Survival analysis of lifespans, deaths, and predictive factors of Tor-Bitcoin darknet markets
I compile a dataset of 87 public English-language darknet markets (DNMs) 2011–52016 in the vein of the famous Silk Road 1, recording their openings/closing and relevant characteristics. A survival analysis indicates the markets follow a Type TODO lifespan, with a median life of TODO months. Risk factors include TODO. With the best model, I generate estimates for the currently-operating markets.
The most striking aspect of darknet markets (DNMs; online websites selling drugs and other goods using cryptocurrencies), after the fact that they are so successful and exist at all, is how much turnover there is. The casual observer of DNMs will quickly become confused by the sheer number of DNMs over time, and their short lifetimes. How many are there? What predicts longer or shorter lifetimes? Why are they so transient? How do they die? Here I try to shed some light on these questions by tabulating all known launched English-language DNMs from the invention of the business model by Silk Road 1 up through 2016. I am interested in websites selling drugs over Tor or i2p, using cryptocurrencies like Bitcoin/Litecoin/Dogecoin, allowing multiple sellers other than the site operators, and providing some sort of escrow functionality. This excludes clearnet sites like Topix, single-vendor shops like Modern Culture or Bungee54, carding shops like Tor Carders Market, hosting services like Cryuserv or Bad Wolf, DNM-focused forums like The Hub, and forums for buyers & sellers to deal directly with each other like The Majestic Garden.
Foreign language markets are excluded because I cannot navigate them1; DrugMarket, Bigshop & a few others are excluded because they reportedly have always been a scam (similarly for most sites listed on the notoriously wrong Hidden Wiki); the Majestic Garden & Underground Market Board 3.0 are excluded because they are forums & do not do escrow for their users; Grand Trunk never left beta & had actual sales.
Data
Variables:
-
start/end dates are, when possible, the date of the first & last known sales/withdrawals; otherwise they are rounded to my first/last visit to them; or to the start/end of the month they appeared/disappeared
-
closure: whether the shut down was due to law enforcement, precipitated by a hack or de-anonymization, a scam/theft by operators, or voluntary (without known losses to users)
-
arrested: whether the principal operator/owner/maintainer of the marketplace was arrested for running it (this excludes hired staff)
-
multisig: whether 2-of-3 escrow supported; 2-of-2 and other ‘lite’ versions are not considered multisig because they still allow for thefts
-
i2p: whether i2p is used in addition/instead of Tor
-
hacks: number of publicly known hacks resulting in leaks of user information, loss of funds, etc
-
doxed: whether a plausible candidate for site operators has been made publicly known by law enforcement or other people
-
codebase: the origin of the source code for a site where anything is publicly known; ‘custom’ simply means the site operators seem to have written it themselves
-
coin: principal cryptocurrency of marketplace; if multiple coins are accepted, I list the most prominent altcoin
-
guns: whether firearms were sold, specified in rules/policies as allowed to be sold, or rules/policies specified there were no bans on item categories
-
fraud: whether carding items like credit card dumps were sold etc (this does not include fake IDs or informational guides on how to commit fraud; the former have uses besides carding, and the latter are often outdated or just scams)
Table
A table of 87 DNMs (updated 2019-06-09):
Market |
Start |
End |
Alive |
Closure |
Arrested |
URL |
Multisig |
I2P |
Bitcoin |
Litecoin |
Dogecoin |
Darkcoin |
Codebase |
Guns |
Fraud |
Hacks |
Doxed |
Notes |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Silk Road 1 |
2011-01-31 |
2013-10-02 |
FALSE |
raided |
TRUE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
2 |
TRUE |
SR1 temporarily sold guns as part of “the Armory” but only for a brief time as sales were poor. |
BlackMarket Reloaded |
2011-06-30 |
2013-12-02 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
TRUE |
TRUE |
1 |
FALSE |
backopy stopped buying on 2 Dec aggravated in part by a big theft, fully shutdown by 23 December. May reopen. BMR permitted gun sales, and also seems to have permitted credit card information sales, judging by angry feedback. |
Atlantis |
2013-03-26 |
2013-09-20 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
FALSE |
FALSE |
0 |
FALSE |
Atlantis’s shutdown seems, judging by comments on Reddit pages & All Things Vice to have initially allowed withdrawals, but disabled it after a few days and then stole the remaining deposits+escrow+vendor-bonds. |
Sheep Marketplace |
2013-02-28 |
2013-11-29 |
FALSE |
scam |
TRUE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Nette |
FALSE |
TRUE |
1 |
TRUE |
withdrawals were halted before 29 Nov, but deposits & sales were ongoing. I choose 29 Nov as the day where the Sheep scam became irrefutable. Strictly speaking, an operator has not been arrested as of 2015-03-27, but the suspected operator is in legal trouble over money-laundering of large Bitcoin-related sums. |
Deepbay |
2013-06-30 |
2013-11-04 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
FALSE |
FALSE |
0 |
FALSE |
Disappeared with funds; based on a screenshot of categories, seems to have been almost exclusively drugs. |
Budster |
2013-10-10 |
2013-10-20 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
WordPress |
FALSE |
FALSE |
1 |
TRUE |
https://www.reddit.com/r/Budster/comments/1ove9w/has_anyone_made_a_purchase_yet/ccw8srh https://www.reddit.com/r/DarkNetMarkets/comments/1xyixa/psa_cyruserv_is_down_for_good_budster_taf_hosting/ Budster did not seem to use genuine multisig and this enabled the scam: https://www.reddit.com/r/SilkRoad/comments/1opmha/budster_the_worlds_first_p2p_marketplace/ |
Project Black Flag |
2013-10-14 |
2013-10-28 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
TRUE |
1 |
FALSE |
https://www.reddit.com/r/DarkNetMarkets/comments/1peguv/pbf_rip/ ; forums: |
TorMarket |
2013-11-07 |
2013-12-22 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
