22 ms·

German police take down 'world's largest darknet marketplace'

203 points by thinkloop 6y ago

thinkloop 6y ago
In theory it is possible to run a bitcoin tor marketplace anonymously, but in practice, given a long enough timeline, mistakes will happen and chances of getting caught approach 100%. I wonder what mistakes were made here.
- Shared404 6y ago
  I would also like a report/postmortem. I think we are unlikely to get one however, at least not anytime soon.
- 0xy 6y ago
  You'll never know the real timeline because law enforcement lie about the use of parallel construction to build cases. We know that Tor isn't resistant to state-based attackers, so my money is always on global surveillance networks picking up missteps by the operators. "Whoops I forgot to turn my VPN on and SSH'ed into one of the servers they were already watching" -- this kind of thing.
  - de_nied 6y ago
    >"Whoops I forgot to turn my VPN on" Why would someone be using a VPN if they're using tor for the market? Why would a VPN offer any protection at all? If you're using a VPN and "SSH into one of the servers that they are already watching", then a VPN isn't going to provide anonymity.
    - Shared404 6y ago
      The model would be something like User --> VPN --> Tor --> Market Assuming the VPN is trustworthy and you don't connect to Tor without it, the VPN would cover up the fact that you used Tor at all. If you normally use the VPN, but forget it one time, you are now exposed.
      - bauruine 6y ago
        If they are able to do a deanonymization attack on the 3 hop Tor circuit why should a VPN protect you? They can just mount a similar attack on the one hop VPN.
        Shared404 6y ago
        Thus the requirement for the VPN to be trustworthy. What that means changes on the threat model, but for this scenario we'll say a hypothetical VPN provider in a different jurisdiction that takes Monero and has good OpSec. The reason they can do the deanonymization attack on the Tor circuit is that they have basically unlimited resources to set up nodes, and Tor is built on the assumption that the nodes are all unrelated. If a Tor session looks like: User -> VPN -> Tor( A -> B -> C ) -> Market then the government could have the advantage of owning both A and B, or any other combination. That is difficult (though not impossible) to do to a VPN that they do not have jurisdiction over. Anyone can set up a Tor node, but it's not possible to just randomly add nodes to a VPN's network, so they shouldn't be vulnerable to that (barring insecurity in other forms).
        de_nied 6y ago
        Check my other reply. I don't think you understand how deanonymization attacks work. It's not by governments "owning nodes." They might sometimes run the exit node, but that's for detecting certain activity, not finding people. Plus, you can restrict what nodes are used. It's not like the public nodes are the only ones that exist.
        Shared404 6y ago
        Thanks, I appreciate it. Clearly I've got gaps in my understanding, any good resources you could point me towards to study up?
        de_nied 6y ago
        I'd check out Wikipedia categories for general pointers. I think it's important to highlight that internet privacy and internet anonymity are two very different things. Also take care on how the word anonymous is used. Some use the word "pseudo-anonymous" which isn't the same thing. It'd also be helpful to first learn how routing works. Then check out different types of applications(Tor, AnoNet, ZeroNet, etc) and read up on how they implement their networks. Also read up on how the people who ran the markets got caught (read up articles in addition to Wikipedia). Be aware Wikipedia shouldn't be used as actual fact. Check the sources. Many editors misinterpret them, or don't even read them at all. https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Routing https://en.wikipedia.org/wiki/Routing Some keywords/concepts that may help: I2P/Peer-to-peer/Friend-to-friend/ Onion routing Garlic routing Digital fingerprinting https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/Anonymous_P2P https://en.wikipedia.org/wiki/Anonymous_P2P Tails/Whonix/QubeOS for system protection.
- Scoundreller 6y ago
  > given a long enough timeline There's an opportunity. Marketplaces that will exist for X days only.
  - forgingahead 6y ago
    Unlikely - ever tried to get a gambler on a winning streak to "stop while he's ahead"?
    - hunter2_ 6y ago
      I was thinking it sounds more like hopping to another roulette table when the one you're on is getting too hot. Complete fallacy other than a potential placebo effect that somehow encourages saner unrelated decisions.
    - de_nied 6y ago
      These markets actually already exist. However, the owners are generally just cashing in and screwing everyone over for whatever crypto is currently being held.
    - Moru 6y ago
      Scammers is not gamblers really, they just do their scam and move on to the next scam.
    - FDSGSG 6y ago
      This is most markets. Arrests of market operators are not very common, usually they exit at some point and are never heard of again.
  - bigiain 6y ago
    aka "exit scam"
- __MatrixMan__ 6y ago
  Exit scams are also a problem whose likelihood increases with time. Either the fed's bust in and take the user's money, or the market makers take off with the user's money, or both sides wait for the pot to get bigger. It kinda seems like fees and taxes, but instead of paying them on every transaction the users gamble on whether they'll be the one stuck with the bill. I'm also interested in the particular opsec failure for this iteration, I just think don't think it's the only factor.
  - FDSGSG 6y ago
    >I'm also interested in the particular opsec failure for this iteration The person running this site did not have anything near the technical skills required to operate a darknet market. Instead of developing his own, he used a very clunky public script for his market https://github.com/5auth/eckmar-source https://github.com/5auth/eckmar-source All of the early posts by /u/darkmarket on Dread were in /d/darknetmarketsAU. Very early on other users figured out his previous handle he used as a drug vendor. DarkMarket was plagued by repeated IP leaks of its servers, and had its servers seized in the 2019 Cyberbunker raid. https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/SttyK/status/1349261670477045760 https://twitter.com/SttyK/status/1349261670477045760
    - comboy 6y ago
      I think owners who are not security pros may be more common because when somebody knows enough and have been doing it for some time, he may realize that with all his skill he still can be owned one way or another (and he will be given long enough time and high enough incentives).
