Skip to main content

Darknet Market mortality risks

Survival analysis of lifespans, deaths, and predictive factors of Tor-Bitcoin darknet markets

I compile a dataset of 87 public English-language darknet markets (DNMs) 2011–2016 in the vein of the famous Silk Road 1, recording their openings/closing and relevant characteristics. A survival analysis indicates the markets follow a Type TODO lifespan, with a median life of TODO months. Risk factors include TODO. With the best model, I generate estimates for the currently-operating markets.

The most striking aspect of darknet markets (DNMs; online websites selling drugs and other goods using cryptocurrencies), after the fact that they are so successful and exist at all, is how much turnover there is. The casual observer of DNMs will quickly become confused by the sheer number of DNMs over time, and their short lifetimes. How many are there? What predicts longer or shorter lifetimes? Why are they so transient? How do they die? Here I try to shed some light on these questions by tabulating all known launched English-language DNMs from the invention of the business model by Silk Road 1 up through 2016. I am interested in websites selling drugs over Tor or i2p, using cryptocurrencies like Bitcoin/Litecoin/Dogecoin, allowing multiple sellers other than the site operators, and providing some sort of escrow functionality. This excludes clearnet sites like Topix, single-vendor shops like Modern Culture or Bungee54, carding shops like Tor Carders Market, hosting services like Cryuserv or Bad Wolf, DNM-focused forums like The Hub, and forums for buyers & sellers to deal directly with each other like The Majestic Garden.

Foreign language markets are excluded because I cannot navigate them1; DrugMarket, Bigshop & a few others are excluded because they reportedly have always been a scam (similarly for most sites listed on the notoriously wrong Hidden Wiki); the Majestic Garden & Underground Market Board 3.0 are excluded because they are forums & do not do escrow for their users; Grand Trunk never left beta & had actual sales.

Data

Variables:

  • start/end dates are, when possible, the date of the first & last known sales/withdrawals; otherwise they are rounded to my first/last visit to them; or to the start/end of the month they appeared/disappeared
  • closure: whether the shut down was due to law enforcement, precipitated by a hack or de-anonymization, a scam/theft by operators, or voluntary (without known losses to users)
  • arrested: whether the principal operator/owner/maintainer of the marketplace was arrested for running it (this excludes hired staff)
  • multisig: whether 2-of-3 escrow supported; 2-of-2 and other ‘lite’ versions are not considered multisig because they still allow for thefts
  • i2p: whether i2p is used in addition/instead of Tor
  • hacks: number of publicly known hacks resulting in leaks of user information, loss of funds, etc
  • doxed: whether a plausible candidate for site operators has been made publicly known by law enforcement or other people
  • codebase: the origin of the source code for a site where anything is publicly known; ‘custom’ simply means the site operators seem to have written it themselves
  • coin: principal cryptocurrency of marketplace; if multiple coins are accepted, I list the most prominent altcoin
  • guns: whether firearms were sold, specified in rules/policies as allowed to be sold, or rules/policies specified there were no bans on item categories
  • fraud: whether carding items like credit card dumps were sold etc (this does not include fake IDs or informational guides on how to commit fraud; the former have uses besides carding, and the latter are often outdated or just scams)

Table

A table of 87 DNMs (updated 2019-06-09):