FALSE |
TRUE |
1 |
FALSE |
Part of the TorMarket user list was leaked by DPR2 on SR2F; TM also admitted other security issues, but further rumors that TorMarket’s shut down was precipitated by a hack by “Profesorhouse” have not been substantiated. TM may have used Bitwasp, but it didn’t seem to have Bitwasp error pages and doesn’t really look like the usual Bitwasp DNM. |
FloMarket |
2013-12-01 |
2014-01-01 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
2 |
FALSE |
Apparently hacked 2013-12-20 (previously noted to be hackable); withdrawals began failing on 2014-01-01 & FloMarket announced a second hack on 2014-01-06; for the operator’s explanation, see his interview |
||
Tortuga |
2013-12-16 |
2014-01-05 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Seagull |
0 |
FALSE |
Advertised in the SR2F on 2013-12-19; advertised on the BMR forums on 16 Dec. Up on 2014-01-01, down on 2014-01-09 & afterwards. No news about reasons for its closure. No official rules on listings were posted before it disappeared, probably because it was unpopular enough that content was not an issue. |
||
BlackBox Market |
2013-11-12 |
2014-02-01 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
TRUE |
TRUE |
0 |
FALSE |
Interesting site, but not sure it should be listed here. Start date based on Reddit. Site stopped responding 2014-02-01. On-site escrow did not use multisig (“We do not make use of the Escrow services provided by Bitcoin itself as this associates buyers and sellers.”) Policies based on the fact that BBM could not know what was being sold on it and so de facto permitted both categories. |
GreyRoad |
2014-01-04 |
2014-02-01 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
TRUE |
TRUE |
0 |
FALSE |
Went public 2013-01-04 (2), operator claims to have been selling for a while but refuses to provide any specifics & very few sellers on market so opening date is used; forums: |
Cantina |
2014-01-20 |
2014-02-07 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Nette |
TRUE |
TRUE |
3 |
TRUE |
Cantina spammed vendors on SR2F on 2014-01-20; earliest known mention of the market. It was repeatedly hacked & doxed. Cantina had no stated policies, but it did have a category for guns and given the ‘Data’ categories & general lack of ethics & greed, highly likely would have permitted carding had it not died so ignominiously. |
Breaking Bad |
2014-02-01 |
2014-02-06 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
TRUE |
TRUE |
0 |
FALSE |
Announced on Reddit; site went down 6 February, owner explained shutdown due to “Lack of interest from vendors, constant hate mail, downvotes and claims on security vulnerabilities” |
Black Goblin Market |
2014-02-03 |
2014-02-04 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Drupal |
TRUE |
TRUE |
0 |
TRUE |
Announced on Reddit; I de-anonymized the site, so it shut down. The “Black Goblin Rules” page does not mention any ban of guns or carding. |
Cannabis Road |
2014-02-03 |
2014-02-07 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
1 |
TRUE |
Announced on The Hub; thoroughly hacked & de-anonymized |
Utopia |
2014-02-03 |
2014-02-11 |
FALSE |
raided |
TRUE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
CakePHP |
TRUE |
TRUE |
0 |
TRUE |
forums: |
Black Services Market |
2013-12-02 |
2014-02-01 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
OSclass |
TRUE |
TRUE |
0 |
FALSE |
Start date based on oldest listing when I checked on 2013-12-26; last admin forum post 18 Jan & PMs to him disabled, reports of escrow problems in late Jan/early Feb, many complaints on forums; site went down 2014-02-14 |
Red Sun Marketplace |
2014-03-20 |
2014-03-23 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
FALSE |
TRUE |
1 |
FALSE |
Announced on Reddit; hacked (SQli etc); forum: |
BuyItNow |
2013-04-30 |
2014-02-17 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
WordPress |
TRUE |
FALSE |
0 |
FALSE |
Site did not respond on 2014-02-17 or afterwards; no reports on shutdown reason or whether it was a scam. Policies not specified, but many listings for guns, and none of any kind related to carding. |
White Rabbit |
2013-12-23 |
2014-02-01 |
FALSE |
scam |
FALSE |
|
FALSE |
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
unknown |
TRUE |
TRUE |
0 |
TRUE |
Start date based on Reddit posts. Formerly named “Rabbit’s Marketplace”. Unable to find reports of successful sales on The Hub or Reddit, and WR withdrawal has been broken at least since 2014-02-21; no one has claimed withdrawals recently. Dead date is based on the February news notice “There are problems with payment gateway”. Forum states only CP is banned (“Items which are not allowed: child porn (and other sick stuff).”) i2p: |
FreeBay |
2013-12-01 |
2014-02-28 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
TRUE |
FALSE |
FALSE |
unknown |
FALSE |
TRUE |
0 |
FALSE |
URL is also apparently |
drugslist |
2014-01-08 |
2014-02-28 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
1 |
FALSE |
Withdrawals began failing & admin ceased responding in February 2014; date closure to the forum admin account’s last login. |
Doge Road |
2014-01-18 |
2014-03-13 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
FALSE |
FALSE |
TRUE |
FALSE |
Bitwasp |
FALSE |
TRUE |
0 |
FALSE |
Announced on Reddit; forums: |
TorEscrow |
2014-02-02 |
2014-04-19 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
FALSE |
TRUE |
0 |
FALSE |
Initially just an escrow, but TE expanded into a market. Forums: |
Armory Vendor Market |
2014-02-06 |
2014-04-07 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
FALSE |
FALSE |
FALSE |
TRUE |
Quick.Cart |
TRUE |
FALSE |
1 |
FALSE |
Announced on Reddit; their Cryuserv hosting, according to the hacker, dated back to 2013-05-23 but it’s unclear when they had their first sale. It announced use of Darkcoin in March 2014. |
Darknet Nation |
2014-02-19 |
2014-03-01 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Joomla |
TRUE |
TRUE |
0 |
TRUE |
Announced on Reddit; Q&A. The site leaked its IP address. Down 2014-04-03; best guess, shut down sometime in March (the administrator’s last post on The Hub was 2014-03-01.) |
Sanitarium Market |
2014-02-20 |
2014-03-28 |
FALSE |
voluntary |
FALSE |
|
FALSE |