      - FDSGSG 6y ago
        Or maybe because there are just far more amateurs than actual security pros out there? Dream market remained online for 7 years and shut down gracefully after the administrator got tired of dealing with DDoS attacks, odds are the site earned closer to $100M even if you ignore bitcoin appreciation. >and he will be given long enough time and high enough incentives You only have to last a couple of years to make tens of millions, Empire Market exited the business with over $30 million after two years.
- juskrey 6y ago
  Yeah, there is a huge asymmetry: a lawbreaker has limited tolerance to errors (one will suffice), a law enforcer has basically unlimited error resource.
dang 6y ago
Url changed from https://bitcoinmagazine.com/articles/worlds-largest-darknet-marketplace-has-been-shut-down https://bitcoinmagazine.com/articles/worlds-largest-darknet-..., which points to this. "Please submit the original source. If a post reports on something found on another site, submit the latter." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- thinkloop 6y ago
  How did you find out it wasn't the original? I didn't realize bitcoin magazine did that. The quotes in the title should be around "world's largest" only (since they're about the inability to fully know what's happening on the dark web)
  - colejohnson66 6y ago
    From the Bitcoin Magazine article: > “Police in the northern city of Oldenburg ‘were able to arrest the alleged operator of the suspected world’s largest illegal marketplace on the darknet, the DarkMarket, at the weekend,’ prosecutors said in a statement,” according to Barron’s. (with "Barron’s" linking to the Barron's article) I'd call it a stretch to say Barron's is the original source. It's entirely possible Bitcoin Magazine just pulled a quote from the Barron's article, but I don't know journalism.
    - r721 6y ago
      Here is the original source (Europol's press release): https://www.europol.europa.eu/newsroom/news/darkmarket-worlds-largest-illegal-dark-web-marketplace-taken-down https://www.europol.europa.eu/newsroom/news/darkmarket-world...
  - viraptor 6y ago
    There's a <<..." according to Barron’s.>> quote in the article.
  - dang 6y ago
    I just looked in the article and saw what it linked to. I'm not sure I follow your point about the quotes but it's the article's own title and it doesn't appear to be misleading or linkbait, so we can probably just keep it. (From the guidelines: "Please use the original title, unless it is misleading or linkbait; don't editorialize.") https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
Scoundreller 6y ago
> in what Europol officials said at the time put an end to the "golden age" of dark web markets. Statements like this are always funny.
- thisisnico 6y ago
  Gotta look good to the media and your bosses.
viraptor 6y ago
> A total of at least 320,000 transactions were carried out via the marketplace That's the total from 1-2 years (I can't find when in 2019 did they start). If that's the biggest right now, I'm surprised how small the markets are.
- thinkloop 6y ago
  Agree. Maybe there are many small ones now rather than few huge ones. Would be interesting to see total dark market transactions by year.
  - Tenoke 6y ago
    The active ones with a significant number of transactions are a single digit amount typically with only a few 'bigger' ones (tho in reality still pretty small).
    - ema 6y ago
      How do we know that we know all the active ones? Wouldn't they prefer to not be too widely known?
      - Tenoke 6y ago
        How would they have anywhere near a comparable amount of users if people can't find out about them?
- alasdair_ 6y ago
  They mention over 420,000 BTC plus tens of thousands of monero in transactions. That’s a fair size for 1-2 years.
  - viraptor 6y ago
    Where does that amount come from? The article mentions 4,650 BTC and during that time the price mostly hovered around $10k. That's $85k a day in transactions and 584 transactions a day. I suspect about the same as my local supermarket.
meekmockmook 6y ago
Well, that's okay. I'll be able to buy acid at Walgreens in 15 years anyway.
joejohnson 6y ago
This is definitely not the “world’s largest” right now.
- thelightthat 6y ago
  What is larger?
  - loves_mangoes 6y ago
    I'm not sure what HN's policy is on discussion of illegal marketplaces, but I imagine it's no secret that the new #1 is White House Market.
    - BelenusMordred 6y ago
      This is what I thought was easily on top originally, I don't buy weed anymore but do enjoy hanging out on /d/opsec and the other places seeing what the vibe is. Mr White is amusingly active on forums, it's so incredibly strange when he replies to you randomly with advice. For someone who works in security there's a massive difference between all the wild uninformed speculation you'll see on the clearnet and actual cybercriminals or marketplace kingpins talking about their techniques/tactics. It's an interesting world out there, these folks have serious fucking skin in the game. Same with hugbunter who seems to have no market affiliation but obviously knows her stuff and can clearly hack a thing or two.
      - berberous 6y ago
        What is /d/? A Chan? Some sort of dark net message board?
        BelenusMordred 6y ago
        Dread. Was spawned after all the darknet subreddits were booted. Address here: https://dark.fail/ https://dark.fail/
        6y ago
alasdair_ 6y ago
The article mentions the us irs were involved. For a german marketplace run by an Australian. Any idea why?
- malwarebytess 6y ago
  An idea: much of the time the way dark net vendors are taken down involve the IRS. Did you know that you can legally report illicit income, legally, with ostensibly no negative consequence? >Income from illegal activities, such as money from dealing illegal drugs, must be included in your income on Schedule 1 (Form 1040), line 8, or on Schedule C (Form 1040) if from your self-employment activity. https://www.irs.gov/publications/p17 https://www.irs.gov/publications/p17
  - deleted 6y ago
    [deleted]
  - justinclift 6y ago
    Be that as it may, the "parallel construction" thing by various agencies make it a hairy prospect. eg "legally" report stuff there, and strangely enough anonymous tips to your local LEO officer would probably happen. ;)
    - AnHonestComment 6y ago
      You don’t say what it’s for. Just making unaccounted income isn’t a crime. In more practical terms, the cops already see your electrical bill/weird mail/strange call pattern/questionable cash transactions from other sources — why add tax evasion as an extra charge? The world is a rough place; a lot of people overlook mild infractions if you pay them their cut. The US government is better than par, but they have their own games that go on.