Market Start End Alive Closure Arrested URL Multisig I2P Bitcoin Litecoin Dogecoin Darkcoin Codebase Guns Fraud Hacks Doxed Notes
Silk Road 1 2011-01-31 2013-10-02 FALSE raided TRUE silkroadvb5piz3r.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 2 TRUE SR1 temporarily sold guns as part of “the Armory” but only for a brief time as sales were poor.
BlackMarket Reloaded 2011-06-30 2013-12-02 FALSE hacked FALSE r6rcmz6lga4i5vb4.onion FALSE FALSE TRUE FALSE FALSE FALSE custom TRUE TRUE 1 FALSE backopy stopped buying on 2 Dec aggravated in part by a big theft, fully shutdown by 23 December. May reopen. BMR permitted gun sales, and also seems to have permitted credit card information sales, judging by angry feedback.
Atlantis 2013-03-26 2013-09-20 FALSE scam FALSE atlantisrky4es5q.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE FALSE 0 FALSE Atlantis’s shutdown seems, judging by comments on Reddit pages & All Things Vice to have initially allowed withdrawals, but disabled it after a few days and then stole the remaining deposits+escrow+vendor-bonds.
Sheep Marketplace 2013-02-28 2013-11-29 FALSE scam TRUE sheep5u64fi457aw.onion FALSE FALSE TRUE FALSE FALSE FALSE Nette FALSE TRUE 1 TRUE withdrawals were halted before 29 Nov, but deposits & sales were ongoing. I choose 29 Nov as the day where the Sheep scam became irrefutable. Strictly speaking, an operator has not been arrested as of 2015-03-27, but the suspected operator is in legal trouble over money-laundering of large Bitcoin-related sums.
Deepbay 2013-06-30 2013-11-04 FALSE scam FALSE deepbay4xr3sw2va.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE FALSE 0 FALSE Disappeared with funds; based on a screenshot of categories, seems to have been almost exclusively drugs.
Budster 2013-10-10 2013-10-20 FALSE scam FALSE budsterga5hcdxjn.onion FALSE FALSE TRUE FALSE FALSE FALSE WordPress FALSE FALSE 1 TRUE https://www.reddit.com/r/Budster/comments/1ove9w/has_anyone_made_a_purchase_yet/ccw8srh https://www.reddit.com/r/DarkNetMarkets/comments/1xyixa/psa_cyruserv_is_down_for_good_budster_taf_hosting/ Budster did not seem to use genuine multisig and this enabled the scam: https://www.reddit.com/r/SilkRoad/comments/1opmha/budster_the_worlds_first_p2p_marketplace/
Project Black Flag 2013-10-14 2013-10-28 FALSE scam FALSE ajd4yqq7ngzmqo3p.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE TRUE 1 FALSE https://www.reddit.com/r/DarkNetMarkets/comments/1peguv/pbf_rip/ ; forums: blackiiw5nozs6i5.onion; policies stated on forums (“Prohibited: Weapons, counterfeit money, stolen goods, child pornography, posting other users information, attempt to cause harm, spamming.”)
TorMarket 2013-11-07 2013-12-22 FALSE scam FALSE tormarkozaegyvco.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE TRUE 1 FALSE Part of the TorMarket user list was leaked by DPR2 on SR2F; TM also admitted other security issues, but further rumors that TorMarket’s shut down was precipitated by a hack by “Profesorhouse” have not been substantiated. TM may have used Bitwasp, but it didn’t seem to have Bitwasp error pages and doesn’t really look like the usual Bitwasp DNM.
FloMarket 2013-12-01 2014-01-01 FALSE hacked FALSE fmkt3wixc772jxyj.onion FALSE FALSE TRUE FALSE FALSE FALSE Bitwasp 2 FALSE Apparently hacked 2013-12-20 (previously noted to be hackable); withdrawals began failing on 2014-01-01 & FloMarket announced a second hack on 2014-01-06; for the operator’s explanation, see his interview
Tortuga 2013-12-16 2014-01-05 FALSE voluntary FALSE tortugauwngwecwd.onion FALSE FALSE TRUE FALSE FALSE FALSE Seagull 0 FALSE Advertised in the SR2F on 2013-12-19; advertised on the BMR forums on 16 Dec. Up on 2014-01-01, down on 2014-01-09 & afterwards. No news about reasons for its closure. No official rules on listings were posted before it disappeared, probably because it was unpopular enough that content was not an issue.
BlackBox Market 2013-11-12 2014-02-01 FALSE voluntary FALSE 77yqlxe7pnxhnxvi.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Interesting site, but not sure it should be listed here. Start date based on Reddit. Site stopped responding 2014-02-01. On-site escrow did not use multisig (“We do not make use of the Escrow services provided by Bitcoin itself as this associates buyers and sellers.”) Policies based on the fact that BBM could not know what was being sold on it and so de facto permitted both categories.
GreyRoad 2014-01-04 2014-02-01 FALSE voluntary FALSE greyroaderw4qymd.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Went public 2013-01-04 (2), operator claims to have been selling for a while but refuses to provide any specifics & very few sellers on market so opening date is used; forums: grforums5qwzbhkl.onion. URL stopped working 2014-02-01
Cantina 2014-01-20 2014-02-07 FALSE hacked FALSE vsudl2g3em6qhcw4.onion FALSE FALSE TRUE FALSE FALSE FALSE Nette TRUE TRUE 3 TRUE Cantina spammed vendors on SR2F on 2014-01-20; earliest known mention of the market. It was repeatedly hacked & doxed. Cantina had no stated policies, but it did have a category for guns and given the ‘Data’ categories & general lack of ethics & greed, highly likely would have permitted carding had it not died so ignominiously.
Breaking Bad 2014-02-01 2014-02-06 FALSE voluntary FALSE breakingnartglxd.onion FALSE FALSE TRUE FALSE FALSE FALSE custom TRUE TRUE 0 FALSE Announced on Reddit; site went down 6 February, owner explained shutdown due to “Lack of interest from vendors, constant hate mail, downvotes and claims on security vulnerabilities”
Black Goblin Market 2014-02-03 2014-02-04 FALSE hacked FALSE ua4aptglh45m5p6b.onion FALSE FALSE TRUE FALSE FALSE FALSE Drupal TRUE TRUE 0 TRUE Announced on Reddit; I de-anonymized the site, so it shut down. The “Black Goblin Rules” page does not mention any ban of guns or carding.
Cannabis Road 2014-02-03 2014-02-07 FALSE hacked FALSE ji4wrifhsnawaw7t.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 1 TRUE Announced on The Hub; thoroughly hacked & de-anonymized
Utopia 2014-02-03 2014-02-11 FALSE raided TRUE ggvow6fj3sehlm45.onion FALSE FALSE TRUE FALSE FALSE FALSE CakePHP TRUE TRUE 0 TRUE forums: ysas7uv4drg7rlwv.onion; forms opened in early January, site opened to ex-BMR sellers late January, general buyers only allowed in February. Dutch seizure notice posted ~7:30AM EST, followed by 5 arrests in Netherlands & Germany
Black Services Market 2013-12-02 2014-02-01 FALSE scam FALSE thebsm6okkbx7fik.onion FALSE FALSE TRUE FALSE FALSE FALSE OSclass TRUE TRUE 0 FALSE Start date based on oldest listing when I checked on 2013-12-26; last admin forum post 18 Jan & PMs to him disabled, reports of escrow problems in late Jan/early Feb, many complaints on forums; site went down 2014-02-14
Red Sun Marketplace 2014-03-20 2014-03-23 FALSE hacked FALSE redsun4lvjrxwwuy.onion FALSE FALSE TRUE FALSE FALSE FALSE Bitwasp FALSE TRUE 1 FALSE Announced on Reddit; hacked (SQli etc); forum: forumsyccj7ekvvv.onion. Surviving materials don’t say whether guns were permitted, but given the operator’s interest in recruiting fake ID vendors it seems more likely than not that carding sales would have been allowed.
BuyItNow 2013-04-30 2014-02-17 FALSE voluntary FALSE buyitnowquyft7dx.onion FALSE FALSE TRUE FALSE FALSE FALSE WordPress TRUE FALSE 0 FALSE Site did not respond on 2014-02-17 or afterwards; no reports on shutdown reason or whether it was a scam. Policies not specified, but many listings for guns, and none of any kind related to carding.