TRUE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
0 |
FALSE |
Announced on Reddit; long address: |
||
Hansa |
2014-03-09 |
2014-03-20 |
FALSE |
raided |
TRUE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
TRUE |
TRUE |
0 |
TRUE |
Announced on Reddit & de-anonymized; closure date based on last transaction by their IP. They planned to implement multisig but seem to have shut down before it went live. Bitwasp classification based on two comments & screenshot of login page. They appeared to be a voluntary shut down but had been subverted by Dutch police & multisig disabled & turned into a honeypot for monitoring buyer addresses, seller geotagged images, and malware. |
EXXTACY |
2014-03-23 |
2014-03-24 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Drupal |
0 |
TRUE |
Announced & de-anonymized on Reddit. No information about policies is available, although since it seems to’ve been run by Sanitarium, it likely had whatever they did. Died before any rules announced or mirrors made. |
||
Mr Nice Guy |
2014-03-29 |
2014-04-20 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
FALSE |
FALSE |
0 |
TRUE |
Announced on Reddit; forum: |
TorBay |
2013-12-18 |
2014-04-20 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
hyops |
FALSE |
TRUE |
0 |
TRUE |
Start date based on Reddit announcement; ceased responding in April 2014, after listings had fallen to near-zero. |
DarkBay |
2014-01-30 |
2014-05-01 |
FALSE |
voluntary |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
FALSE |
TRUE |
0 |
TRUE |
Announced on Reddit; forums: |
Pigeon Market |
2014-04-14 |
2014-05-07 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
TRUE |
TRUE |
0 |
FALSE |
Unknown what happened to funds. |
Free Market |
2015-01-14 |
2015-02-26 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
0 |
FALSE |
|
Tortuga 2 |
2014-04-23 |
2014-06-17 |
FALSE |
voluntary |
FALSE |
|
TRUE |
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
Drupal |
FALSE |
FALSE |
0 |
FALSE |
Announced on Reddit; i2p: |
Deepzon |
2014-05-14 |
2014-07-13 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
TRUE |
TRUE |
0 |
FALSE |
Support’s response: “Guns/Weapons are allowed, we thought that would be clear, as we are having the category ‘Weapons’ listed. CC-Dumps are also allowed.”’ ; unknown what happened to funds. |
Silk Street |
2014-04-08 |
2014-08-04 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
FALSE |
FALSE |
0 |
FALSE |
Announced on The Hub; no reports of withdrawals, so marked false. No explicit policies, but UI shows many empty categories but no empty categories for fraud or gun items, so I presume those were not permitted. |
Underground Market |
2014-04-09 |
2014-08-26 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
TRUE |
TRUE |
0 |
FALSE |
Announced on Reddit; forums: |
Cannabis Road 2 |
2014-03-28 |
2014-08-25 |
FALSE |
hacked |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
1 |
FALSE |
Forum: |
Pandora |
2013-10-21 |
2014-08-19 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
TRUE |
2 |
FALSE |
See “Forbidden Items on PANDORA”. Pandora has had 2 hacks: the first was a rogue moderator using an admin account, and the second was a loss of half the centralized escrow (repaid by levying extraordinary transaction fees). The operator eventually locked out all seller accounts around 19/2014-08-20 (definitely by 1 September) and disabled withdrawals & the site forums, but continued accepting deposits from buyers; he may also have captured login credentials and robbed accounts on other marketplaces according to several sellers. Targeted in Operation Onymous but had already turned scammer. |
Pirate Market |
2013-11-29 |
2014-08-15 |
FALSE |
scam |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
TRUE |
TRUE |
0 |
FALSE |
Start date based on Reddit. Originally RoadSilk; multisig. Site reportedly began blocking withdrawals ~2014-08-15 while still accepting deposits, with the Pirate Market forum being shut down several days later. |
Freedom Market |
2014-09-16 |
2014-09-25 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
FALSE |
FALSE |
0 |
FALSE |
Announced on Reddit; went down without notice sometime before 2014-09-25. Site rules: “If the item doesn’t hurt others, you can sell it.”; the categories included “Forgeries” but nothing else, so carding probably counted as ‘hurting others’. |
1776 |
2014-04-19 |
2014-10-02 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
ASP.NET |
FALSE |
FALSE |
0 |
FALSE |
Announced by DeepDotWeb & on Reddit. Not Bitwasp, given the traceback on error pages. No policy documentation. Disappeared starting 2014-10-03. |
Silk Road 2 |
2013-11-06 |
2014-11-05 |
FALSE |
raided |
TRUE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
2 |
TRUE |
Forum moderator Cirrus advises considering SR2 compromised (2013-12-22, ironic inasmuch as Cirrus was the LE undercover agent who undid SR2 and helped with SR1); new operators Defcon/Hux/etc deny it. Defcon announced the cold wallet had been lost to DPR2, but then that it had been restored. SR2 experienced repeated account balance problems, failed to ever implement autofinalize or dispute resolution (forcing accumulation of orders’ balances), and announced 2014-02-13 that all deposits & escrow had been stolen, followed by another hack in September 2014. Use of SR was not advised. Was raided by Operation Onymous & Defcon arrested. |
Hydra |
2014-03-27 |
2014-11-05 |
FALSE |
raided |
TRUE |
|
TRUE |
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
Bitwasp |
TRUE |
TRUE |
0 |
FALSE |
Announced on The Hub; forum: |
Cloud-Nine |
2014-02-11 |
2014-11-05 |
FALSE |
raided |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Cloud-9 |
FALSE |
TRUE |
0 |
FALSE |
Announced on Reddit; on banned items. Raided in Operation Onymous. |
Blue Sky |
2013-12-03 |
2014-11-05 |
FALSE |
raided |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
FALSE |
FALSE |
0 |
FALSE |
Or is the opening 2013-12-12? Raided in Operation Onymous. |
TorBazaar |
2014-01-26 |
2014-11-05 |
FALSE |
raided |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
TRUE |
TRUE |
0 |
FALSE |
Announced on The Hub; original centralized escrow site: |
Topix 2 |
2014-03-25 |
2014-11-05 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
0 |
FALSE |
