The site’s administrator, known as “Vito,” attributed the disruptions to a wave of new users following the shutdown of rival Archetyp Market and an alleged DDoS attack. The site’s operators charged fees on every transaction and even offered 3.3 million cards for free to lure in new users. In one major operation, U.S. agencies dismantled BidenCash, a platform that sold over 15 million stolen credit cards and credentials, generating more than $17 million since 2022. Fraud shops are services found mainly on the dark web that sell stolen data and personally identifiable information (PII), which cybercriminals use for scams, identity theft, and ransomware attacks.
Continued Law Enforcement Efforts Key To Illicit
Blacksprut, which rose to prominence with Mega in the wake of Hydra’s 2022 sanctions designation, law enforcement seizure, and subsequent collapse, came in third with 13.6% less revenue YoY. A series of law enforcement takedowns in the last few years have shaped the 2024 drug and fraud ecosystems. The darknet environment constantly evolves, requiring continuous education on emerging threats and updated countermeasures. Disputes on Abacus darknet should be handled through official escrow systems—never finalize early without product receipt.
- All sellers undergo strict verification ($1,500 vendor bond) to ensure marketplace quality and reduce scams.
- Beginning in September 2021, Abacus Market has established itself as one of the leading dark web marketplaces.
- Despite some occasional service issues, Russian Market remains a favorite among cybercriminals seeking fresh access and financial data.
- Last year, DNM vendors sent a significantly higher portion of their funds to DeFi than they did historically.
- In late June, users began reporting withdrawal issues, which prompted the Abacus administrator known by the handle “Vito” to assure users that the problems were merely a result of an influx of new people and a distributed denial-of-service attack.
Global Crackdowns Leave Crypto Criminals Few Options
Russian Market has operated since 2019, specialising in stolen credentials, stealer logs, and remote desktop access. This survey highlights active and recently shuttered markets with actionable metrics and intelligence for threat hunters, CISOs, and red team leaders. Only 23% of vendor applications are approved, resulting in the most trustworthy vendor base in the darknet ecosystem.
TRM Labs analysis shows that nearly half of the marketplaces launched in 2024 accepted only Monero — a sharp increase from just over one-third in 2023. TRM Labs analysts observed that this pattern aligns with typical exit scams, similar to how Evolution Market and other darknet sites previously disappeared. In 2024, Abacus accounted for 70% of Western darknet platforms accepting Bitcoin. Users who engage in these marketplaces do so at their own risk, with little to no protection for their funds or personal information. Vito eventually stopped communicating entirely, aligning with typical exit scam patterns observed in other darknet sites like Evolution Market. All sellers undergo strict verification ($1,500 vendor bond) to ensure marketplace quality and reduce scams.
Bohemia accepts Monero and Bitcoin as payment methods and places a strong emphasis on protecting user anonymity through PGP encryption. Mega Market, established in 2016, experienced a surge in popularity following the takedown of the Hydra market. Its user base is primarily English-speaking, and it appeals to more sophisticated cybercriminals. Welcome to Daily Security Review, the premier source for news and information on security threats, Ransomware and vulnerabilities.
Abacus Market Shutters After Exit Scam, Say Experts
The platform’s administrator, known by the alias “Vito,” attributed the problems to a distributed denial-of-service (DDoS) attack and a surge in new registrations following Archetyp Market’s collapse. TRM estimates the platform processed between $300 million and $400 million in total sales during its operation. Analysts note that while a covert takedown remains a possibility, the signs overwhelmingly point to an exit strategy. According to blockchain intelligence firm TRM Labs, Abacus’ web infrastructure—including its clearnet mirrors—became inaccessible in early July.
JavaScript Supply-Chain Attack Infects Key Crypto Packages, ENS Libraries Hit Hard
Abacus Market has surpassed 1,200 verified vendors, with a 34% increase in new vendor applications compared to last quarter. All users are advised to update their PGP keys immediately. Line chart showing steady monthly growth in users and transactions The platform is developing decentralized infrastructure that will make it virtually unstoppable while maintaining its legendary security. The marketplace became known for its reliability during this period. With an unwavering commitment to security, user privacy, and operational reliability, Abacus has earned the trust of the community.