White Rabbit 2013-12-23 2014-02-01 FALSE scam FALSE rabbittorvr74veg.onion FALSE TRUE FALSE TRUE FALSE FALSE unknown TRUE TRUE 0 TRUE Start date based on Reddit posts. Formerly named “Rabbit’s Marketplace”. Unable to find reports of successful sales on The Hub or Reddit, and WR withdrawal has been broken at least since 2014-02-21; no one has claimed withdrawals recently. Dead date is based on the February news notice “There are problems with payment gateway”. Forum states only CP is banned (“Items which are not allowed: child porn (and other sick stuff).”) i2p: wrmarket.i2p. IP was found to be leaking.
FreeBay 2013-12-01 2014-02-28 FALSE voluntary FALSE freebay3yxuebsog.onion FALSE FALSE TRUE TRUE FALSE FALSE unknown FALSE TRUE 0 FALSE URL is also apparently litebay7vp5pm77f.onion (FreeBay took Bitcoin, LiteBay took Litecoin); open date is guess based on Reddit post; site was not up on 2014-02-28 when I checked. Policies not specified, but many carding & no gun listings.
drugslist 2014-01-08 2014-02-28 FALSE scam FALSE drugslisvdknitqd.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 1 FALSE Withdrawals began failing & admin ceased responding in February 2014; date closure to the forum admin account’s last login.
Doge Road 2014-01-18 2014-03-13 FALSE scam FALSE dogeroadiqt6olb6.onion FALSE FALSE FALSE FALSE TRUE FALSE Bitwasp FALSE TRUE 0 FALSE Announced on Reddit; forums: dogeroadqmu2yzcg.onion. Went down sometime in March 2014, may have gone bad in late February.
TorEscrow 2014-02-02 2014-04-19 FALSE scam FALSE torescrow7upglhe.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE TRUE 0 FALSE Initially just an escrow, but TE expanded into a market. Forums: 4rtvonaubslk7vvk.onion. TE seems to have permitted carding: “We do not allow the sale of weapons, pornography, ebooks, pirated software or hits.”
Armory Vendor Market 2014-02-06 2014-04-07 FALSE scam FALSE armoryx7kvdq3jds.onion FALSE FALSE FALSE FALSE FALSE TRUE Quick.Cart TRUE FALSE 1 FALSE Announced on Reddit; their Cryuserv hosting, according to the hacker, dated back to 2013-05-23 but it’s unclear when they had their first sale. It announced use of Darkcoin in March 2014.
Darknet Nation 2014-02-19 2014-03-01 FALSE hacked FALSE 26a2ueoc3xxrrgs4.onion FALSE FALSE TRUE FALSE FALSE FALSE Joomla TRUE TRUE 0 TRUE Announced on Reddit; Q&A. The site leaked its IP address. Down2014-04-03; best guess, shut down sometime in March (the administrator’s last post on The Hub was 2014-03-01.)
Sanitarium Market 2014-02-20 2014-03-28 FALSE voluntary FALSE sanitarium-market.i2p FALSE TRUE TRUE FALSE FALSE FALSE Bitwasp 0 FALSE Announced on Reddit; long address: dhd5okd2imkskbhsrlbs5c4nx3cdtmwpplvcei6o3l2sc35kt4ma.b32.i2p; Tor mirror: nyu7nlbj33ym2va3.onion. Unreachable by DeepDotWeb2014-03-28, and last subreddit activity was 2014-03-19. The operator claimed on 2014-02-24 to have integrated multisig but I can’t find any reports of use of it. No surviving info indicates whether weapons or carding were allowed.
Hansa 2014-03-09 2014-03-20 FALSE raided TRUE hansann7wim5ier2.onion FALSE FALSE TRUE FALSE FALSE FALSE Bitwasp TRUE TRUE 0 TRUE Announced on Reddit & de-anonymized; closure date based on last transaction by their IP. They planned to implement multisig but seem to have shut down before it went live. Bitwasp classification based on two comments & screenshot of login page. They appeared to be a voluntary shut down but had been subverted by Dutch police & multisig disabled & turned into a honeypot for monitoring buyer addresses, seller geotagged images, and malware.
EXXTACY 2014-03-23 2014-03-24 FALSE hacked FALSE j3gwwsnswrg7dtf4.onion FALSE FALSE TRUE FALSE FALSE FALSE Drupal 0 TRUE Announced & de-anonymized on Reddit. No information about policies is available, although since it seems to’ve been run by Sanitarium, it likely had whatever they did. Died before any rules announced or mirrors made.
Mr Nice Guy 2014-03-29 2014-04-20 FALSE voluntary FALSE niceguymn4plorwb.onion FALSE FALSE TRUE FALSE FALSE FALSE Bitwasp FALSE FALSE 0 TRUE Announced on Reddit; forum: ngforumjj4dkis7w.onion. IP was leaking.
TorBay 2013-12-18 2014-04-20 FALSE voluntary FALSE tyedahhf56xli7xp.onion FALSE FALSE TRUE FALSE FALSE FALSE hyops FALSE TRUE 0 TRUE Start date based on Reddit announcement; ceased responding in April 2014, after listings had fallen to near-zero.
DarkBay 2014-01-30 2014-05-01 FALSE voluntary FALSE darkbay4rwgvdkqn.onion TRUE FALSE TRUE FALSE FALSE FALSE unknown FALSE TRUE 0 TRUE Announced on Reddit; forums: 7y26aczl3wdyujkc.onion; formerly, UltraVioletCity/ultracityi2gdwhq.onion. “There is very little restriction here, we only ask that you do not sell firearms (rifles, pistols, automatic weapons etc) or child pornography (photographs, videos etc).” Merged with Andromeda?
Pigeon Market 2014-04-14 2014-05-07 FALSE voluntary FALSE pigeonkcmw5h44lq.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Unknown what happened to funds.
Free Market 2015-01-14 2015-02-26 FALSE voluntary FALSE tfmarket6iaddx45.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 0 FALSE Announced on Reddit
Tortuga 2 2014-04-23 2014-06-17 FALSE voluntary FALSE l6hkncqo46wgzx7y.onion TRUE TRUE FALSE TRUE FALSE FALSE Drupal FALSE FALSE 0 FALSE Announced on Reddit; i2p: wtat6dgz57j5xllu2j7htb7aydq5rgls6edg7e6lf2tumqn5ej3a.b32.i2p/tortuga-marketplace.i2p; multisig; ; unknown what happened to funds.
Deepzon 2014-05-14 2014-07-13 FALSE voluntary FALSE deepzondhyl3yaro.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Support’s response: “Guns/Weapons are allowed, we thought that would be clear, as we are having the category ‘Weapons’ listed. CC-Dumps are also allowed.”’ ; unknown what happened to funds.
Silk Street 2014-04-08 2014-08-04 FALSE scam FALSE silkr2xyqsu73qhh.onion FALSE FALSE TRUE FALSE FALSE FALSE Bitwasp FALSE FALSE 0 FALSE Announced on The Hub; no reports of withdrawals, so marked false. No explicit policies, but UI shows many empty categories but no empty categories for fraud or gun items, so I presume those were not permitted.
Underground Market 2014-04-09 2014-08-26 FALSE voluntary FALSE unground6baopdio.onion FALSE FALSE TRUE FALSE FALSE FALSE Bitwasp TRUE TRUE 0 FALSE Announced on Reddit; forums: vxcwhb4lzqltfauq.onion. Shut down citing “not enough customers”.
Cannabis Road 2 2014-03-28 2014-08-25 FALSE hacked FALSE cannabiskofvl7pa.onion TRUE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 1 FALSE Forum: forumzxmoorof4ja.onion; forum opened 2014-02-26, but site was not operational. The soft-launch/raffle announced 2014-03-28 seems a good start date. Was hacked & lost >$164564.5935166913₿2002014 from escrow (while multisig was available, very few buyers used it).
Pandora 2013-10-21 2014-08-19 FALSE scam FALSE pandorajodqp5zrr.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE TRUE 2 FALSE See “Forbidden Items on PANDORA”. Pandora has had 2 hacks: the first was a rogue moderator using an admin account, and the second was a loss of half the centralized escrow (repaid by levying extraordinary transaction fees). The operator eventually locked out all seller accounts around 19/2014-08-20 (definitely by 1 September) and disabled withdrawals & the site forums, but continued accepting deposits from buyers; he may also have captured login credentials and robbed accounts on other marketplaces according to several sellers. Targeted in Operation Onymous but had already turned scammer.
Pirate Market 2013-11-29 2014-08-15 FALSE scam FALSE yjhzeedl5osagmmr.onion TRUE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Start date based on Reddit. Originally RoadSilk; multisig. Site reportedly began blocking withdrawals ~2014-08-15 while still accepting deposits, with the Pirate Market forum being shut down several days later.
