Anatomy of an exit scam: the predictable stages before a darknet market disappears
When a darknet market dies at the hands of its own administrators, the ending is rarely a surprise to careful observers. Exit scams follow a recognizable script, refined over more than a decade of stolen escrow funds, from Evolution's $12 million vanishing act in 2015 to Empire Market's $30 million blackout in 2020. Knowing the stages turns panic into pattern recognition.
Stage one: the withdrawal slows to a crawl
The first verifiable sign is almost always friction around withdrawals. Before Evolution vanished in March 2015, its moderators instituted long delays in processing vendor withdrawal requests, blaming an unexpected influx that the coffers could supposedly not satisfy all at once, as Brian Krebs documented at the time. Vendors who noticed the delays had roughly a day before the site went dark for good. The same tell appeared at Sheep Marketplace in 2013, where users reported blocked withdrawals more than a week before the operators announced a convenient vendor "hack" as cover, according to reporting later summarized on Wikipedia and Forbes. A market that holds your deposits controls the exit door. When that door starts sticking, treat it as data, not bad luck.Stage two: the excuses multiply
Once delays begin, administrators rarely admit anything. They cite DDoS attacks, wallet maintenance, blockchain congestion, or security upgrades. Empire Market spent years under genuine denial-of-service attacks and was reportedly paying an extortionist five figures weekly, which gave its operators a plausible cover story when the end came. The trick is distinguishing operational problems from stalling. Real outages come with partial service, staff communication, and eventually restored withdrawals. An exit scam's technical issues never resolve, because they are not meant to. As Chainalysis noted in its review of the 2020 landscape, some markets keep appearing active precisely so administrators can continue collecting money from purchases that will never be fulfilled (Chainalysis).Stage three: the pressure to finalize early
A subtler stage involves incentives rather than outages. Observers at Sheep Marketplace watched moderators slash prices, push bulk deals, and encourage buyers to pay upfront instead of using escrow while withdrawals were already broken. That is inventory liquidation behavior: extracting maximum cash inflow during the final window. Watch for it in reverse too. Empire's head moderator Se7en initially downplayed concerns on Dread, insisting the downtime was attack-related and not an exit scam, since classic scams involve weeks of disabled withdrawals, per CoinDesk. Reassurances from staff are worth exactly as much as their access to the escrow wallets, which is total.The blackout
"I am so sorry, but Verto and Kimble have f--ked us all. I have over $20,000 in escrow myself from sales." - NSWGreat, Evolution staffer, March 2015The finale is anticlimactic. The onion stops resolving, the forum goes silent, and no law enforcement seizure banner appears. Andy Greenberg's Wired coverage of Evolution noted the absence of any takedown notice as the key discriminator between a scam and a bust. Empire simply went offline on August 22, 2020, and stayed there, with an estimated 2,638 BTC gone.
The warning signs you can actually check
Most of this is verifiable without insider access. Before trusting any market with funds, monitor:- Withdrawal latency over days, not hours, especially if deposits still work instantly
- Staff activity on public forums like Dread going quiet or turning defensive
- Aggressive promotions, price cuts, or pushes toward direct-pay orders
- Rising complaints about withheld funds from multiple independent vendors
- Sustained downtime beyond what previous incidents recovered from