Dark Markets, Cyber Crime

DeepSea Market Possibly Exit-Scammed, Continuing the Recent Streak of Admins Disappearance

Market exits by admin disappearance seem to become a trend these days. First with Empire Market at the end of August, then Icarus Market in September, and now Deep Sea Market, which was declared likely gone for good on October 14 by one of its moderators. This time again, there was some activity on the official sub of the market, so let's unroll the information we have at the moment. Note that the time mentioned in this article will be in GMT unless specified otherwise.

The events began on October 12, with the market becoming irresponsive. At 09:26, Atlantic, DeepSee's Market Dread Manager posted on the forum, saying that he was aware of the situation. He reported speaking with the admin 10 hours earlier, and that the conversation was as normal as usual. The mod also noted that the admin was online on Jabber a "few hours ago", and continued by saying that the servers were under DDoS recently so that a tech issue likely occurred. Nothing to worry about, especially as he claims that the previous day withdrawals were processed as expected.

Deep See is Down - First Post

A couple of hours later, at 13:33, the moderator posted a new thread in the official Dread's sub: "Market and admin are still offline, yes I'm bit worried but very optimistic.". At this time, the mirror list was still online, but the market was down. The post doesn't offer a great deal of information, but Atlantic said that the admin only talked to him at certain hours (for OpSec reasons), so that he needed to wait a bit more before talking with him. Note that he said that it was normal for him not to speak with the admin at this time, but he was still a "bit worried".

Deep Sea Second Update - Worried but Optimistic

Note that there is an interesting set of comments. A user mentions that the admin usually processes the withdrawals every 4 hours, which should be roughly around the time when the comment is made (13:44). Atlantic says it's true, but that the admin doesn't use Jabber around this time (to avoid being distracted). One other user (a verified vendor) said that he received a withdrawal at around 5:00 the same day.

Comments about the withdrawals

The third update post came a couple of hours later, at 18:45. Atlantic says he saw the admin on Jabber at 6:30, and that he reportedly processed withdrawals earlier. According to his sources, someone hired DDoS attackers, which attacked the market during the night.

Third Update Message - No Big News

Again, we can note some vendor claiming that they received their withdrawals in the comments.

Vendor Comment - Posted the 12 October at 18:58
Vendor Comment - Posted the 12 October at 20:15

Twenty-one hours after the admin went dark, Atlantic posted a new update (the 13 October at 04:51). He said that he managed to speak with another moderator (which he didn't name), but the moderator had no clue of what was occurring either.

Fourth Update - Still Nothing New

Another user posted in the comments (at 08:50) that his withdrawal was processed at 6:21.

User Claims he Received Funds

Forty hours after the market and admin went offline, Atlantic posted a new update (the 13 October at 19:18), where he said he was starting to get stressed. In this post, he changed a bit the narrative he had at first. He went from something like "all was fine when I last spoke to the admin" to saying that he was logged into the market and that all the mirrors (including a private one) went offline when the admin disconnected from Jabber. He said he was able to speak to a senior mod (likely Melanocetus or Greyshark, respectively "Senior Mod" and "Head of Operations" on the Dread sub) that had no idea of what was going on either. At this point, Atlantic says he's positive that this is not an exit scam, as (among other things) the market spend a great deal of money in ad networks and server updates one week earlier.

Fifth Update - Becoming Stressed

In the comments, we learn that only the admin had servers access, so other staff can't put everything back online.

Mods have no access to the market's infrastructure

Two days after all went dark, comes the final blow, today, the 14 October at 07:25, Atlantic says the market is likely gone for good, but that he still believes in an exit scam, because it wouldn't make sense for the admin to invest 35k a few days before doing that.

Sixth Update - The Market is likely gone

If we consider the events, there are no contradictions as far as the timeline goes. Atlantic says that he spoke to the admin sometimes around the 12th at 00:00 and that he was online a couple of hours before the first update post on Dread, at 9:26.
According to the comments, some users received money around 6:00 and 7:00. The first post complaining about the market being done was posted on the sub at 07:50.

Of course, we saw with the Icarus exit scam that a mod's words couldn't be totally trusted, but if the admin indeed made big investments a couple of days before the exit, and if (as multiple sources in the comments say) the admin did  process vendors' withdrawals before shutting all down, then all doesn't make much sense.

I can think of a few possibilities on what happened, but of course there are many more:

  • Law Enforcement shut the servers down and/or arrested the admin. If the admin was online every day at the same time, it is possible that the police tried to catch him while he was logged on the market and servers.
  • The admin had an accident. But if we trust the information that the admins and the servers went online at the same time, it doesn't seem likely (unless he was self-hosting some services, and his house burned or something - doesn't seem super plausible)
  • The admin exit-scammed, but decided to be nice to a few people, or to make some withdrawals to make people think it was not an exit scam, and give him a few days to move funds with less scrutiny. It might also be some automatic processing running (Atlantic said all was manually processed, but without access to the servers he can't know for sure)
  • The admin went on vacations and made a mistake when shutting down his computer

Note that on one of the comments, Atlantic claims that the server is up, but not connecting to the market. This is not impossible, as the index page (sp4jpokprfuaznn6.onion) is still online at the time this article is written (although all the mirrors are indeed down). Interestingly, we can notice that they also have a mirror of this listing on the clear-net (dsmarket.support). The page has a canary, which was updated the 4th of this month, and is supposed to get an update again within 14 days.

The Server is Up

Looking at the Dead sub staff, we can observe that only Atlantic has been online since the service shut down. As for the other staff:

  • WhiteShark's (Admin) last post was on October 8, at 04:51
  • Greyshark's (Head of Operations) last post was on September 2, at 14:10
  • Melancocetus's (Senior Mod) last post was on September 20, at 13:07
  • SeaStarDS's (Junior Mod) last post was on October 7, at 16:46

This, however, doesn't mean much, as all of them (except WhiteShark) were not really active on Dread. For the admin, no recent posts would make sense, as some DDoS was pending around the time he last posted, so he was likely busy.

We might know more about what happened with time, but meanwhile, note that I did not see any comment of people saying their funds moved.

Author image

About Ixonae