Freedom Market 2014-09-16 2014-09-25 FALSE voluntary FALSE freedom3qg7hmtxn.onion FALSE FALSE TRUE FALSE FALSE FALSE Bitwasp FALSE FALSE 0 FALSE Announced on Reddit; went down without notice sometime before 2014-09-25. Site rules: “If the item doesn’t hurt others, you can sell it.”; the categories included “Forgeries” but nothing else, so carding probably counted as ‘hurting others’.
1776 2014-04-19 2014-10-02 FALSE voluntary FALSE n6tzonxy7sod7eqt.onion FALSE FALSE TRUE FALSE FALSE FALSE ASP.NET FALSE FALSE 0 FALSE Announced by DeepDotWeb & on Reddit. Not Bitwasp, given the traceback on error pages. No policy documentation. Disappeared starting 2014-10-03.
Silk Road 2 2013-11-06 2014-11-05 FALSE raided TRUE silkroad6ownowfk.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 2 TRUE Forum moderator Cirrus advises considering SR2 compromised (2013-12-22, ironic inasmuch as Cirrus was the LE undercover agent who undid SR2 and helped with SR1); new operators Defcon/Hux/etc deny it. Defcon announced the cold wallet had been lost to DPR2, but then that it had been restored. SR2 experienced repeated account balance problems, failed to ever implement autofinalize or dispute resolution (forcing accumulation of orders’ balances), and announced 2014-02-13 that all deposits & escrow had been stolen, followed by another hack in September 2014. Use of SR was not advised. Was raided by Operation Onymous & Defcon arrested.
Hydra 2014-03-27 2014-11-05 FALSE raided TRUE hydrampvvnunildl.onion TRUE FALSE FALSE TRUE FALSE FALSE Bitwasp TRUE TRUE 0 FALSE Announced on The Hub; forum: hydrafmchvpq5yc6.onion. Operator arrested in Hungary as part of Operation Onymous. (Apparently unrelated to the Russian Hydra still in operation as of January 2019.)
Cloud-Nine 2014-02-11 2014-11-05 FALSE raided FALSE xvqrvtnn4pbcnxwt.onion TRUE FALSE TRUE FALSE FALSE FALSE Cloud-9 FALSE TRUE 0 FALSE Announced on Reddit; on banned items. Raided in Operation Onymous.
Blue Sky 2013-12-03 2014-11-05 FALSE raided FALSE blueskyplzv4fsti.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE FALSE 0 FALSE Or is the opening 2013-12-12? Raided in Operation Onymous.
TorBazaar 2014-01-26 2014-11-05 FALSE raided FALSE bazaarlv2a7i3uyn.onion TRUE FALSE TRUE FALSE FALSE FALSE Bitwasp TRUE TRUE 0 FALSE Announced on The Hub; original centralized escrow site: 3p42y56a76g6okuv.onion; forums: 22iwhc2luicynjqy.onion
Topix 2 2014-03-25 2014-11-05 FALSE voluntary FALSE topixslhezyytrvm.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 0 FALSE Started January 2014; opened to public 2014-09-28, previously was invite-only; start date based on first sale listed in recent-feedback page; apparently drug-only based on the listings. Shut down without notice after Operation Onymous.
Alpaca Marketplace 2014-04-20 2014-11-05 FALSE scam FALSE alpaca727o3c75xx.onion TRUE FALSE TRUE FALSE FALSE FALSE unknown TRUE FALSE 1 FALSE Announced on The Hub; policies based on Secret Laboratory writeup Hacked mid-May 2014. Alpaca allows weapons (but not poisons/WMDs/hitmen) and appears to ban carding: “We do not allow items that are advertised as stolen.” Shut down after Operation Onymous (seizure notice) without returning any funds.
Cannabis Road 3 2014-10-06 2014-11-05 FALSE scam FALSE cannabis37oj24rd.onion TRUE FALSE TRUE FALSE FALSE FALSE Alpaca FALSE FALSE 0 FALSE Forum: forumz2gljo2vhzb.onion. After CR2 was hacked, developer “Crypto” disappeared; the remaining staff set up a new marketplace hosted by Alpaca Marketplace. Went down with Alpaca after Operation Onymous
Andromeda 2014-04-05 2014-11-18 FALSE scam FALSE andromedam363aux.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Formerly Silk Road 3/silkroad3wqdnifp.onion; site has no connection to SR1 or SR2. Forums: dvzuhtlteonn6mwd.onion. Andromeda attempted to mask its exit scam as an Operation Onymous but it wasn’t announced as seized and the broken withdrawals & failed mimicry show it’s bogus.
The Marketplace 2013-11-28 2014-11-09 FALSE voluntary FALSE themarketplace.i2p TRUE TRUE TRUE FALSE FALSE FALSE custom FALSE TRUE 0 FALSE Start date from personal communication; Tor Proxy: 43y5mwjvhxd6zf7v.onion. The ToS ban CP, guns, and Bitcoin/dollar sales. Site went down 9 November, without any further notice. (The use of multisig means buyers & sellers can still complete the final transactions.)
Onionshop 2014-05-18 2014-09-17 FALSE hacked FALSE onionshopkue7sxr.onion FALSE FALSE TRUE FALSE FALSE FALSE TRUE TRUE 1 FALSE Announced on Reddit; hacked 2014-09-17 (announcement, hacker)
TOM 2014-05-10 2014-12-18 FALSE scam FALSE tom3j5jkjl7327oc.onion TRUE FALSE TRUE FALSE FALSE FALSE Bitwasp FALSE FALSE 0 FALSE Forums: tomf2fo56wthggwk.onion. TOM disappeared without any announcements; Reddit comments report deposits were not returned, so I mark TOM a scam.
Area51 2014-06-20 2015-01-24 FALSE scam FALSE fiftyonecrklhzhe.onion FALSE FALSE TRUE FALSE FALSE FALSE custom TRUE TRUE 0 FALSE Spammed on The Hub; implementation is PHP on Debian, admin states “area51 is complete selfcoded and we have nothing to do with bitwasp”. Centralized escrow & no reports of deposits being returned.
Panacea 2014-10-27 2015-02-13 FALSE voluntary FALSE panaceaz4give75l.onion TRUE FALSE TRUE FALSE FALSE FALSE Cloud-9 FALSE FALSE 1 TRUE Reddit ANN; forums: flower777wpnxpkj.onion; cannabis-only; admin “PyroWolf” was reportedly doxed by the cannabis seller EastCoastCollective (likely the operator of CR2/CR3, and possibly CR1 as well), who he was a former customer of. Closure obscure - staff blames an AWOL developer and the multisig coins to be safe, but a throwaway claims to’ve hacked it.
evolution 2014-01-14 2015-03-14 FALSE scam FALSE k5zq47j6wd3wdvjq.onion FALSE FALSE TRUE FALSE FALSE FALSE Laravel TRUE TRUE 0 FALSE Announced on Reddit 20 Jan, but forums claim first sale on 14 January; forums: i25c62nvu4cgeqyz.onion; new url: nifgk5szbodg7qbo.onion; claimed multisig but on further investigation, seems to be the weak kind. PHP framework. Site & forums went down 2015-03-18 but large withdrawals began failing ~2015-03-14, marking the start of the exit scam. Former employee claims $58791971.486784644₿130,0002015 lost.
Ironclad 2015-03-17 2015-03-25 FALSE scam FALSE ironcladcoc3chq6.onion FALSE FALSE TRUE FALSE FALSE FALSE custom TRUE TRUE 0 FALSE ANN; forums: forum.ironcladcoc3chq6.onion. Disappeared without notice during the post-Evolution chaos & Tor DoS attacks in March 2015; as a centralized market, all escrow & deposits are presumed stolen.
Kiss 2015-02-19 2015-05-16 FALSE scam FALSE kissmpg5zave56f4.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 1 FALSE ANN; forum: 6bssxspijk7n2ioh.onion; Kiss moderator claims hacked 2015-05-21 then operator decided to exit-scam. I date to 2015-05-16, however, as I was unable to log in starting then.
BlackBank Market 2014-02-05 2015-05-18 FALSE scam FALSE wztyb7vlfcw6l4xd.onion TRUE FALSE TRUE FALSE FALSE FALSE unknown TRUE TRUE 0 FALSE Active before its Reddit announcement but no apparent sales. Forums: kth2mwuwlkezwziy.onion. Forbidden items are listed on the wiki. BB went down without notice ~2015-05-18, with no communications afterwards; complicating the usual exit-scam story is that none of the bitcoins appear to have moved in weeks and the admin, many months ago, had alluded to serious health issue.
Tornado 2015-05-12 2015-05-20 FALSE FALSE tornadoputkhrvfq.onion FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE ANN; forums: tortalkmcguzevvz.onion; went down ~20 May without any public comments.
Havana/Absolem 2015-04-13 2015-05-22 FALSE hacked FALSE havana3cofejesta.onion TRUE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE Opened initially invite-code-only; forums: forumz4usxavgyri.onion; pentester whyusheep/hacksforcrack turned on Havana-Absolem, DoSing/hacking them; the admins gave up, talking about perhaps trying a private market instead.