Started January 2014; opened to public 2014-09-28, previously was invite-only; start date based on first sale listed in recent-feedback page; apparently drug-only based on the listings. Shut down without notice after Operation Onymous. |
Alpaca Marketplace |
2014-04-20 |
2014-11-05 |
FALSE |
scam |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
TRUE |
FALSE |
1 |
FALSE |
Announced on The Hub; policies based on Secret Laboratory writeup Hacked mid-May 2014. Alpaca allows weapons (but not poisons/WMDs/hitmen) and appears to ban carding: “We do not allow items that are advertised as stolen.” Shut down after Operation Onymous (seizure notice) without returning any funds. |
Cannabis Road 3 |
2014-10-06 |
2014-11-05 |
FALSE |
scam |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Alpaca |
FALSE |
FALSE |
0 |
FALSE |
Forum: |
Andromeda |
2014-04-05 |
2014-11-18 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
TRUE |
TRUE |
0 |
FALSE |
Formerly Silk Road 3/ |
The Marketplace |
2013-11-28 |
2014-11-09 |
FALSE |
voluntary |
FALSE |
|
TRUE |
TRUE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
TRUE |
0 |
FALSE |
Start date from personal communication; Tor Proxy: |
Onionshop |
2014-05-18 |
2014-09-17 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
TRUE |
TRUE |
1 |
FALSE |
Announced on Reddit; hacked 2014-09-17 (announcement, hacker) |
|
TOM |
2014-05-10 |
2014-12-18 |
FALSE |
scam |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
FALSE |
FALSE |
0 |
FALSE |
Forums: |
Area51 |
2014-06-20 |
2015-01-24 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
TRUE |
TRUE |
0 |
FALSE |
Spammed on The Hub; implementation is PHP on Debian, admin states “area51 is complete selfcoded and we have nothing to do with bitwasp”. Centralized escrow & no reports of deposits being returned. |
Panacea |
2014-10-27 |
2015-02-13 |
FALSE |
voluntary |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Cloud-9 |
FALSE |
FALSE |
1 |
TRUE |
Reddit ANN; forums: |
evolution |
2014-01-14 |
2015-03-14 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Laravel |
TRUE |
TRUE |
0 |
FALSE |
Announced on Reddit 20 Jan, but forums claim first sale on 14 January; forums: |
Ironclad |
2015-03-17 |
2015-03-25 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
TRUE |
TRUE |
0 |
FALSE |
ANN; forums: |
Kiss |
2015-02-19 |
2015-05-16 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
1 |
FALSE |
ANN; forum: |
BlackBank Market |
2014-02-05 |
2015-05-18 |
FALSE |
scam |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
TRUE |
TRUE |
0 |
FALSE |
Active before its Reddit announcement but no apparent sales. Forums: |
Tornado |
2015-05-12 |
2015-05-20 |
FALSE |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
FALSE |
FALSE |
0 |
FALSE |
ANN; forums: |
||
Havana/Absolem |
2015-04-13 |
2015-05-22 |
FALSE |
hacked |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
FALSE |
FALSE |
0 |
FALSE |
Opened initially invite-code-only; forums: |
|
Agape |
2015-05-29 |
2015-06-04 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
FALSE |
FALSE |
0 |
FALSE |
ANN. Voluntarily shut down due to lack of interest and “backlash”. |
|
Zanzibar Spice |
2015-05-07 |
2015-06-14 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
0 |
FALSE |
ANN; server began throwing errors 2015-06-14 with no market communication. |
Dream Market |
2013-11-15 |
2019-04-30 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
unknown |
FALSE |
TRUE |
0 |
FALSE |
Site claims to’ve opened 2013-11-15; first mention of it I found was on 2014-01-07. Later moved to |
Agora |
2013-12-03 |
2015-09-06 |
FALSE |
voluntary |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
TRUE |
TRUE |
0 |
FALSE |
Forums: |
Outlaw Market |
2013-12-29 |
2017-05-16 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
TRUE |
FALSE |
3 |
FALSE |
Open date based on the date of the “Welcome” post on the OM forum; apparently formerly “Drugs’n’Bets”. Site was hacked & user PMs released in 201311ya; site shut down 2014-07-31 after an attack blame on former admins when “A SESSION-hack was performed and a couple of datasets manipulated but not much damage created”. They claim in an interview it’s custom software; this is confirmed by a leak of PHP source which does not call any frameworks/CRMs. Policies based on no apparent hits among mirrors. Ex-staff insist it was not an exit scam but a genuine hack. |
Middle Earth Marketplace |
2014-06-22 |
2015-11-04 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Django |
FALSE |
TRUE |
0 |
FALSE |
Announced on Reddit. Exit-scammed sometime around October-November 2015; some issues with withdrawals reported in late October, then the site went down for ‘maintenance’ around 2015-11-04, and coins were definitely being moved by the admins by 2015-11-06 . |
Diabolus/SR3 |
2014-10-13 |
2017-02-12 |
FALSE |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
TRUE |
custom |
FALSE |
FALSE |
0 |
FALSE |
Cannabis-only. Unclear when it shut down so I assign it the same date as CM, which was operated by the same team. |
|
Nucleus Marketplace |
2014-10-24 |
2016-04-13 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
TRUE |
FALSE |
TRUE |
Laravel |
TRUE |
TRUE |
0 |
FALSE |
Went down 2016-04-13 according to DNstats & Reddit. Apparent non-movement of market coins has prompted speculation about arrests, but no busts has been announced as of 2016-08-18. |
Abraxas |
2014-12-13 |
2015-11-05 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
TRUE |
Laravel |
FALSE |
TRUE |
0 |
FALSE |
forums: |
AlphaBay |
2014-12-22 |
2017-07-05 |
FALSE |
raided |
TRUE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
TRUE |
TRUE |
0 |
FALSE |
|
Silk Road Reloaded |
2015-01-13 |
2016-02-27 |
FALSE |
FALSE |
|
FALSE |
TRUE |
TRUE |
TRUE |
TRUE |
TRUE |
custom |
FALSE |
TRUE |
0 |
FALSE |
Full I2P address: |
|
Tochka |
2015-01-30 |
TRUE |
FALSE |
|
FALSE |
FALSE |
TRUE |
TRUE |
TRUE |
TRUE |
custom |
FALSE |
FALSE |
0 |
FALSE |
Announced on Reddit; site rules ban “Counterfeit documents” which I interpret as banning carding in general. |
||
Crypto Market |
2015-02-14 |
2017-02-12 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
TRUE |
TRUE |
0 |
FALSE |