  - alasdair_ 6y ago
    Sure, but the IRS has no jurisdiction in either Germany or Australia for non-citizens.
seibelj 6y ago
No matter what anyone says, I believe with every fiber of my being that simple drug dealing is a victimless crime. Free people choose to purchase and consume drugs to their own detriment (benefit). All violence related to the sale of drugs is ancillary to the fact some drugs (but not others - alcohol, marijuana, caffeine for starters) are illegal. https://freeross.org/ https://freeross.org/
- JALTU 6y ago
  Nothing wrong with having that opinion. You might consider that not all humans have equal capacity for free will, and not all humans are equally able to resist addictive substances. And that someday you may be responsible for, or even love someone who is unable to help themselves. And you can still hold the idea there are no victims. Or, not. Just sayin' you might find things are more complicated IRL.
  - seibelj 6y ago
    I don't want to restrict the freedom of the 99% to prevent the 1% from abusing drugs and ruining their lives, which under prohibition, they have been able to do anyway. Legalization (or at least decriminalization) would be a net-benefit to the group of people that cannot control their impulses. I'm sorry you know people who have problems with drugs, but drugs clearly won despite their illegality.
- skinkestek 6y ago
  > I believe with every fiber of my being that simple drug dealing is a victimless crime. Quick, ugly counterexample: Date rape drugs. You can of course say that the crime is on whoever uses it but criminal neglect is a thing. Somewhat more nuanced example: Vulnerable people are still given highly addictive drugs as "marketing" from dealers. This isn't something all of those victims have chosen, so I'd say it isn't victimless. That said I agree that there's a fair chance that legalizing many drugs would bring large benefits to society.
  - seibelj 6y ago
adenozine 6y ago
As more of the "largest darknet marketplace"s are taken down, it kinda becomes less and less impressive whenever some law enforcement agency does it. This one seems to have decent volume by BTC and other crypto, but it's not really anything earth-shattering. In the scheme of things, I don't see there being any major ground made in preventing people from selling dope online. It's nearly trivial to ship it anonymously and it's nearly trivial to package it and sanitize it and aside from taking the time to scan and inspect every single piece of mail, people are going to continue to want to buy drugs online.
- Tenoke 6y ago
  No, they don't prevent people from buying drugs online but they sure make it less safe and more filled with bad actors by interfering with the reputational nature of them.
  - saiya-jin 6y ago
    Which just harms consumers, who will anyway use the same method to get them. Nobody wins, state police just has some extra semi-meaningless jobs and prisons are a bit more full
martin_a 6y ago
"the largest market" always reminds me of "Bin Ladens right hand". Obviously the next one becomes the largest, but nevertheless it's like they kill at least one of those markets a month. Probably legalizing weed would stop most of that more effectively than all those police operations after month of preparation.
- aunetx 6y ago
  I guess so, but the problem is that weed is not the only thing that is sold on these markets... So even if legalising it would make those markets lose profits, they still have a lot of nasty things to sell -- so taking them down is still the best thing to do for the moment, IMHO.
  - Tenoke 6y ago
    The amount sold on these markets is tiny, however they are one of the safest ways to purchase drugs - with reviews, reputation, tests etc. Constantly interfering with the safest ways to buy drugs so people have to instead buy it from a random person in the real world with less guarantees, and more danger to everyone or from an online scammer that just popped up is not good at all. Further, the costs of these LE operations is very high to catch some small fries. These are extremely counterproductive.
    - capableweb 6y ago
      > up is not good at all I think that's the point. As far as I understand their reasoning (although I don't agree with it), is that some people buy drugs when they are easily accessible over the internet, but wouldn't do so if they have to meet risky people in person AFK. Of course, people who want drugs will get drugs, somehow, and if it's safer, that'd be better. But they want people to move into the riskier meat-space as it's easier to keep track on people and eventually arrest them then.
      - Tenoke 6y ago
        It's not even remotely believable that this is anywhere near an efficient way to eventually catch people irl instead of just spending all those resources on irl operations in the first place.
thinkingemote 6y ago
Anyone suspect this weeks major disruption to the tor network was related to this? 4 days ago: "All v3 Onion addresses unavailable": https://news.ycombinator.com/item?id=25714424 https://news.ycombinator.com/item?id=25714424 This article says that police called their operation "Operation DisrupTor" in 2019.... edits: https://matt.traudt.xyz/posts/tracking-tors-network-wide-v3-onion-service-outages/ https://matt.traudt.xyz/posts/tracking-tors-network-wide-v3-... suggests that it wasnt an attack although was written before the news.
- edeion 6y ago
  I suspected something along these lines when I saw Library Genesis was down two days ago : https://news.ycombinator.com/item?id=25750184 https://news.ycombinator.com/item?id=25750184 These are weird days.
- FDSGSG 6y ago
  Nah, the guy running this site was a moron and kept leaking his server IPs. https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/SttyK/status/1349261670477045760 https://twitter.com/SttyK/status/1349261670477045760 The owners previous identity was known for a long time on Dread (.onion reddit clone)
- system33- 6y ago
  The "attacker" is so bad at consistently preventing consensus generation that I find it extremely hard to believe it is an attack at all, thus it isn't related to this market bust. An attacker would (1) send much more traffic to dirauths or find an easier/better way to disrupt the dirauths' voting, and (2) ignore the fallback dirs. (Author of the matt.traudt.xyz post)
cm2187 6y ago
I get how these market places are used for digital goods (malware, credit cards), but I don’t understand how people can trade physical goods on those. If they have to exchange products, they must either meet in person or use the mail, either is trackable by the authorities. I see how the seller can protect himself for local transactions. He could leave the goods hidden somewhere and tell the buyer where to go. But the buyer has to be exposed 100% of the time.