Agape 2015-05-29 2015-06-04 FALSE voluntary FALSE agape3brimud5fk6.onion FALSE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE ANN. Voluntarily shut down due to lack of interest and “backlash”.
Zanzibar Spice 2015-05-07 2015-06-14 FALSE voluntary FALSE mithrakushhvfyto.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 0 FALSE ANN; server began throwing errors 2015-06-14 with no market communication.
Dream Market 2013-11-15 2019-04-30 FALSE voluntary FALSE ltxocqh4nvwkofil.onion FALSE FALSE TRUE FALSE FALSE FALSE unknown FALSE TRUE 0 FALSE Site claims to’ve opened 2013-11-15; first mention of it I found was on 2014-01-07. Later moved to lchudifyeqm4ldjj.onion/. Shutdown background: DoJ, Dark Owl
Agora 2013-12-03 2015-09-06 FALSE voluntary FALSE agorahooawayyfoe.onion FALSE FALSE TRUE FALSE FALSE FALSE custom TRUE TRUE 0 FALSE Forums: lacbzxobeprssrfx.onion. Agora banned guns 2015-07-15 after ~20 gun busts became known; nevertheless, for most of its lifespan it allowed guns. Agora announced 2015-08-25 that it would be going offline indefinitely to deal with Tor deanonymization attacks; withdrawals were enabled and DNstats indicates the site went offline around 2015-09-06.
Outlaw Market 2013-12-29 2017-05-16 FALSE hacked FALSE drugs26ucskmvcef.onion FALSE FALSE TRUE FALSE FALSE FALSE custom TRUE FALSE 3 FALSE Open date based on the date of the “Welcome” post on the OM forum; apparently formerly “Drugs’n’Bets”. Site was hacked & user PMs released in 2013; site shut down 2014-07-31 after an attack blame on former admins when “A SESSION-hack was performed and a couple of datasets manipulated but not much damage created”. They claim in an interview it’s custom software; this is confirmed by a leak of PHP source which does not call any frameworks/CRMs. Policies based on no apparent hits among mirrors. Ex-staff insist it was not an exit scam but a genuine hack.
Middle Earth Marketplace 2014-06-22 2015-11-04 FALSE scam FALSE mango7u3rivtwxy7.onion FALSE FALSE TRUE FALSE FALSE FALSE Django FALSE TRUE 0 FALSE Announced on Reddit. Exit-scammed sometime around October-November 2015; some issues with withdrawals reported in late October, then the site went down for ‘maintenance’ around 2015-11-04, and coins were definitely being moved by the admins by 2015-11-06 .
Diabolus/SR3 2014-10-13 2017-02-12 FALSE FALSE qxvfcavhse45ckpw.onion FALSE FALSE TRUE FALSE FALSE TRUE custom FALSE FALSE 0 FALSE Cannabis-only. Unclear when it shut down so I assign it the same date as CM, which was operated by the same team.
Nucleus Marketplace 2014-10-24 2016-04-13 FALSE scam FALSE nucleuspf3izq7o6.onion FALSE FALSE TRUE TRUE FALSE TRUE Laravel TRUE TRUE 0 FALSE Went down 2016-04-13 according to DNstats & Reddit. Apparent non-movement of market coins has prompted speculation about arrests, but no busts has been announced as of 2016-08-18.
Abraxas 2014-12-13 2015-11-05 FALSE scam FALSE abraxasdegupusel.onion FALSE FALSE TRUE FALSE FALSE TRUE Laravel FALSE TRUE 0 FALSE forums: abraxasgacelesox.onion Went down 2015-11-05 according to DNstats and several months later the wallet may’ve been drained.
AlphaBay 2014-12-22 2017-07-05 FALSE raided TRUE pwoah7foa6au2pul.onion FALSE FALSE TRUE FALSE FALSE FALSE custom TRUE TRUE 0 FALSE Announced on Reddit
Silk Road Reloaded 2015-01-13 2016-02-27 FALSE FALSE silkroadreloaded.i2p FALSE TRUE TRUE TRUE TRUE TRUE custom FALSE TRUE 0 FALSE Full I2P address: hyn3mwmyeovcn2paujxur2eury2ufqpoahvbbqshfoggljn25tra.b32.i2p. I’m uncertain when it closed - last subreddit activity 2016-02-27 but may have still been alive as of May 2016 or later.
Tochka 2015-01-30 TRUE FALSE tochka3evlj3sxdv.onion FALSE FALSE TRUE TRUE TRUE TRUE custom FALSE FALSE 0 FALSE Announced on Reddit; site rules ban “Counterfeit documents” which I interpret as banning carding in general.
Crypto Market 2015-02-14 2017-02-12 FALSE scam FALSE cryptomktgxdn2zd.onion FALSE FALSE TRUE FALSE FALSE FALSE custom TRUE TRUE 0 FALSE ANN; CM is run on / by Diabolus and not entirely separate. According to DNstats.net, Crypto Market was last observed up on 2017-02-12, but there are complaints in January 2017 on Reddit so I’m not sure when it really went down. In any case, the escrow funds apparently were not returned.
Mr Nice Guy 2 2015-02-21 2015-10-14 FALSE scam FALSE niceguyfa3xkuuoq.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 0 TRUE Operator claims doxing was just of “a volunteer”. Went down October 14, 2015 according to DNstats.
TheRealDeal 2015-04-09 2016-10-22 FALSE FALSE trdealmgn4uvm42g.onion TRUE FALSE TRUE FALSE FALSE FALSE Bitwasp TRUE TRUE 0 FALSE Interview, ANN; forums: forum5cijl4suew6.onion. Multiple staffers were arrested & the site went down for a while but came back up, leading to questions about whether it had been subverted. Last observed by DNstats.net on 2016-10-22. Unclear why it shut down: LE, exit scam, or otherwise? Or to what extent its multisig worked.
Oxygen 2015-04-16 2015-08-27 FALSE scam FALSE o2oxycuvnwxhv73e.onion TRUE FALSE TRUE FALSE FALSE FALSE custom FALSE TRUE 1 FALSE ANN. Was hacked around January 2015 by a vendor exploiting an early finalization bug to scam customers. Went down 2015-08-27 according to DNstats.
East India Company 2015-04-28 2016-01-01 FALSE scam FALSE g4c35ipwiutqccly.onion FALSE FALSE TRUE FALSE FALSE FALSE custom FALSE FALSE 1 FALSE ANN; EU-only. Claims to’ve lost $12894.807158442709₿302015 to a hacker in early August 2015. EIC went down ~2016-01-01–2016-01-02 for a week or so, then a maintenance message, then came back up but withdrawals failed; finally, went down for good 2016-02-01 according to DNstats.
Haven 2015-05-05 2015-06-06 FALSE scam FALSE havenpghmfqhivfn.onion FALSE FALSE TRUE FALSE FALSE FALSE custom TRUE TRUE 0 FALSE ANN Went down 2015-06-06 according to DNstats; not much discussion of its closure.
Anarchia 2015-05-07 2016-05-09 FALSE FALSE tkmlejimlt72jnkm.onion FALSE FALSE TRUE FALSE FALSE FALSE Bitwasp TRUE TRUE 0 FALSE ANN. Still around 2015-07-09 judging from spam for it; may have gone down 2016-05-09 for unclear reasons. No discussion of its closure on Reddit, DDW, The Hub, or I can find in Google.
Darknet Heroes League 2015-05-27 2017-08-05 FALSE hacked FALSE darkheroesq46awl.onion FALSE FALSE TRUE FALSE FALSE FALSE 0 FALSE Not explicitly announced. Disappeared after vulnerabilities & IP disclosed.
Poseidon 2015-06-02 2015-06-29 FALSE scam FALSE poseidonzskufuwb.onion FALSE FALSE TRUE FALSE FALSE FALSE TRUE TRUE 0 TRUE Server de-anonymized by TheRealDeal ~2015-06-02 & was in Latvia. From the few mentions of it afterwards, Poseidon apparently disabled withdrawals and then disappeared within a few months.
Amazon Dark 2015-06-08 2015-10-25 FALSE scam FALSE amazon435hm6h3ye.onion TRUE FALSE TRUE FALSE FALSE FALSE FALSE FALSE 0 FALSE ANN. Around 2015-10-22–2015-10-25, complaints began appearing about administrators not responding & withdrawals failing; former spokesperson says it was an exit scam; went down 2015-10-28, according to DNstats.
Simply Bear 2015-06-20 2015-10-21 FALSE scam FALSE llog4svhkcb5txld.onion FALSE FALSE TRUE FALSE FALSE FALSE FALSE TRUE 0 FALSE ANN. Went down 2015-10-21 according to DNstats; no mentions of whether it might’ve shut down earlier anywhere else.
Horizon Market 2015-05-23 2015-07-08 FALSE scam FALSE horizon77qneerav.onion FALSE FALSE TRUE FALSE FALSE FALSE TRUE TRUE 0 FALSE Was French-only until mid-June 2015; opening date based on earlier last-seen dates for the lowest-numbered vendors. Disappeared sometime before 2015-07-08, according to the DDW changelog.