ANN; CM is run on / by Diabolus and not entirely separate. According to DNstats.net, Crypto Market was last observed up on 2017-02-12, but there are complaints in January 2017 on Reddit so I’m not sure when it really went down. In any case, the escrow funds apparently were not returned. |
Mr Nice Guy 2 |
2015-02-21 |
2015-10-14 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
0 |
TRUE |
Operator claims doxing was just of “a volunteer”. Went down October 14, 2015 according to DNstats. |
TheRealDeal |
2015-04-09 |
2016-10-22 |
FALSE |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
TRUE |
TRUE |
0 |
FALSE |
Interview, ANN; forums: |
|
Oxygen |
2015-04-16 |
2015-08-27 |
FALSE |
scam |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
TRUE |
1 |
FALSE |
ANN. Was hacked around January 2015 by a vendor exploiting an early finalization bug to scam customers. Went down 2015-08-27 according to DNstats. |
East India Company |
2015-04-28 |
2016-01-01 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
FALSE |
FALSE |
1 |
FALSE |
ANN; EU-only. Claims to’ve lost $14,027.6₿302015 to a hacker in early August 20152016-01-01–2d2016-01-02 for a week or so, then a maintenance message, then came back uDNstats. |
Haven |
2015-05-05 |
2015-06-06 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
custom |
TRUE |
TRUE |
0 |
FALSE |
ANN Went down 2015-06-06 according to DNstats; not much discussion of its closure. |
Anarchia |
2015-05-07 |
2016-05-09 |
FALSE |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
Bitwasp |
TRUE |
TRUE |
0 |
FALSE |
ANN. Still around 2015-07-09 judging from spam for it; may have gone down 2016-05-09 for unclear reasons. No discussion of its closure on Reddit, DDW, The Hub, or I can find in Google. |
|
Darknet Heroes League |
2015-05-27 |
2017-08-05 |
FALSE |
hacked |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
0 |
FALSE |
Not explicitly announced. Disappeared after vulnerabilities & IP disclosed. |
|||
Poseidon |
2015-06-02 |
2015-06-29 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
TRUE |
TRUE |
0 |
TRUE |
Server de-anonymized by TheRealDeal ~2015-06-02 & was in Latvia. From the few mentions of it afterwards, Poseidon apparently disabled withdrawals and then disappeared within a few months. |
|
Amazon Dark |
2015-06-08 |
2015-10-25 |
FALSE |
scam |
FALSE |
|
TRUE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
FALSE |
FALSE |
0 |
FALSE |
ANN. Around 2015-10-22–4d2015-10-25, complaints began appearing about administrators not responding & withdrawals failing; former spokesperson says it was an exit scam; went down 2015-10-28, according to DNstats. |
|
Simply Bear |
2015-06-20 |
2015-10-21 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
FALSE |
TRUE |
0 |
FALSE |
ANN. Went down 2015-10-21 according to DNstats; no mentions of whether it might’ve shut down earlier anywhere else. |
|
Horizon Market |
2015-05-23 |
2015-07-08 |
FALSE |
scam |
FALSE |
|
FALSE |
FALSE |
TRUE |
FALSE |
FALSE |
FALSE |
TRUE |
TRUE |
0 |
FALSE |
Was French-only until mid-June 2015; opening date based on earlier last-seen dates for the lowest-numbered vendors. Disappeared sometime before 2015-07-08, according to the DDW changelog. |
See also DeepDotWeb’s list (changelog), DNstats2, the DNM market list, and the Hidden Wiki (last updated 2014-08-30).
I may add to the table other variables; possibly useful ones:
-
2-factor-authentication
-
Vendor PGP enforced
-
FE status
-
ideology: whether the operator seems ideological (I suspect SR1 may have lasted longer than most post-SR1 markets because Ulbricht’s agorist ideology meant he was not profit-motivated & refused to do an exit scam or shutdown when SR1 was being extorted and may even have been running at loss; but after watching markets in 2014–2015, it seems that such a variable is unlikely to be useful: Ulbricht is the only one clearly ideological, and the rest seem to be aping it or too quiet to tell. Just because the operators say something doesn’t mean they believe it, and many say nothing.)
-
volume (at what time?)
-
how much money was lost when the site scammed or was hacked (only reasonably known for a few scams…)
-
apparent nationality of operator
-
media coverage
-
number of employees (can official claims be trusted?)
-
mandatory role separation (fully-separate buyer/seller/admin/staff accounts)
Analysis
TODO:
“The death rate of bitwasp marketplaces will always be higher because it lowers the barrier of entry to starting and launching your own BTC marketplace so less technical people with lesser funds to start the marketplace will use it and that demographic has a higher chance of failure.”
From a predictive standpoint, it doesn’t much matter why Bitwasp correlates with shorter lifetimes - whether it’s through greater likelihood of being hacked or self-selection by weak-willed/poor/uncommitted/incompetent operators. As long as it does, it’ll improve predictions by predicting shorter lifetimes for Bitwasp-using marketplaces, and so it’s less safe for buyers: even if the marketplace is using multisig, there’s still some limited scope for an exit scam; it wastes one’s investment in learning how to use a marketplace; and sellers lose any bond they put up. (Multisig is great and I’ve been advocating for it for a long time, but it’s not a silver bullet.)
In any case, I can try checking if using Bitwasp correlates with being hacked, not just shut down. The sample is currently small enough that the results won’t mean much regardless, though.
library(XML)
library(RCurl)
html <- getURL("https://gwern.net/dnm-survival#table")
black <- readHTMLTable(html, colClasses = c("factor", as.Date, as.Date, "logical", "factor", "logical", "character", "logical", "logical", "logical", "logical", "logical", "logical", "factor", "logical", "logical", "integer", "logical", "character"))[[1]]
black[black$Codebase=="",]$Codebase <- "unknown"
black$Start <- as.Date(black$Start); black$End <- as.Date(black$End)
black[is.na(black$End),]$End <- Sys.Date() # assuming the table is up to date
black$Age <- black$End - black$Start
black$Age <- as.integer(black$End - black$Start)
# for some markets, these values are impossible to find: they were never decided on, or the market is gone
# there's only a few, so I'm not sure the complexity of multiple-imputation is worthwhile (MICE objects work with almost no libraries...)
