent & food. I’ll bump this up by $1,000 for food and all expenses, since he apparently didn’t even eat out very much. So $frac200031=65$.

   Doubling his rent for total expenses is probably also conservative; for most people, rent is not >50% of income, but SF is incredibly expensive to live in.

This gives a daily expense of $652 (or a monthly total of $19.1k in expenses). As you can see, the employees are by far the most expensive part of running SR in my estimate, which makes me wonder if maybe Libertas was the only employee.

Revenue over Time: First and Last Days

Christin:

Table 3 provides a breakdown of the feedback ratings from 184,804 feedback instances we collected…In Figure 12, we plot an estimate of the daily commissions collected by Silk Road operators as a function of time. We simply reuse the previous estimates, and apply both the fixed 6.23% rate, and the schedule of Table 4 to each item. We find that the new schedule turns out to yield on average a commission corresponding to approximately 7.4% of the item price.

The FBI:

From February 6, 2011 to July 23, 2013 there were approximately 1,229,465 transactions completed on the site…$79.8 million (USD) in commissions.

According to Bitcoin Charts, on 2013-07-23, the MtGox price was $91. (As the most famous exchange, any FBI estimate almost certainly used it.) So that implies $\frac{79,800,000}{91}$=₿876,923. Or to put it the other way, at $79.8m in transactions, then using Christin’s 7.4% estimate, total sales were $1,078,000,000 or ₿10,780,000.

Wikipedia says “These transactions involved 146,946 unique buyer accounts, and 3,877 unique vendor accounts.”, and “The total revenue generated from transactions was 9,519,664 bitcoins. Commissions collected from the sales by Silk Road amounted to 614,305 bitcoins.”

(So the numbers aren’t too different: 614k vs 876k and 10.8m vs 9.5m.)

We’ll set 2011-02-06 to $10 in sales (probably not too far from the truth). But what about 2013-07-23? pg20 of the indictment says:

For example, on July 21, 2013 alone, DPR received approximately 3,237 separate transfers of Bitcoins into his account, totaling approximately $19,459. Virtually all of these transactions are labeled “commission”.

$\frac{19459}{0.074}$ = $262,959 that day. $20k in commissions is extremely impressive, since Christin estimates only $4k/day commissions as late as the end of July 2012—so SR must have grown by 500% 2012–2013. We use this revenue estimate as our endpoint and interpolate from $10 to $262,959 over the ~900 days SR existed. This is a conservative way of modeling SR, since the graphs in Christin indicate that SR saw sigmoid growth in 2012, and 2013 would’ve seen even more growth (to be consistent with the 2013 July commission datapoint being 5x the 2012 July commission datapoint).

Exchange Rate

I grab weighted price for each day between 2011-02-06 & 2013-07-23, and stuff it in a CSV.

Analysis

sr <- read.csv("https://gwern.net/doc/darknet-market/silk-road/1/dpr-exchangerate.csv")
sr$Sales <- c(10, rep(NA, 890), 262959, NA, NA)
## revenue increased by $300 a day:
l <- lm(Sales ~ as.numeric(Date), data=sr); l
# Coefficients:
#      (Intercept)  as.numeric(Date)
#             -285               295
sr$Sales <- predict(l, newdata=sr)
sum(with(sr, (Sales * 0.074 - 652) / ExchangeRate))
# [1] 803397

Or we can run the estimate the other way: if DPR had to spend $652 a day and converted at that day’s exchange rate, and we took into account the hitmen, how many bitcoins would he have spent in total?

sum(with(sr, 652 / ExchangeRate))
# [1] 127154
(614305 - 127154) - 4797
# [1] 482354

Conclusion

Obviously ₿803k > ₿614k, which implies that the linear model overestimates sales in the early life of SR; but going the other direction and estimating just from costs & hitmen & total commission, we still wind up with nearly ₿500k (and that was after making a bunch of highly conservative assumptions). The fewer sales (and commissions) early on, the less of a fixed number of bitcoins will be sold. So, while it may initially sound plausible that DPR could have been forced to part with say ₿400k to pay for SR and sundry expenses, the distribution of sales and fluctuations of Bitcoin value mean that this simply does not seem to be the case.

Unless there are some abandoned yachts floating around the SF Bay Area, DPR/Ross Ulbricht probably has ₿500k-614k.

Original

BMR & Sheep have demonstrated their danger, but few DNM-users seem to genuinely appreciate this. I am publicly betting that they will fail in the near-future. If you think I am wrong, just try to take my money and prove me wrong! Otherwise, spare us your cheap talk.

Hi! I’m Gwern Branwen. You may remember me from such DNM webpages as Silk Road: Theory & Practice, and /r/silkroad. Today I’m here to talk to you about BlackMarket Reloaded & Sheep Marketplace.

(A signed version of this 2013-10-30 post will be posted as a comment, because I wish to use Markdown formatting; my PGP key is available.)

Statistical Considerations

In my past betting & predicting, I have found it useful to start with some simple base rates & statistical calculations as a way of anchoring my subjective considerations. Neither approach is extremely reliable, but they can help us figure out what are reasonable-looking estimates and we can increase or decrease them based on the observed security issues to get a final estimate which will be better than either random guessing based on gut-feel or blind acceptance of numbers spat out by a model.