- zaarn 6y ago
  In germany, a common method is using dead-mans package stations from DHL using stolen one-time credentials to pick up the package.
  - cm2187 6y ago
    Though if the seller is the police, the buyer is exposed.
    - arez 6y ago
      honeypots are not allowed in germany afaik. The police is not allowed to sell drugs or ask people for drugs and then take them in
      - KraftKacke 6y ago
        Also, drug laws are saner than in then US (apart from cannabis legalisation) and nobody is out to get you for minor amounts of any drug. Even getting caught selling drugs will get you locked up guaranteed, if you don't pair that with criminal conspiracy. However, buying or selling weapons is no joke here.
        whatatita 6y ago
        It's pretty similar over the border in Switzerland too, with the exception of looser gun control laws. You can buy an amount of weed here (for personal) use that would absolutely get you convicted with "intent to supply" in the UK. My weed smoking friends were worried they wouldn't be able to pick up when they came to visit. It was not a problem.
leoplct 6y ago
It is very easy for the buyer to get caught: - Buy BTC from an exchange with KYC and then send it to the seller (police) - Receive the product by post or collect it at a pick-up point where the seller (police) knows the address. What strategies can the buyer follow to protect his privacy and trust the seller?
- dannyw 6y ago
  Use monero. There’s a reason why the second largest (now the largest, I guess) market only takes monero now.
  - deleted 6y ago
    [deleted]
- Tenoke 6y ago
  1. Always encrypt your messages personally before messaging a seller. 2. Pick trustworthy sellers with a long history and good reviews. 3. Use monero (or shuffle your btc). 4. Make a new account with a unique username for every purchase. 5. Order only domestically.
- narag 6y ago
  Also live in a country where posesion is not a crime.
- deleted 6y ago
  [deleted]
- asdff 6y ago
  Receiving a package at your address does not make you a criminal. In this situation the police really have no case.
aivisol 6y ago
> anonymous SIM cards Are anonymous SIM cards illegal in Germany? There are definitely some EU countries where you can buy a prepaid SIM card in a newspaper stand without presenting any ID and it is 100% legal.
- hrktb 6y ago
  Interesting question. In France as far as I know they are not illegal, but almost completely disappeared from physical retail, and I had to identify myself to get a prepaid SIM card from one of the major operators (Orange). 10 years ago I'd just have bought it in a supermarket, no questions asked, and the line would be alive as long as it's credited. I wouldn't be surprised that pressure was put on operators to set barriers and make their clients jump through hoops if they try to buy anonymously.
- DominikPeters 6y ago
  Yes, they have been illegal in Germany since 2017. SIM cards now need to be registered by showing ID. http://www.gesetze-im-internet.de/tkg_2004/__111.html http://www.gesetze-im-internet.de/tkg_2004/__111.html
- whatatita 6y ago
  In the UK (okay, not EU anymore but it was until recently) anonymous SIM cards are incredibly easy to come by. You can buy them in most corner shops, supermarkets, and petrol stations. Both big and small operators. If you buy a SIM card from an operator's store they might ask for ID but they didn't the last time I did this (a couple of years ago). When I last flew into the UK there were even prepaid SIM card vending machines, provided by the network operator, in the entrance/exit to the airport. COntrast that with Switzerland, where I had to provide my passport to buy a SIM card.
- Theizestooke 6y ago
  My country declared them illegal a couple years ago, so I went on Ebay and ordered one from the Netherlands. Slovenia is an option too, I think.
abstractbarista 6y ago
Glad to see more XMR usage in these. For every market you take down, two more shall pop up. You cannot fix a demand-side problem by restricting supply. Economically, the pricing will always rise to meet the increased risk of supplying. This war cannot be won. So please just give up.
- dpiers 6y ago
  You can still be highly effective in disincentivizing behavior without completely preventing it. Enforcement raises risk, raising prices, which decreases consumption and thus the incentive to distribute. People are less likely to want to participate as a seller or buyer. You talk a big game, but I don't think you understand the reality for people who are involved and get caught. Let me know when one of your closest friends gets arrested by the Feds and you don't get to see them for a decade plus.
  - freedomben 6y ago
    Not sure I understand your argument. It seems like you are against allowing these markets to function. But then you say: > Let me know when one of your closest friends gets arrested by the Feds and you don't get to see them for a decade plus.* Which seems like an argument in support of GP. If we didn't make these illegal, which then increases prices and danger (only the most ruthless survive), which in turn incentivizes one of your closest friends to take the risk by getting involved in the supply side, then you wouldn't have to worry about "your closest friends gets arrested by the Feds and you don't get to see them for a decade plus." If you're talking about demand side (i.e. your friend is a user), banning the markets won't address that problem. Sure it impacts demand, but it will never eliminate it and it only makes those sucked in all the more vulnerable to exploitation and abuse, and unable to get help from law enforcement since they are committing crimes (this is the identical problem that sex workers with abusive jons and/or "pimps" often have as well).
    - dpiers 6y ago
      I am opposed to allowing the markets to function, and believe the parent post is overly dismissive of the efficacy of enforcement as a deterrent. I intended to call out the folly of their idealism - "the war cannot be won" - the Feds don't have to win a war. Every battle they win destroys the lives of the people foolish enough to be involved. Once you're in their sights it's only a matter of time before you slip up and then you're done.
flyGuyOnTheSly 6y ago
I wonder if the current bull run of crypto prices gave the founder of the market a touch of FOMO and perhaps sold some of his earnings without covering his tracks properly?
Strongylodon 6y ago
So what's the second largest? (Also does largest == best? A market could have a huge volume of mostly scams for example)