# so for the 2 relevant columns so far, I do a simple impute of the median/mode value
black[is.na(black$Fraud),]$Fraud <- as.logical(median(black$Fraud, na.rm=T))
black[is.na(black$Guns),]$Guns <- as.logical(median(black$Fraud, na.rm=T))
# for competing-risks modeling
levels(black$Closure) <- c("unknown", "hacked", "raided", "scam", "voluntary") # sets "" to "unknown"
black <- black[order(black$Start),]
library(survival)
# plot(survfit(Surv(Age, Alive, type="right") ~ 1, data=black), xlab="Days active", ylab="Fraction of markets still active")
# generate fancy timeline of DNM openings/closing:
library(ggplot2)
png(file="~/wiki/doc/darknet-market/silk-road/1/gwern-marketlifetimes.png", width = 1200, height = 2500)
ggplot(black, aes(colour=Closure)) +
geom_segment(aes(x=Start, xend=End, y=sort(decreasing=TRUE, reorder(Market,Start)), yend=sort(decreasing=TRUE, reorder(Market,Start))), size=3) +
xlab("Open") + ylab("Market") + theme(legend.position="bottom", axis.text=element_text(hjust=1, size=20)) + scale_y_discrete(labels = sort(decreasing=TRUE, reorder(black$Market, black$Start)))
invisible(dev.off())
library(lubridate)
cmodel <- coxph(Surv(Age, Alive) ~ year(black$Start) + Multisig + I2P + Bitcoin+Litecoin+Dogecoin+Darkcoin + Codebase + Guns + Fraud + Hacks + Doxed, data = black, control=coxph.control(iter.max=10000)); cmodel
with(black, survdiff(Surv(Age,Alive)~as.factor(year(Start))))
cmodel2 <- coxph(Surv(Age, Alive) ~ as.factor(year(black$Start)) + ridge(Multisig, I2P, Bitcoin,Litecoin,Dogecoin,Darkcoin, Codebase, Guns, Fraud, Hacks, Doxed), data = black); summary(cmodel2)
cmodel <- coxph(Surv(Age, Alive) ~ strata(year(black$Start)), data = black); cmodel
black$URL <- black$Notes <- black$Market <- NULL
Example competing-risks model using startup data:
# https://blogs.wsj.com/venturecapital/2014/11/20/techstars-graduates-success-rates-what-the-numbers-show/
# data:application/octet-stream;charset=utf-8,Year%2C2007%2C2008%2C2009%2C2010%2C2011%2C2012%2C2013%2C2014%0AActive%2C2%2C2%2C7%2C15%2C36%2C68%2C121%2C120%0AFailed%2C3%2C4%2C5%2C11%2C9%2C10%2C5%2C0%0AAcquired%2C5%2C4%2C7%2C5%2C14%2C15%2C4%2C1
rates <- read.csv(stdin(),header=TRUE)
Year,2007,2008,2009,2010,2011,2012,2013,2014
Active,2,2,7,15,36,68,121,120
Failed,3,4,5,11,9,10,5,0
Acquired,5,4,7,5,14,15,4,1
library(reshape2)
rates2 <- melt(rates)
colnames(rates2) <- c("Status", "Year", "Count")
rates2$Year <- as.integer(substring(as.character(rates2$Year), 2))
startups <- NULL
for (i in 1:nrow(rates2)) { startups <- rbind(data.frame(Status = rep(rates2[i,]$Status, rates2[i,]$Count), Year=rep(rates2[i,]$Year, rates2[i,]$Count)), startups) }
library(survival)
startups$Alive <- startups$Status == "Active"
startups$Age <- 2014 - startups$Year
sf <- survfit(Surv(Age, Alive, type="right") ~ 1, data=startups); summary(sf)
# time n.risk n.event survival std.err lower 95% CI upper 95% CI
# 0 473 120 0.74630 0.020007 0.708099 0.78656
# 1 352 121 0.48976 0.023007 0.446680 0.53699
# 2 222 68 0.33974 0.022007 0.299236 0.38573
# 3 129 36 0.24493 0.020778 0.207412 0.28924
# 4 70 15 0.19245 0.020269 0.156552 0.23657
# 5 39 7 0.15790 0.020407 0.122571 0.20342
# 6 20 2 0.14211 0.021202 0.106083 0.19038
# 7 10 2 0.11369 0.024715 0.074248 0.17409
plot(sf)
# https://i.imgur.com/76B7AxN.png
library(cmprsk)
sc <- cuminc(startups$Age, startups$Status, cencode="Active"); sc
# Estimates and Variances:
# $est
# 1 2 3 4 5 6
# 1 Acquired 0.0134537767 0.0791545678 0.172799416 0.223444079 0.321616811 0.397350061
# 1 Failed 0.0141745147 0.0579750421 0.118175302 0.229593560 0.299716940 0.375450190
#
# $var
# 1 2 3 4 5 6
# 1 Acquired 3.62406271e-05 0.000301240943 0.000805565675 0.00118663857 0.00205862260 0.00275961348
# 1 Failed 3.97263451e-05 0.000220342717 0.000570181024 0.00140171794 0.00200661959 0.00272841167
plot(sc, lty=1, color=c(3,2))
# https://i.imgur.com/Tafk9B0.png
DNMs:
library(cmprsk)
blackc <- with(black, cuminc(Age, Closure, cencode="alive")); blackc
