Darknet fraud glossary: exit scams, FE, vendor bonds and the language of disappearing money

Every darknet forum runs on compressed language. A single line in a vendor profile - FE unless reship, bond refunded after 90 days, ignore the FUD - encodes a history of scams that never got their own write-ups. This vocabulary did not appear for style: each term names a specific way money disappears or trust gets abused, coined by users after a pattern had already cost them deposits. What follows is a working reference to the terms that carry real risk information, and why each one exists.

When operators vanish: exit scam and rug pull

• Exit scam: an operator shuts a market or service and disappears with the funds it holds. The reference case is Evolution, which vanished in March 2015 leaving with over EUR 11 million in bitcoin held in escrow, according to Europol; Sheep Marketplace had folded the same way in November 2013 with more than EUR 36 million of members' money. The term exists because the pattern repeats: whoever holds the escrow holds the exit door (Europol IOCTA 2015).
• Rug pull: the crypto-native version of the same move, applied to tokens and projects rather than markets - developers attract deposits into what looks like a legitimate venture, then drain and abandon it. Chainalysis noted in 2021 that the definition is still loose, but rug pulls had already taken in over $2.8 billion that year, about 37 percent of the scam revenue it measured (Chainalysis).

"Developers build out what appear to be legitimate cryptocurrency projects before ultimately taking investors' money and disappearing." - Chainalysis, 2021

Bonds, escrow and FE: how markets price trust

• Vendor bond: a deposit a market charges before it lets a seller open a listing account, nominally refundable. The stated purpose is deterrence - scamming buyers or breaking rules costs the vendor the bond - and the upfront sum filters out casual fraudsters. In practice it doubles as a revenue line and a lever of control for whoever administers the market.
• Bond forfeiture: the enforcement side of the same arrangement. A market seizes a vendor's deposit after a scam ruling, a rule breach, or an accusation the staff choose to believe. Because the ruling is internal and unappealable, forfeiture is where administration blurs into confiscation - which is why experienced vendors read bond terms before commission rates.
• Finalize early (FE): the buyer releases escrow to the vendor before the order arrives or its conditions are met. Rapid7's dark web glossary defines FE as the release of escrow funds before the conditions of the contract are satisfied; vendors pushed for it to escape feedback extortion and slow escrow releases, while a buyer who FE's accepts the entire risk of receiving nothing (Rapid7).
• "FE unless...": listing shorthand that makes early release the default, with stated exceptions - FE unless you have five completed orders with me, FE unless shipping is tracked. Parsing matters more than the acronym: whatever follows the unless is the only protection left, and the rest of the transaction runs on the vendor's word alone.

FUD, mirrors and canaries: reading the status signals

• FUD: fear, uncertainty and doubt - the label attached to any rumor that a market is dying, stealing, or already compromised. The term earned its place because rumor cascades are real events on these forums: withdrawal panics can empty reserves faster than any raid. Overuse turned it into a reflex dismissal, so the word often signals a fight over narrative more than a judgment about facts.
• Mirror: an alternative onion address serving the same site, published so users can keep reaching it during downtime and so phishing clones are easier to spot. Since fake mirrors are the standard way to harvest logins, the phrase that matters in practice is verified mirror - an address confirmed through PGP-signed announcements, not through a stranger's forum post.
• Warrant canary: a regularly published, usually signed statement that an operator has not received legal process it is prohibited from disclosing. EFF, which keeps an FAQ on the practice, describes the mechanism plainly: the update is the statement, and when it stops appearing on schedule, the silence is the warning - with the caveat that a canary is only as convincing as the process behind it (EFF).

OPSEC and the delivery-side vocabulary

• OPSEC: operations security - the discipline of keeping a pseudonym unlinked from payment records, devices, and writing habits. The term is military in origin and does double duty on forums: praise for the careful, epitaph for the careless. Most enforcement cases against market staff read, in the end, as OPSEC failure stories.
• Share drop: in carding slang a drop is a delivery address a fraudster controls without living at it - an empty flat, a complaisant neighbor, a reshipper. A share drop, more often written shared drop, is one such address serving several fraudsters at once, spreading volume and exposure across a single mailbox. SEON's fraud glossary treats the underlying term, drop address, as a hallmark of reshipping fraud.