203 points by thinkloop 6y ago

In theory it is possible to run a bitcoin tor marketplace anonymously, but in practice, given a long enough timeline, mistakes will happen and chances of getting caught approach 100%. I wonder what mistakes were made here.

Shared404 6y ago
I would also like a report/postmortem. I think we are unlikely to get one however, at least not anytime soon.
0xy 6y ago
You'll never know the real timeline because law enforcement lie about the use of parallel construction to build cases. We know that Tor isn't resistant to state-based attackers, so my money is always on global surveillance networks picking up missteps by the operators. "Whoops I forgot to turn my VPN on and SSH'ed into one of the servers they were already watching" -- this kind of thing.
- de_nied 6y ago
  >"Whoops I forgot to turn my VPN on" Why would someone be using a VPN if they're using tor for the market? Why would a VPN offer any protection at all? If you're using a VPN and "SSH into one of the servers that they are already watching", then a VPN isn't going to provide anonymity.
  - Shared404 6y ago
    The model would be something like User --> VPN --> Tor --> Market Assuming the VPN is trustworthy and you don't connect to Tor without it, the VPN would cover up the fact that you used Tor at all. If you normally use the VPN, but forget it one time, you are now exposed.
    - bauruine 6y ago
      If they are able to do a deanonymization attack on the 3 hop Tor circuit why should a VPN protect you? They can just mount a similar attack on the one hop VPN.
      - Shared404 6y ago
        Thus the requirement for the VPN to be trustworthy. What that means changes on the threat model, but for this scenario we'll say a hypothetical VPN provider in a different jurisdiction that takes Monero and has good OpSec. The reason they can do the deanonymization attack on the Tor circuit is that they have basically unlimited resources to set up nodes, and Tor is built on the assumption that the nodes are all unrelated. If a Tor session looks like: User -> VPN -> Tor( A -> B -> C ) -> Market then the government could have the advantage of owning both A and B, or any other combination. That is difficult (though not impossible) to do to a VPN that they do not have jurisdiction over. Anyone can set up a Tor node, but it's not possible to just randomly add nodes to a VPN's network, so they shouldn't be vulnerable to that (barring insecurity in other forms).
        de_nied 6y ago
        Check my other reply. I don't think you understand how deanonymization attacks work. It's not by governments "owning nodes." They might sometimes run the exit node, but that's for detecting certain activity, not finding people. Plus, you can restrict what nodes are used. It's not like the public nodes are the only ones that exist.
        Shared404 6y ago
        Thanks, I appreciate it. Clearly I've got gaps in my understanding, any good resources you could point me towards to study up?
        de_nied 6y ago
        I'd check out Wikipedia categories for general pointers. I think it's important to highlight that internet privacy and internet anonymity are two very different things. Also take care on how the word anonymous is used. Some use the word "pseudo-anonymous" which isn't the same thing. It'd also be helpful to first learn how routing works. Then check out different types of applications(Tor, AnoNet, ZeroNet, etc) and read up on how they implement their networks. Also read up on how the people who ran the markets got caught (read up articles in addition to Wikipedia). Be aware Wikipedia shouldn't be used as actual fact. Check the sources. Many editors misinterpret them, or don't even read them at all. https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Internet_privacy https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Category:Anonymity_networks https://en.wikipedia.org/wiki/Routing https://en.wikipedia.org/wiki/Routing Some keywords/concepts that may help: I2P/Peer-to-peer/Friend-to-friend/ Onion routing Garlic routing Digital fingerprinting https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Mix_network https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/Crowds_(anonymity_network) https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/ZeroNet https://en.wikipedia.org/wiki/Anonymous_P2P https://en.wikipedia.org/wiki/Anonymous_P2P Tails/Whonix/QubeOS for system protection.
Scoundreller 6y ago
> given a long enough timeline There's an opportunity. Marketplaces that will exist for X days only.
- forgingahead 6y ago
  Unlikely - ever tried to get a gambler on a winning streak to "stop while he's ahead"?
  - hunter2_ 6y ago
    I was thinking it sounds more like hopping to another roulette table when the one you're on is getting too hot. Complete fallacy other than a potential placebo effect that somehow encourages saner unrelated decisions.
  - de_nied 6y ago
    These markets actually already exist. However, the owners are generally just cashing in and screwing everyone over for whatever crypto is currently being held.
  - Moru 6y ago
    Scammers is not gamblers really, they just do their scam and move on to the next scam.
  - FDSGSG 6y ago
    This is most markets. Arrests of market operators are not very common, usually they exit at some point and are never heard of again.
- bigiain 6y ago
  aka "exit scam"
__MatrixMan__ 6y ago
Exit scams are also a problem whose likelihood increases with time. Either the fed's bust in and take the user's money, or the market makers take off with the user's money, or both sides wait for the pot to get bigger. It kinda seems like fees and taxes, but instead of paying them on every transaction the users gamble on whether they'll be the one stuck with the bill. I'm also interested in the particular opsec failure for this iteration, I just think don't think it's the only factor.
- FDSGSG 6y ago
  >I'm also interested in the particular opsec failure for this iteration The person running this site did not have anything near the technical skills required to operate a darknet market. Instead of developing his own, he used a very clunky public script for his market https://github.com/5auth/eckmar-source https://github.com/5auth/eckmar-source All of the early posts by /u/darkmarket on Dread were in /d/darknetmarketsAU. Very early on other users figured out his previous handle he used as a drug vendor. DarkMarket was plagued by repeated IP leaks of its servers, and had its servers seized in the 2019 Cyberbunker raid. https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/SttyK/status/1349261670477045760 https://twitter.com/SttyK/status/1349261670477045760
  - comboy 6y ago
    I think owners who are not security pros may be more common because when somebody knows enough and have been doing it for some time, he may realize that with all his skill he still can be owned one way or another (and he will be given long enough time and high enough incentives).
    - FDSGSG 6y ago
      Or maybe because there are just far more amateurs than actual security pros out there? Dream market remained online for 7 years and shut down gracefully after the administrator got tired of dealing with DDoS attacks, odds are the site earned closer to $100M even if you ignore bitcoin appreciation. >and he will be given long enough time and high enough incentives You only have to last a couple of years to make tens of millions, Empire Market exited the business with over $30 million after two years.
juskrey 6y ago
Yeah, there is a huge asymmetry: a lawbreaker has limited tolerance to errors (one will suffice), a law enforcer has basically unlimited error resource.