# Estimates and Variances:
# $est
# 200 400 600 800 1000 1200
# 1 unknown 0.01136363636 0.02272727273 0.03409090909 0.07954545455 0.10227272727 0.11363636364
# 1 hacked 0.11363636364 0.11363636364 0.11363636364 0.11363636364 0.12500000000 0.12500000000
# 1 raided 0.01136363636 0.06818181818 0.06818181818 0.06818181818 0.07954545455 0.07954545455
# 1 scam 0.25000000000 0.35227272727 0.39772727273 0.39772727273 0.39772727273 0.39772727273
# 1 voluntary 0.22727272727 0.26136363636 0.26136363636 0.27272727273 0.27272727273 0.27272727273
#
# $var
# 200 400 600 800 1000 1200
# 1 unknown 0.0001292408729 0.0002616701315 0.0003911601132 0.0008988554115 0.0011441139596 0.0013003690983
# 1 hacked 0.0011623540396 0.0011623540396 0.0011623540396 0.0011623540396 0.0012886980693 0.0012886980693
# 1 raided 0.0001292408729 0.0007494488199 0.0007494488199 0.0007494488199 0.0009089372449 0.0009089372449
# 1 scam 0.0021690847025 0.0026530347066 0.0028036544633 0.0028036544633 0.0028036544633 0.0028036544633
# 1 voluntary 0.0020307752901 0.0022406509916 0.0022406509916 0.0023107700306 0.0023107700306 0.0023107700306
plot(blackc, lty=1, color=c(1:5), xlab="Days")
# confidence intervals:
plot(blackc, col=c(1:5), lty=1, xlab="Days", curvlab=c('hacked','raided','scam','voluntary'))
for (i in 1:4){
cltype <- names(blackc)[i]
ctm <- blackc[[cltype]]$time
cest <- blackc[[cltype]]$est
cvar <- blackc[[cltype]]$var
clo <- cest ^ exp(-1.96*sqrt(cvar)/(cest*log(cest)))
chi <- cest ^ exp(1.96*sqrt(cvar)/(cest*log(cest)))
lines(ctm[2:length(ctm)], chi[2:length(ctm)], col=i, lty=2, lwd=0.7)
lines(ctm[2:length(ctm)],clo[2:length(ctm)] , col=i, lty=2, lwd=0.7)
}
for (FAIL in c("raided", "hacked", "scam", "voluntary")) {
cat(FAIL,":\n")
print(with(black, crr(Age, Closure, cencode="alive", maxiter=100,
cov1= black[,c("Multisig", "Hacks", "Doxed", "Fraud", "Guns", "I2P", "Bitcoin", "Litecoin", "Dogecoin", "Darkcoin")],
failcode=FAIL)))
cat("\n")
}
# raided :
# convergence: TRUE
# coefficients:
# Multisig Hacks Doxed Fraud Guns I2P Bitcoin Litecoin Dogecoin Darkcoin
# 0.98020 0.32990 1.17200 -0.04558 -0.24180 -17.32000 -15.50000 -11.17000 -28.49000 -27.65000
# standard errors:
# [1] 0.9436 0.4524 0.8089 0.8893 1.0400 1.4230 2.1440 1.3780 2.8650 2.4430
# two-sided p-values:
# Multisig Hacks Doxed Fraud Guns I2P Bitcoin Litecoin Dogecoin Darkcoin
# 3.0e-01 4.7e-01 1.5e-01 9.6e-01 8.2e-01 0.0e+00 4.9e-13 4.4e-16 0.0e+00 0.0e+00
#
# hacked :
# convergence: TRUE
# coefficients:
# Multisig Hacks Doxed Fraud Guns I2P Bitcoin Litecoin Dogecoin Darkcoin
# 0.4371 0.7562 1.0860 0.4956 0.8256 -11.6700 2.8160 -10.2200 -8.0430 -10.9900
# standard errors:
# [1] 0.7206 0.3491 0.7689 0.6925 0.7205 0.8449 1.4230 1.2160 2.1830 0.9428
# two-sided p-values:
# Multisig Hacks Doxed Fraud Guns I2P Bitcoin Litecoin Dogecoin Darkcoin
# 0.54000 0.03000 0.16000 0.47000 0.25000 0.00000 0.04800 0.00000 0.00023 0.00000
#
# scam :
# convergence: TRUE
# coefficients:
# Multisig Hacks Doxed Fraud Guns I2P Bitcoin Litecoin Dogecoin Darkcoin
# -0.10720 0.08057 -0.59050 0.43420 -0.71390 -1.00200 -2.03000 -1.22200 -0.67940 0.29050
# standard errors:
# [1] 0.5164 0.2175 0.5461 0.3790 0.3868 1.1430 0.6974 0.8939 0.7397 0.4950
# two-sided p-values:
# Multisig Hacks Doxed Fraud Guns I2P Bitcoin Litecoin Dogecoin Darkcoin
# 0.8400 0.7100 0.2800 0.2500 0.0650 0.3800 0.0036 0.1700 0.3600 0.5600
#
# voluntary :
# convergence: TRUE
# coefficients:
# Multisig Hacks Doxed Fraud Guns I2P Bitcoin Litecoin Dogecoin Darkcoin
# -0.7029 -2.1160 0.2623 -0.9765 0.2492 2.1520 3.5960 1.8850 -7.7330 -13.3800
# standard errors:
# [1] 0.5779 0.8878 0.6494 0.4879 0.4364 0.4149 1.3520 0.5346 1.9310 0.7828
# two-sided p-values:
# Multisig Hacks Doxed Fraud Guns I2P Bitcoin Litecoin Dogecoin Darkcoin
# 2.2e-01 1.7e-02 6.9e-01 4.5e-02 5.7e-01 2.1e-07 7.8e-03 4.2e-04 6.2e-05 0.0e+00
Time-varying confounds: Multisig, RoI, σ, hacked, doxed, sales… Solve with multi-state models? https://cran.r-project.org/web/packages/msm/vignettes/msm-manual.pdf / http://web.inter.nl.net/users/rgeskus/CompRisk.pdf