See also DeepDotWeb’s list (changelog), DNstats2, the DNM market list, and the Hidden Wiki (last updated 2014-08-30).

DNM lifetimes, sorted by when a market opened, colored by how it closed.

I may add to the table other variables; possibly useful ones:

  • 2-factor-authentication
  • Vendor PGP enforced
  • FE status
  • ideology: whether the operator seems ideological (I suspect SR1 may have lasted longer than most post-SR1 markets because Ulbricht’s agorist ideology meant he was not profit-motivated & refused to do an exit scam or shutdown when SR1 was being extorted and may even have been running at loss; but after watching markets in 2014-2015, it seems that such a variable is unlikely to be useful: Ulbricht is the only one clearly ideological, and the rest seem to be aping it or too quiet to tell. Just because the operators say something doesn’t mean they believe it, and many say nothing.)
  • volume (at what time?)
  • how much money was lost when the site scammed or was hacked (only reasonably known for a few scams…)
  • apparent nationality of operator
  • media coverage
  • number of employees (can official claims be trusted?)
  • mandatory role separation (fully-separate buyer/seller/admin/staff accounts)

Analysis

TODO:

“The death rate of bitwasp marketplaces will always be higher because it lowers the barrier of entry to starting and launching your own BTC marketplace so less technical people with lesser funds to start the marketplace will use it and that demographic has a higher chance of failure.”

From a predictive standpoint, it doesn’t much matter why Bitwasp correlates with shorter lifetimes - whether it’s through greater likelihood of being hacked or self-selection by weak-willed/poor/uncommitted/incompetent operators. As long as it does, it’ll improve predictions by predicting shorter lifetimes for Bitwasp-using marketplaces, and so it’s less safe for buyers: even if the marketplace is using multisig, there’s still some limited scope for an exit scam; it wastes one’s investment in learning how to use a marketplace; and sellers lose any bond they put up. (Multisig is great and I’ve been advocating for it for a long time, but it’s not a silver bullet.)

In any case, I can try checking if using Bitwasp correlates with being hacked, not just shut down. The sample is currently small enough that the results won’t mean much regardless, though.

library(XML)
library(RCurl)
html <- getURL("https://gwern.net/dnm-survival#table")
black <- readHTMLTable(html, colClasses = c("factor", as.Date, as.Date, "logical", "factor", "logical", "character", "logical", "logical", "logical", "logical", "logical", "logical", "factor", "logical", "logical", "integer", "logical", "character"))[[1]]
black[black$Codebase=="",]$Codebase <- "unknown"
black$Start <- as.Date(black$Start); black$End <- as.Date(black$End)
black[is.na(black$End),]$End <- Sys.Date() # assuming the table is up to date
black$Age <- black$End - black$Start
black$Age <- as.integer(black$End - black$Start)

# for some markets, these values are impossible to find: they were never decided on, or the market is gone
# there's only a few, so I'm not sure the complexity of multiple-imputation is worthwhile (MICE objects work with almost no libraries...)
# so for the 2 relevant columns so far, I do a simple impute of the median/mode value
black[is.na(black$Fraud),]$Fraud <- as.logical(median(black$Fraud, na.rm=T))
black[is.na(black$Guns),]$Guns   <- as.logical(median(black$Fraud, na.rm=T))

# for competing-risks modeling
levels(black$Closure) <- c("unknown", "hacked", "raided", "scam", "voluntary") # sets "" to "unknown"
black <- black[order(black$Start),]

library(survival)
# plot(survfit(Surv(Age, Alive, type="right") ~ 1, data=black), xlab="Days active", ylab="Fraction of markets still active")

# generate fancy timeline of DNM openings/closing:
library(ggplot2)
png(file="~/wiki/doc/darknet-market/silk-road/1/gwern-marketlifetimes.png", width = 1200, height = 2500)
ggplot(black, aes(colour=Closure)) +
    geom_segment(aes(x=Start, xend=End, y=sort(decreasing=TRUE, reorder(Market,Start)), yend=sort(decreasing=TRUE, reorder(Market,Start))), size=3) +
    xlab("Open") + ylab("Market") + theme(legend.position="bottom", axis.text=element_text(hjust=1, size=20)) + scale_y_discrete(labels = sort(decreasing=TRUE, reorder(black$Market, black$Start)))
invisible(dev.off())

library(lubridate)
cmodel <- coxph(Surv(Age, Alive) ~ year(black$Start) + Multisig + I2P + Bitcoin+Litecoin+Dogecoin+Darkcoin + Codebase + Guns + Fraud + Hacks + Doxed, data = black, control=coxph.control(iter.max=10000)); cmodel

with(black, survdiff(Surv(Age,Alive)~as.factor(year(Start))))

cmodel2 <- coxph(Surv(Age, Alive) ~ as.factor(year(black$Start)) + ridge(Multisig, I2P, Bitcoin,Litecoin,Dogecoin,Darkcoin, Codebase, Guns, Fraud, Hacks, Doxed), data = black); summary(cmodel2)

cmodel <- coxph(Surv(Age, Alive) ~ strata(year(black$Start)), data = black); cmodel

black$URL <- black$Notes <- black$Market <- NULL

Example competing-risks model using startup data:

# https://blogs.wsj.com/venturecapital/2014/11/20/techstars-graduates-success-rates-what-the-numbers-show/
# data:application/octet-stream;charset=utf-8,Year%2C2007%2C2008%2C2009%2C2010%2C2011%2C2012%2C2013%2C2014%0AActive%2C2%2C2%2C7%2C15%2C36%2C68%2C121%2C120%0AFailed%2C3%2C4%2C5%2C11%2C9%2C10%2C5%2C0%0AAcquired%2C5%2C4%2C7%2C5%2C14%2C15%2C4%2C1
rates <- read.csv(stdin(),header=TRUE)
Year,2007,2008,2009,2010,2011,2012,2013,2014
Active,2,2,7,15,36,68,121,120
Failed,3,4,5,11,9,10,5,0
Acquired,5,4,7,5,14,15,4,1

library(reshape2)
rates2 <- melt(rates)
colnames(rates2) <- c("Status", "Year", "Count")
rates2$Year <- as.integer(substring(as.character(rates2$Year), 2))
startups <- NULL
for (i in 1:nrow(rates2)) { startups <- rbind(data.frame(Status = rep(rates2[i,]$Status, rates2[i,]$Count), Year=rep(rates2[i,]$Year, rates2[i,]$Count)), startups) }
library(survival)
startups$Alive <- startups$Status == "Active"
startups$Age <- 2014 - startups$Year
sf <- survfit(Surv(Age, Alive, type="right") ~ 1, data=startups); summary(sf)
#  time n.risk n.event survival  std.err lower 95% CI upper 95% CI
#     0    473     120  0.74630 0.020007     0.708099      0.78656
#     1    352     121  0.48976 0.023007     0.446680      0.53699
#     2    222      68  0.33974 0.022007     0.299236      0.38573
#     3    129      36  0.24493 0.020778     0.207412      0.28924
#     4     70      15  0.19245 0.020269     0.156552      0.23657
#     5     39       7  0.15790 0.020407     0.122571      0.20342
#     6     20       2  0.14211 0.021202     0.106083      0.19038
#     7     10       2  0.11369 0.024715     0.074248      0.17409
plot(sf)
# https://i.imgur.com/76B7AxN.png

library(cmprsk)
sc <- cuminc(startups$Age, startups$Status, cencode="Active"); sc
# Estimates and Variances:
# $est
#                       1            2           3           4           5           6
# 1 Acquired 0.0134537767 0.0791545678 0.172799416 0.223444079 0.321616811 0.397350061
# 1 Failed   0.0141745147 0.0579750421 0.118175302 0.229593560 0.299716940 0.375450190
#
# $var
#                         1              2              3             4             5             6
# 1 Acquired 3.62406271e-05 0.000301240943 0.000805565675 0.00118663857 0.00205862260 0.00275961348
# 1 Failed   3.97263451e-05 0.000220342717 0.000570181024 0.00140171794 0.00200661959 0.00272841167
plot(sc, lty=1, color=c(3,2))
# https://i.imgur.com/Tafk9B0.png

DNMs:

library(cmprsk)
blackc <- with(black, cuminc(Age, Closure, cencode="alive")); blackc
# Estimates and Variances:
# $est
#                       200           400           600           800          1000          1200
# 1 unknown   0.01136363636 0.02272727273 0.03409090909 0.07954545455 0.10227272727 0.11363636364
# 1 hacked    0.11363636364 0.11363636364 0.11363636364 0.11363636364 0.12500000000 0.12500000000
# 1 raided    0.01136363636 0.06818181818 0.06818181818 0.06818181818 0.07954545455 0.07954545455
# 1 scam      0.25000000000 0.35227272727 0.39772727273 0.39772727273 0.39772727273 0.39772727273
# 1 voluntary 0.22727272727 0.26136363636 0.26136363636 0.27272727273 0.27272727273 0.27272727273
#
# $var
#                         200             400             600             800            1000            1200
# 1 unknown   0.0001292408729 0.0002616701315 0.0003911601132 0.0008988554115 0.0011441139596 0.0013003690983
# 1 hacked    0.0011623540396 0.0011623540396 0.0011623540396 0.0011623540396 0.0012886980693 0.0012886980693
# 1 raided    0.0001292408729 0.0007494488199 0.0007494488199 0.0007494488199 0.0009089372449 0.0009089372449
# 1 scam      0.0021690847025 0.0026530347066 0.0028036544633 0.0028036544633 0.0028036544633 0.0028036544633
# 1 voluntary 0.0020307752901 0.0022406509916 0.0022406509916 0.0023107700306 0.0023107700306 0.0023107700306

plot(blackc, lty=1, color=c(1:5), xlab="Days")

# confidence intervals:

plot(blackc, col=c(1:5), lty=1, xlab="Days", curvlab=c('hacked','raided','scam','voluntary'))
for (i in 1:4){
    cltype <- names(blackc)[i]
    ctm <- blackc[[cltype]]$time
    cest <- blackc[[cltype]]$est
    cvar <- blackc[[cltype]]$var
    clo <- cest ^ exp(-1.96*sqrt(cvar)/(cest*log(cest)))
    chi <- cest ^ exp(1.96*sqrt(cvar)/(cest*log(cest)))
    lines(ctm[2:length(ctm)], chi[2:length(ctm)], col=i, lty=2, lwd=0.7)
    lines(ctm[2:length(ctm)],clo[2:length(ctm)] , col=i, lty=2, lwd=0.7)
}

for (FAIL in c("raided", "hacked", "scam", "voluntary")) {
    cat(FAIL,":\n")
    print(with(black, crr(Age, Closure, cencode="alive", maxiter=100,
                    cov1= black[,c("Multisig", "Hacks", "Doxed", "Fraud", "Guns", "I2P", "Bitcoin", "Litecoin", "Dogecoin", "Darkcoin")],
                    failcode=FAIL)))
    cat("\n")
    }
# raided :
# convergence:  TRUE
# coefficients:
#  Multisig     Hacks     Doxed     Fraud      Guns       I2P   Bitcoin  Litecoin  Dogecoin  Darkcoin
#   0.98020   0.32990   1.17200  -0.04558  -0.24180 -17.32000 -15.50000 -11.17000 -28.49000 -27.65000
# standard errors:
#  [1] 0.9436 0.4524 0.8089 0.8893 1.0400 1.4230 2.1440 1.3780 2.8650 2.4430
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  3.0e-01  4.7e-01  1.5e-01  9.6e-01  8.2e-01  0.0e+00  4.9e-13  4.4e-16  0.0e+00  0.0e+00
#
# hacked :
# convergence:  TRUE
# coefficients:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#   0.4371   0.7562   1.0860   0.4956   0.8256 -11.6700   2.8160 -10.2200  -8.0430 -10.9900
# standard errors:
#  [1] 0.7206 0.3491 0.7689 0.6925 0.7205 0.8449 1.4230 1.2160 2.1830 0.9428
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  0.54000  0.03000  0.16000  0.47000  0.25000  0.00000  0.04800  0.00000  0.00023  0.00000
#
# scam :
# convergence:  TRUE
# coefficients:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
# -0.10720  0.08057 -0.59050  0.43420 -0.71390 -1.00200 -2.03000 -1.22200 -0.67940  0.29050
# standard errors:
#  [1] 0.5164 0.2175 0.5461 0.3790 0.3868 1.1430 0.6974 0.8939 0.7397 0.4950
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#   0.8400   0.7100   0.2800   0.2500   0.0650   0.3800   0.0036   0.1700   0.3600   0.5600
#
# voluntary :
# convergence:  TRUE
# coefficients:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  -0.7029  -2.1160   0.2623  -0.9765   0.2492   2.1520   3.5960   1.8850  -7.7330 -13.3800
# standard errors:
#  [1] 0.5779 0.8878 0.6494 0.4879 0.4364 0.4149 1.3520 0.5346 1.9310 0.7828
# two-sided p-values:
# Multisig    Hacks    Doxed    Fraud     Guns      I2P  Bitcoin Litecoin Dogecoin Darkcoin
#  2.2e-01  1.7e-02  6.9e-01  4.5e-02  5.7e-01  2.1e-07  7.8e-03  4.2e-04  6.2e-05  0.0e+00