dang 6y ago

Url changed from https://bitcoinmagazine.com/articles/worlds-largest-darknet-marketplace-has-been-shut-down https://bitcoinmagazine.com/articles/worlds-largest-darknet-..., which points to this. "Please submit the original source. If a post reports on something found on another site, submit the latter." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

thinkloop 6y ago
How did you find out it wasn't the original? I didn't realize bitcoin magazine did that. The quotes in the title should be around "world's largest" only (since they're about the inability to fully know what's happening on the dark web)
- colejohnson66 6y ago
  From the Bitcoin Magazine article: > “Police in the northern city of Oldenburg ‘were able to arrest the alleged operator of the suspected world’s largest illegal marketplace on the darknet, the DarkMarket, at the weekend,’ prosecutors said in a statement,” according to Barron’s. (with "Barron’s" linking to the Barron's article) I'd call it a stretch to say Barron's is the original source. It's entirely possible Bitcoin Magazine just pulled a quote from the Barron's article, but I don't know journalism.
  - r721 6y ago
    Here is the original source (Europol's press release): https://www.europol.europa.eu/newsroom/news/darkmarket-worlds-largest-illegal-dark-web-marketplace-taken-down https://www.europol.europa.eu/newsroom/news/darkmarket-world...
- viraptor 6y ago
  There's a <<..." according to Barron’s.>> quote in the article.
- dang 6y ago
  I just looked in the article and saw what it linked to. I'm not sure I follow your point about the quotes but it's the article's own title and it doesn't appear to be misleading or linkbait, so we can probably just keep it. (From the guidelines: "Please use the original title, unless it is misleading or linkbait; don't editorialize.") https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

Scoundreller 6y ago

> in what Europol officials said at the time put an end to the "golden age" of dark web markets. Statements like this are always funny.

thisisnico 6y ago
Gotta look good to the media and your bosses.

viraptor 6y ago

> A total of at least 320,000 transactions were carried out via the marketplace That's the total from 1-2 years (I can't find when in 2019 did they start). If that's the biggest right now, I'm surprised how small the markets are.

thinkloop 6y ago
Agree. Maybe there are many small ones now rather than few huge ones. Would be interesting to see total dark market transactions by year.
- Tenoke 6y ago
  The active ones with a significant number of transactions are a single digit amount typically with only a few 'bigger' ones (tho in reality still pretty small).
  - ema 6y ago
    How do we know that we know all the active ones? Wouldn't they prefer to not be too widely known?
    - Tenoke 6y ago
      How would they have anywhere near a comparable amount of users if people can't find out about them?
alasdair_ 6y ago
They mention over 420,000 BTC plus tens of thousands of monero in transactions. That’s a fair size for 1-2 years.
- viraptor 6y ago
  Where does that amount come from? The article mentions 4,650 BTC and during that time the price mostly hovered around $10k. That's $85k a day in transactions and 584 transactions a day. I suspect about the same as my local supermarket.

meekmockmook 6y ago

Well, that's okay. I'll be able to buy acid at Walgreens in 15 years anyway.

joejohnson 6y ago

This is definitely not the “world’s largest” right now.

thelightthat 6y ago
What is larger?
- loves_mangoes 6y ago
  I'm not sure what HN's policy is on discussion of illegal marketplaces, but I imagine it's no secret that the new #1 is White House Market.
  - BelenusMordred 6y ago
    This is what I thought was easily on top originally, I don't buy weed anymore but do enjoy hanging out on /d/opsec and the other places seeing what the vibe is. Mr White is amusingly active on forums, it's so incredibly strange when he replies to you randomly with advice. For someone who works in security there's a massive difference between all the wild uninformed speculation you'll see on the clearnet and actual cybercriminals or marketplace kingpins talking about their techniques/tactics. It's an interesting world out there, these folks have serious fucking skin in the game. Same with hugbunter who seems to have no market affiliation but obviously knows her stuff and can clearly hack a thing or two.
    - berberous 6y ago
      What is /d/? A Chan? Some sort of dark net message board?
      - BelenusMordred 6y ago
        Dread. Was spawned after all the darknet subreddits were booted. Address here: https://dark.fail/ https://dark.fail/
      - 6y ago

alasdair_ 6y ago

The article mentions the us irs were involved. For a german marketplace run by an Australian. Any idea why?

malwarebytess 6y ago
An idea: much of the time the way dark net vendors are taken down involve the IRS. Did you know that you can legally report illicit income, legally, with ostensibly no negative consequence? >Income from illegal activities, such as money from dealing illegal drugs, must be included in your income on Schedule 1 (Form 1040), line 8, or on Schedule C (Form 1040) if from your self-employment activity. https://www.irs.gov/publications/p17 https://www.irs.gov/publications/p17
- deleted 6y ago
  [deleted]
- justinclift 6y ago
  Be that as it may, the "parallel construction" thing by various agencies make it a hairy prospect. eg "legally" report stuff there, and strangely enough anonymous tips to your local LEO officer would probably happen. ;)
  - AnHonestComment 6y ago
    You don’t say what it’s for. Just making unaccounted income isn’t a crime. In more practical terms, the cops already see your electrical bill/weird mail/strange call pattern/questionable cash transactions from other sources — why add tax evasion as an extra charge? The world is a rough place; a lot of people overlook mild infractions if you pay them their cut. The US government is better than par, but they have their own games that go on.
- alasdair_ 6y ago
  Sure, but the IRS has no jurisdiction in either Germany or Australia for non-citizens.