In my bet, I used an earlier version of this analysis, and after looking at the various results, settled on gut-estimates as follows:

1. BMR 6-month shutdown risk: 35%

2. BMR 12-month: 50%

3. Sheep 6-month: 40%

4. Sheep 12-month: 50%

After expanding the data to include Deepbay and continuing to observe the DNMs, I would personally decrease the risk for BMR and increase for Sheep (a choice vindicated when Sheep shut down with a scam in late November, not long after my analysis).

library(survival)
library(rms)
market <- read.csv(stdin(),header=TRUE, colClasses=c("factor","Date","Date","logical","factor"))
Marketplace,Started,Ended,Dead,Cause
SR,2011-01-27,2013-10-02,TRUE,external
Atlantis,2013-03-26,2013-09-21,TRUE,internal
Deepbay,2013-06-05,2013-11-04,TRUE,internal
Budster,2013-10-20,2013-10-21,TRUE,internal
ProjectBlackFlag,2013-10-14,2013-10-21,TRUE,internal
BMR,2011-06-10,2013-11-12,FALSE,NA
Sheep,2013-02-15,2013-11-12,FALSE,NA
BuyItNow,2013-04-02,2013-11-12,FALSE,NA
Pandora,2013-10-21,2013-11-12,FALSE,NA
SR2,2013-11-06,2013-11-12,FALSE,NA
Tormarket,2013-11-07,2013-11-12,FALSE,NA


market$Days <- as.integer(market$Ended - market$Started)
surv <- survfit(Surv(market$Days, market$Dead, type="right") ~ 1)
summary(surv)

 time n.risk n.event survival std.err lower 95% CI upper 95% CI
    1     11       1    0.909  0.0867        0.754            1
    7      8       1    0.795  0.1306        0.577            1
  152      6       1    0.663  0.1628        0.410            1
  179      5       1    0.530  0.1761        0.277            1
  979      1       1    0.000     NaN           NA           NA

# Confidence intervals show not enough datapoints to really estimate!
# 6-month mortality:
sixm <- 1 - (1-((1-0.53)/179))^(365.25/2); sixm
[1] 0.3813
# 12-month mortality
1 - (1-((1-0.53)/179))^(365.25)
[1] 0.6172

plot(surv, xlab="Days", ylab="Survival Probability function with 95% CI")

market$Type  <- as.factor("black.market")

exchange <- read.csv("https://gwern.net/doc/bitcoin/2013-moorechristin-bitcoinexchanges.csv")
exchange <- with(exchange, data.frame(Marketplace=Exchange, Started=as.Date(Origin), Ended=as.Date(Dates),
                                      Dead=as.logical(Closed), Cause=NA))
exchange$Days <- as.integer(as.Date(exchange$Ended) - as.Date(exchange$Started))
exchange$Type <- as.factor("exchange")

allSites <- rbind(exchange, market)

# plot aggregate survival curve
surv <- survfit(Surv(allSites$Days, allSites$Dead, type="right") ~ 1)
plot(surv, xlab="Days", ylab="Survival Probability function with 95% CI")

cpmodel <- cph(Surv(Days, Dead) ~ Type, data = allSites, x=TRUE, y=TRUE, surv=TRUE)
cpmodel
# ...
#                   Coef   S.E.   Wald Z Pr(>|Z|)
# Type=black.market 0.2128 0.5644 0.38   0.7061

conditionalProbability <- function (d, followupUnits, cmodel) {
    chances <- rep(NA, nrow(d)) # stash results

    for (i in 1:nrow(d)) {

        # extract chance of particular subject surviving as long as it has:
        beginProb <- survest(cmodel, d[i,], times=(d[i,]$Days))$surv
        if (length(beginProb)==0) { beginProb <- 1 } # set to a default

        tmpFollowup <- followupUnits # reset in each for loop
        while (TRUE) {
            # extract chance of subject surviving as long as it has + an arbitrary additional time-units
            endProb <- survest(cmodel, d[i,], times=(d[i,]$Days + tmpFollowup))$surv
            # survival curve may not reach that far! 'survexp returns 'numeric(0)' if it doesn't;
            # so we shrink down 1 day and try again until 'survexp' *does* return an usable answer
            if (length(endProb)==0) { tmpFollowup <- tmpFollowup - 1} else { break }
        }

        # if 50% of all subjects survive to time t, and 20% of all survive to time t+100, say, what chance
        # does a survivor - at exactly time t - have of making it to time t+100? 40%: 0.20 / 0.50 = 0.40
        chances[i] <- endProb / beginProb
    }
    return(chances)
}
allSites$SixMonth <- conditionalProbability(allSites, (365/2), cpmodel)
allSites$OneYear <- conditionalProbability(allSites, 365, cpmodel)

allSites[allSites$Type=="black.market" & !allSites$Dead,][c(1,8,9)]
   Marketplace SixMonth OneYear
# 46         BMR   1.0000  0.3679
# 47       Sheep   0.8084  0.6429
# 48    BuyItNow   0.8248  0.7286
# 49     Pandora   0.6934  0.5720
# 50         SR2   0.6765  0.5579
# 51   Tormarket   0.6765  0.5579