Time-varying confounds: Multisig, RoI, σ, hacked, doxed, sales… Solve with multi-state models? https://cran.r-project.org/web/packages/msm/vignettes/msm-manual.pdf / http://web.inter.nl.net/users/rgeskus/CompRisk.pdf

Predictions

# Generate predictions of shutdown in next 6 / 12 months for the still-running marketplaces:

# You are not expected to understand this ugly hack. I don't either. But it *seems* to work...
# for background, see https://gwern.net/google-shutdown & https://gwern.net/silk-road#the-bet-bmr-or-sheep-to-die-in-a-year-by-oct-2014
library(rms)
conditionalProbability <- function (d, followupUnits, cmodel) {
    chances <- rep(NA, nrow(d)) # stash results

    for (i in 1:nrow(d)) {

        # extract chance of particular subject surviving as long as it has:
        beginProb <- survest(cmodel, d[i,], times=(d[i,]$Age))$surv
        if (length(beginProb)==0) { beginProb <- 1 } # set to a default

        tmpFollowup <- followupUnits # reset in each for loop
        while (TRUE) {
            # extract chance of subject surviving as long as it has + an arbitrary additional time-units
            endProb <- survest(cmodel, d[i,], times=(d[i,]$Age + tmpFollowup))$surv
            # survival curve may not reach that far! 'survexp returns 'numeric(0)' if it doesn't;
            # so we shrink down 1 day and try again until 'survexp' *does* return a usable answer
            if (length(endProb)==0) { tmpFollowup <- tmpFollowup - 1} else { break }
        }

        # if 50% of all subjects survive to time t, and 20% of all survive to time t+100, say, what chance
        # does a survivor - at exactly time t - have of making it to time t+100? 40%: 0.20 / 0.50 = 0.40
        chances[i] <- endProb / beginProb
    }
    return(chances)
}
# we can't regress on '~ 1' because `survest` crashes inside `conditionalProbability` (‽),
# so let's just toss in all the covariates to make it work despite none of them being well-justified...
cpmodel <- cph(Surv(Age, Alive) ~ Multisig + Litecoin+Dogecoin+Darkcoin + Guns + Fraud, data = black, x=TRUE, y=TRUE, surv=TRUE)
# report in %s rather than raw probabilities for easier reading
black$SixMonth <- round(digits=1, conditionalProbability(black, round(365/2), cpmodel) * 100)
black$OneYear  <- round(digits=1, conditionalProbability(black,          365, cpmodel) * 100)

## Predictions from 2015-01-02:
subset(black, Alive, select=c("Market", "SixMonth", "OneYear"))
#                      Market SixMonth OneYear
# 56             Dream Market    100.0   100.0
# 57                    Agora     65.6    65.6
# 58            Outlaw Market     72.3    72.3
# 59                evolution     17.5    17.5
# 60         BlackBank Market     13.1    13.1
# 61                   Area51     57.7    28.1
# 62 Middle Earth Marketplace     56.8    28.8
# 63                 Diabolus     34.7     0.0
# 64      Nucleus Marketplace     15.7     0.0
# 65                  Panacea     89.7    34.4
# 66                  Abraxas     85.9    51.2
# 67                 AlphaBay     92.5    48.4
## Evaluation: Agora/evolution/BlackBank/Area51/MEM/Nucleus/Panacea/Abraxas were all dead by August 2016.

## Predictions from 2016-08-18:
#                   Market SixMonth OneYear
# 67          Dream Market    100.0   100.0
# 69         Outlaw Market      0.0     0.0
# 74              AlphaBay    100.0     0.0
# 76                Tochka     53.7    53.7
# 77                Crypto     58.3    58.3
# 79           TheRealDeal      4.1     4.1
# 84 Darknet Heroes League     44.7    44.7

See Also

Appendix

Return & Volatility

dead <- as.Date(c("2013-10-02","2013-12-02","2013-09-20","2013-11-29","2013-11-04",
                  "2013-10-20","2013-10-28","2013-12-22","2014-01-01","2014-01-05",
                  "2014-02-01","2014-02-01","2014-02-07","2014-02-06","2014-02-04",
                  "2014-02-07","2014-02-11","2014-02-01","2014-03-23","2014-02-17",
                  "2014-03-24","2014-02-28","2014-03-13","2014-02-01","2014-02-28",
                  "2014-03-28","2014-03-01","2014-04-07","2014-04-19","2014-04-20",
                  "2014-04-20","2014-03-20"))
live <- as.Date("2014-04-24") # yesterday, default for live markets
volatility <- read.csv("http://btcvol.info/csv",
                       colClasses=c("Date","numeric","numeric","numeric", "numeric"))

# 30-day return
sapply(dead, function(d) { post   <- volatility[volatility$date==d,]$price;
                           pre    <- volatility[volatility$date==(d - 30),]$price;
                           return <- ((post - pre)/pre);
                           round(return, digits=3) } )
 [1] -0.216  4.170  0.103  4.759  0.859  0.327  0.506 -0.173 -0.258  0.127  0.056  0.056 -0.182
[14] -0.033 -0.104 -0.182 -0.233  0.056 -0.014 -0.263 -0.031 -0.351 -0.047  0.056 -0.351 -0.129
[27] -0.334 -0.275 -0.145 -0.129 -0.129 -0.056
sapply(live, function(d) { post   <- volatility[volatility$date==d,]$price;
                           pre    <- volatility[volatility$date==(d - 30),]$price;
                           return <- ((post - pre)/pre);
                           round(return, digits=3) } )
[1] -0.141

# 30-day volatility
sapply(dead, function(d) { round(volatility[volatility$date==d,]$volatility, digits=3) } )
 [1] 0.018 0.102 0.024 0.093 0.035 0.056 0.063 0.127 0.118 0.109 0.047 0.047 0.030 0.031 0.043 0.030
[17] 0.032 0.047 0.046 0.040 0.045 0.048 0.057 0.047 0.048 0.052 0.049 0.046 0.074 0.075 0.075 0.050
tail(volatility$volatility,n=1)
[1] 0.07408

  1. There are a fair number. An incomplete list as of mid-2014:

    • Finnish: Silkkitie: http://silkkitiehdg5mug.onion
    • French: French Dark Place 2.0: http://ruzh5shkcme2tpfk.onion
    • Polish: Torepublic Market: http://nco5ranerted3nkt.onion/forum/market.php; Forum: http://nco5ranerted3nkt.onion/forum/
    • Russian: Ramp: http://ramp2bombkadwvgz.onion
    • Russian: Hydra Market: http://hydraruehsdjjfud.onion/ (not to be confused with the Hungarian Hydra busted in Onymous)
    • Italian: http://babylonxjrtdyomy.onion (Babylon was raided in late July 2015)
    • Swedish: flugsvamp: http://yakwbcn5ou2wkzfx.onion
    • Magic Shop
    ↩︎
  2. Historical archive of DNstats’s statistics is available in my DNM archives.↩︎

Similar Links

[Similars]