seibelj 6y ago

No matter what anyone says, I believe with every fiber of my being that simple drug dealing is a victimless crime. Free people choose to purchase and consume drugs to their own detriment (benefit). All violence related to the sale of drugs is ancillary to the fact some drugs (but not others - alcohol, marijuana, caffeine for starters) are illegal. https://freeross.org/ https://freeross.org/

JALTU 6y ago
Nothing wrong with having that opinion. You might consider that not all humans have equal capacity for free will, and not all humans are equally able to resist addictive substances. And that someday you may be responsible for, or even love someone who is unable to help themselves. And you can still hold the idea there are no victims. Or, not. Just sayin' you might find things are more complicated IRL.
- seibelj 6y ago
  I don't want to restrict the freedom of the 99% to prevent the 1% from abusing drugs and ruining their lives, which under prohibition, they have been able to do anyway. Legalization (or at least decriminalization) would be a net-benefit to the group of people that cannot control their impulses. I'm sorry you know people who have problems with drugs, but drugs clearly won despite their illegality.
skinkestek 6y ago
> I believe with every fiber of my being that simple drug dealing is a victimless crime. Quick, ugly counterexample: Date rape drugs. You can of course say that the crime is on whoever uses it but criminal neglect is a thing. Somewhat more nuanced example: Vulnerable people are still given highly addictive drugs as "marketing" from dealers. This isn't something all of those victims have chosen, so I'd say it isn't victimless. That said I agree that there's a fair chance that legalizing many drugs would bring large benefits to society.
- seibelj 6y ago

adenozine 6y ago

As more of the "largest darknet marketplace"s are taken down, it kinda becomes less and less impressive whenever some law enforcement agency does it. This one seems to have decent volume by BTC and other crypto, but it's not really anything earth-shattering. In the scheme of things, I don't see there being any major ground made in preventing people from selling dope online. It's nearly trivial to ship it anonymously and it's nearly trivial to package it and sanitize it and aside from taking the time to scan and inspect every single piece of mail, people are going to continue to want to buy drugs online.

Tenoke 6y ago
No, they don't prevent people from buying drugs online but they sure make it less safe and more filled with bad actors by interfering with the reputational nature of them.
- saiya-jin 6y ago
  Which just harms consumers, who will anyway use the same method to get them. Nobody wins, state police just has some extra semi-meaningless jobs and prisons are a bit more full

martin_a 6y ago

"the largest market" always reminds me of "Bin Ladens right hand". Obviously the next one becomes the largest, but nevertheless it's like they kill at least one of those markets a month. Probably legalizing weed would stop most of that more effectively than all those police operations after month of preparation.

aunetx 6y ago
I guess so, but the problem is that weed is not the only thing that is sold on these markets... So even if legalising it would make those markets lose profits, they still have a lot of nasty things to sell -- so taking them down is still the best thing to do for the moment, IMHO.
- Tenoke 6y ago
  The amount sold on these markets is tiny, however they are one of the safest ways to purchase drugs - with reviews, reputation, tests etc. Constantly interfering with the safest ways to buy drugs so people have to instead buy it from a random person in the real world with less guarantees, and more danger to everyone or from an online scammer that just popped up is not good at all. Further, the costs of these LE operations is very high to catch some small fries. These are extremely counterproductive.
  - capableweb 6y ago
    > up is not good at all I think that's the point. As far as I understand their reasoning (although I don't agree with it), is that some people buy drugs when they are easily accessible over the internet, but wouldn't do so if they have to meet risky people in person AFK. Of course, people who want drugs will get drugs, somehow, and if it's safer, that'd be better. But they want people to move into the riskier meat-space as it's easier to keep track on people and eventually arrest them then.
    - Tenoke 6y ago
      It's not even remotely believable that this is anywhere near an efficient way to eventually catch people irl instead of just spending all those resources on irl operations in the first place.

thinkingemote 6y ago

Anyone suspect this weeks major disruption to the tor network was related to this? 4 days ago: "All v3 Onion addresses unavailable": https://news.ycombinator.com/item?id=25714424 https://news.ycombinator.com/item?id=25714424 This article says that police called their operation "Operation DisrupTor" in 2019.... edits: https://matt.traudt.xyz/posts/tracking-tors-network-wide-v3-onion-service-outages/ https://matt.traudt.xyz/posts/tracking-tors-network-wide-v3-... suggests that it wasnt an attack although was written before the news.

edeion 6y ago
I suspected something along these lines when I saw Library Genesis was down two days ago : https://news.ycombinator.com/item?id=25750184 https://news.ycombinator.com/item?id=25750184 These are weird days.
FDSGSG 6y ago
Nah, the guy running this site was a moron and kept leaking his server IPs. https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/SttyK/status/1349034993893265408 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/5auth/status/1349358474476613633 https://twitter.com/SttyK/status/1349261670477045760 https://twitter.com/SttyK/status/1349261670477045760 The owners previous identity was known for a long time on Dread (.onion reddit clone)
system33- 6y ago
The "attacker" is so bad at consistently preventing consensus generation that I find it extremely hard to believe it is an attack at all, thus it isn't related to this market bust. An attacker would (1) send much more traffic to dirauths or find an easier/better way to disrupt the dirauths' voting, and (2) ignore the fallback dirs. (Author of the matt.traudt.xyz post)

cm2187 6y ago

I get how these market places are used for digital goods (malware, credit cards), but I don’t understand how people can trade physical goods on those. If they have to exchange products, they must either meet in person or use the mail, either is trackable by the authorities. I see how the seller can protect himself for local transactions. He could leave the goods hidden somewhere and tell the buyer where to go. But the buyer has to be exposed 100% of the time.