Predictions
# Generate predictions of shutdown in next 6 / 12 months for the still-running marketplaces:
# You are not expected to understand this ugly hack. I don't either. But it *seems* to work...
# for background, see https://gwern.net/google-shutdown & https://gwern.net/silk-road#the-bet-bmr-or-sheep-to-die-in-a-year-by-oct-2014
library(rms)
conditionalProbability <- function (d, followupUnits, cmodel) {
chances <- rep(NA, nrow(d)) # stash results
for (i in 1:nrow(d)) {
# extract chance of particular subject surviving as long as it has:
beginProb <- survest(cmodel, d[i,], times=(d[i,]$Age))$surv
if (length(beginProb)==0) { beginProb <- 1 } # set to a default
tmpFollowup <- followupUnits # reset in each for loop
while (TRUE) {
# extract chance of subject surviving as long as it has + an arbitrary additional time-units
endProb <- survest(cmodel, d[i,], times=(d[i,]$Age + tmpFollowup))$surv
# survival curve may not reach that far! 'survexp returns 'numeric(0)' if it doesn't;
# so we shrink down 1 day and try again until 'survexp' *does* return a usable answer
if (length(endProb)==0) { tmpFollowup <- tmpFollowup - 1} else { break }
}
# if 50% of all subjects survive to time t, and 20% of all survive to time t+100, say, what chance
# does a survivor - at exactly time t - have of making it to time t+100? 40%: 0.20 / 0.50 = 0.40
chances[i] <- endProb / beginProb
}
return(chances)
}
# we can't regress on '~ 1' because `survest` crashes inside `conditionalProbability` (‽),
# so let's just toss in all the covariates to make it work despite none of them being well-justified...
cpmodel <- cph(Surv(Age, Alive) ~ Multisig + Litecoin+Dogecoin+Darkcoin + Guns + Fraud, data = black, x=TRUE, y=TRUE, surv=TRUE)
# report in %s rather than raw probabilities for easier reading
black$SixMonth <- round(digits=1, conditionalProbability(black, round(365/2), cpmodel) * 100)
black$OneYear <- round(digits=1, conditionalProbability(black, 365, cpmodel) * 100)
## Predictions from 2015-01-02:
subset(black, Alive, select=c("Market", "SixMonth", "OneYear"))
# Market SixMonth OneYear
# 56 Dream Market 100.0 100.0
# 57 Agora 65.6 65.6
# 58 Outlaw Market 72.3 72.3
# 59 evolution 17.5 17.5
# 60 BlackBank Market 13.1 13.1
# 61 Area51 57.7 28.1
# 62 Middle Earth Marketplace 56.8 28.8
# 63 Diabolus 34.7 0.0
# 64 Nucleus Marketplace 15.7 0.0
# 65 Panacea 89.7 34.4
# 66 Abraxas 85.9 51.2
# 67 AlphaBay 92.5 48.4
## Evaluation: Agora/evolution/BlackBank/Area51/MEM/Nucleus/Panacea/Abraxas were all dead by August 2016.
## Predictions from 2016-08-18:
# Market SixMonth OneYear
# 67 Dream Market 100.0 100.0
# 69 Outlaw Market 0.0 0.0
# 74 AlphaBay 100.0 0.0
# 76 Tochka 53.7 53.7
# 77 Crypto 58.3 58.3
# 79 TheRealDeal 4.1 4.1
# 84 Darknet Heroes League 44.7 44.7
See Also
-
Google products survival analysis (a similar analysis of a corpus of Google websites/services/products/software)
Appendix
Return & Volatility
dead <- as.Date(c("2013-10-02","2013-12-02","2013-09-20","2013-11-29","2013-11-04",
"2013-10-20","2013-10-28","2013-12-22","2014-01-01","2014-01-05",
"2014-02-01","2014-02-01","2014-02-07","2014-02-06","2014-02-04",
"2014-02-07","2014-02-11","2014-02-01","2014-03-23","2014-02-17",
"2014-03-24","2014-02-28","2014-03-13","2014-02-01","2014-02-28",
"2014-03-28","2014-03-01","2014-04-07","2014-04-19","2014-04-20",
"2014-04-20","2014-03-20"))
live <- as.Date("2014-04-24") # yesterday, default for live markets
volatility <- read.csv("http://btcvol.info/csv",
colClasses=c("Date","numeric","numeric","numeric", "numeric"))
# 30-day return
sapply(dead, function(d) { post <- volatility[volatility$date==d,]$price;
pre <- volatility[volatility$date==(d - 30),]$price;
return <- ((post - pre)/pre);
round(return, digits=3) } )
[1] -0.216 4.170 0.103 4.759 0.859 0.327 0.506 -0.173 -0.258 0.127 0.056 0.056 -0.182
[14] -0.033 -0.104 -0.182 -0.233 0.056 -0.014 -0.263 -0.031 -0.351 -0.047 0.056 -0.351 -0.129
[27] -0.334 -0.275 -0.145 -0.129 -0.129 -0.056
sapply(live, function(d) { post <- volatility[volatility$date==d,]$price;
pre <- volatility[volatility$date==(d - 30),]$price;
return <- ((post - pre)/pre);
round(return, digits=3) } )
[1] -0.141
# 30-day volatility
sapply(dead, function(d) { round(volatility[volatility$date==d,]$volatility, digits=3) } )
[1] 0.018 0.102 0.024 0.093 0.035 0.056 0.063 0.127 0.118 0.109 0.047 0.047 0.030 0.031 0.043 0.030
[17] 0.032 0.047 0.046 0.040 0.045 0.048 0.057 0.047 0.048 0.052 0.049 0.046 0.074 0.075 0.075 0.050
tail(volatility$volatility,n=1)
[1] 0.07408
External Links
-
“Darknet markets ecosystem - Lifetimes and reasons for closure of over 100 global darknet markets offering drugs, sorted by date”, EMCDDA, Europol, Lisbon, April 2018
-
“Darknet Market Activity Higher Than Ever in 2019 Despite Closures. How Does Law Enforcement Respond?”, Chainanalysis, 2020-01-28
-
et al 2019, “Collective Dynamics of Dark Web Marketplaces”
-
There are a fair number. An incomplete list as of mid-2014:
-
Finnish: Silkkitie:
http://silkkitiehdg5mug.onion
-
French: French Dark Place 2.0:
http://ruzh5shkcme2tpfk.onion
-
Polish: Torepublic Market:
http://nco5ranerted3nkt.onion/forum/market.php
; Forum:http://nco5ranerted3nkt.onion/forum/
-
Russian: Ramp:
http://ramp2bombkadwvgz.onion
-
Russian: Hydra Market:
http://hydraruehsdjjfud.onion/
(not to be confused with the Hungarian Hydra busted in Onymous) -
Italian:
http://babylonxjrtdyomy.onion
(Babylon was raided in late July 2015) -
Swedish:
flugsvamp
:http://yakwbcn5ou2wkzfx.onion
-
Magic Shop
-
-
Historical archive of DNstats’s statistics is available in my DNM archives.↩︎