How Mid-Market Businesses Can Leverage Microsoft Security For Proactive Defenses
Along with its listings for large pill press machines, the vendor does not hide the sale of Oxycontin and Xanax TDP die kits, which are used to press counterfeit pills. For example, in India, one of the most frequent listings is for generic medication, which mostly comes from the first vendor shown below. In Colombia, for instance, many of the vendor listings are for cocaine or Infrastructure-as-a-Service, as seen in the screenshot below.
Canadian Crypto-Exchange Shutters After $6m ‘Hack’
TRM Labs speculates the Abacus operators could have also “lost motivation to continue” or chose to exit the ecosystem to “preserve their freedom and financial gains.” Its website and infrastructure, including its clearnet mirror, are inaccessible, TRM Labs said in a report on Monday.
With these stolen credentials, the suspects purchased ghost gun parts and tools from a variety of legitimate websites, which they used to build ghost guns with a 3D printer, and sell for cash. Suspects were exchanging large sums of fiat for cryptocurrency by transferring cash into a mainstream CEX account and buying BTC, which they used to purchase stolen credit cards and identities from fraud shops on the dark web. Interestingly, this vendor has also been a trusted supplier for OFAC-designated fentanyl traffickers Alex Adrianus Martinus Peijnenburg and Matthew Simon Grimm, having received close to $1.5 million in purchases from them. The vendor’s listing of a protonitazene analog boldly states that the compound has a potency 20x greater than that of fentanyl, as seen below. The vendor accepts BTC and XMR, and analyzing its on-chain exposure to regional CEXs and DNMs reveals that it serves customers worldwide, including in the United States, Canada, Sweden, and Russia.
Vendor Distribution
While DNM and fraud shop revenues declined in 2024 following years of concerted international law enforcement efforts, these platforms have managed to sustain their operations by adopting new tactics. The Abacus Market operates as a secure darknet platform requiring Tor access through verified Abacus onion links to prevent phishing scams. Abacus Market is a well-known darknet marketplace operating as a hidden Tor Abacus onion service. Yet, several marketplaces managed to retire gracefully over the past few months. Luckily, the dark web community has no shortage of information on everything you need to know about the darknet markets. Abacus launched in September 2021 as ‘Alphabet Market,’ and gradually increased its popularity, especially as the number of other markets on the dark web dwindled, mostly as a result of law enforcement actions.
Active for a decade since 2014, it is a widely used credit card shop used to source stolen credit card information such as dumps, CVVs, Wholesale Accounts. But once you start doing illegal things, like buying drugs or stolen credit cards, that’s when you’re breaking the law. It’s been a constant back-and-forth between cybercriminals and law enforcement, with each new site trying to be smarter and more secure than the last. These sites cater to cybercriminals seeking valuable data, such as credit card numbers, login credentials, and personal information. This similarity includes menu options, vendor pages, listing pages, categories, and listing layouts.
Abacus Darknet Market: Exit Scam!
That’s the Abacus difference—built by devs who live the darknet, not just code it. Dread calls us “the darknet’s quiet giant”—we don’t flaunt, we deliver. Vendors, who rely on timely withdrawals to access their earnings, are particularly worried, with some claiming their funds are now stuck in escrow.
Apart from the dark web markets that are operating online today, some raided platforms influenced many markets. One of the most common is the exit scam, where a marketplace suddenly disappears and takes everyone’s money with it. But that is to be expected especially after the recent bust of Archetyp and multiple of it's largest vendors, but that wouldn't provide an excuse to exit scam in fact the contrary. Abacus was one of the top darknet marketplaces dealing in Bitcoin. These efforts helped it become one of the most active platforms among Australian users. Even as major darknet platforms fall, TRM Labs data shows that the ecosystem remains highly adaptive.
Our recent upgrades include a fully responsive design, improved CAPTCHA for easier access, and enhanced platform stability. TRM Labs stated that the recent rise in new users may have attracted more attention from authorities. TRM Labs noted that these patterns, withdrawal delays, user panic, and plummeting deposits, have been seen before on darknet sites that later vanished with customer money. Despite these claims, deposits to the marketplace began to fall, from around $230,000 a day in June to just $13,000 a day by July. The site’s administrator, known as "Vito", told users this was due to too many new accounts and a denial-of-service attack.
Useful Tools
The leading darknet marketplace for secure, anonymous transactions since 2021. Starting with just 23 vendors, the platform quickly gained traction. The evolution of the most trusted darknet marketplace Our smart mirror system automatically redirects users to the fastest available gateway, ensuring uninterrupted access even during high-traffic periods.