zaarn 6y ago
In germany, a common method is using dead-mans package stations from DHL using stolen one-time credentials to pick up the package.
- cm2187 6y ago
  Though if the seller is the police, the buyer is exposed.
  - arez 6y ago
    honeypots are not allowed in germany afaik. The police is not allowed to sell drugs or ask people for drugs and then take them in
    - KraftKacke 6y ago
      Also, drug laws are saner than in then US (apart from cannabis legalisation) and nobody is out to get you for minor amounts of any drug. Even getting caught selling drugs will get you locked up guaranteed, if you don't pair that with criminal conspiracy. However, buying or selling weapons is no joke here.
      - whatatita 6y ago
        It's pretty similar over the border in Switzerland too, with the exception of looser gun control laws. You can buy an amount of weed here (for personal) use that would absolutely get you convicted with "intent to supply" in the UK. My weed smoking friends were worried they wouldn't be able to pick up when they came to visit. It was not a problem.

leoplct 6y ago

It is very easy for the buyer to get caught: - Buy BTC from an exchange with KYC and then send it to the seller (police) - Receive the product by post or collect it at a pick-up point where the seller (police) knows the address. What strategies can the buyer follow to protect his privacy and trust the seller?

dannyw 6y ago
Use monero. There’s a reason why the second largest (now the largest, I guess) market only takes monero now.
- deleted 6y ago
  [deleted]
Tenoke 6y ago
1. Always encrypt your messages personally before messaging a seller. 2. Pick trustworthy sellers with a long history and good reviews. 3. Use monero (or shuffle your btc). 4. Make a new account with a unique username for every purchase. 5. Order only domestically.
narag 6y ago
Also live in a country where posesion is not a crime.
deleted 6y ago
[deleted]
asdff 6y ago
Receiving a package at your address does not make you a criminal. In this situation the police really have no case.

aivisol 6y ago

> anonymous SIM cards Are anonymous SIM cards illegal in Germany? There are definitely some EU countries where you can buy a prepaid SIM card in a newspaper stand without presenting any ID and it is 100% legal.

hrktb 6y ago
Interesting question. In France as far as I know they are not illegal, but almost completely disappeared from physical retail, and I had to identify myself to get a prepaid SIM card from one of the major operators (Orange). 10 years ago I'd just have bought it in a supermarket, no questions asked, and the line would be alive as long as it's credited. I wouldn't be surprised that pressure was put on operators to set barriers and make their clients jump through hoops if they try to buy anonymously.
DominikPeters 6y ago
Yes, they have been illegal in Germany since 2017. SIM cards now need to be registered by showing ID. http://www.gesetze-im-internet.de/tkg_2004/__111.html http://www.gesetze-im-internet.de/tkg_2004/__111.html
whatatita 6y ago
In the UK (okay, not EU anymore but it was until recently) anonymous SIM cards are incredibly easy to come by. You can buy them in most corner shops, supermarkets, and petrol stations. Both big and small operators. If you buy a SIM card from an operator's store they might ask for ID but they didn't the last time I did this (a couple of years ago). When I last flew into the UK there were even prepaid SIM card vending machines, provided by the network operator, in the entrance/exit to the airport. COntrast that with Switzerland, where I had to provide my passport to buy a SIM card.
Theizestooke 6y ago
My country declared them illegal a couple years ago, so I went on Ebay and ordered one from the Netherlands. Slovenia is an option too, I think.

abstractbarista 6y ago

Glad to see more XMR usage in these. For every market you take down, two more shall pop up. You cannot fix a demand-side problem by restricting supply. Economically, the pricing will always rise to meet the increased risk of supplying. This war cannot be won. So please just give up.

dpiers 6y ago
You can still be highly effective in disincentivizing behavior without completely preventing it. Enforcement raises risk, raising prices, which decreases consumption and thus the incentive to distribute. People are less likely to want to participate as a seller or buyer. You talk a big game, but I don't think you understand the reality for people who are involved and get caught. Let me know when one of your closest friends gets arrested by the Feds and you don't get to see them for a decade plus.
- freedomben 6y ago
  Not sure I understand your argument. It seems like you are against allowing these markets to function. But then you say: > Let me know when one of your closest friends gets arrested by the Feds and you don't get to see them for a decade plus.* Which seems like an argument in support of GP. If we didn't make these illegal, which then increases prices and danger (only the most ruthless survive), which in turn incentivizes one of your closest friends to take the risk by getting involved in the supply side, then you wouldn't have to worry about "your closest friends gets arrested by the Feds and you don't get to see them for a decade plus." If you're talking about demand side (i.e. your friend is a user), banning the markets won't address that problem. Sure it impacts demand, but it will never eliminate it and it only makes those sucked in all the more vulnerable to exploitation and abuse, and unable to get help from law enforcement since they are committing crimes (this is the identical problem that sex workers with abusive jons and/or "pimps" often have as well).
  - dpiers 6y ago
    I am opposed to allowing the markets to function, and believe the parent post is overly dismissive of the efficacy of enforcement as a deterrent. I intended to call out the folly of their idealism - "the war cannot be won" - the Feds don't have to win a war. Every battle they win destroys the lives of the people foolish enough to be involved. Once you're in their sights it's only a matter of time before you slip up and then you're done.

flyGuyOnTheSly 6y ago

I wonder if the current bull run of crypto prices gave the founder of the market a touch of FOMO and perhaps sold some of his earnings without covering his tracks properly?

Strongylodon 6y ago

So what's the second largest? (Also does largest == best? A market could have a huge volume of mostly scams for example)