Source
r/DarkNetMarkets•
UDNM

Question about market hacks and exit scams

NSFW

If a market (or tumbler etc.) was hacked and they tried to cover it up or was starting an exit scam would it be possible to find out by looking at the blockchain?

Looking back at Evo's exit scam was there any suspicious transactions that could have tipped us off that they were about to scam? Would it be possible to look for similar patterns in the blockchain for current markets and predict exit scams in the future?

I read this in a post by u/J0NJ0NES

Recently Agora had significant downtime. The ability to withdraw coins was suspended. They claim they were under a DDOS attack. After dealing with the problem, they came back online and both users and vendors were eventually able to withdraw coins. We can assume that they are better off now because they've learned something from this experience, and are better able to deal with DDOS attacks. The end result is that they continue to occupy the "Superlist", and not the "Wall of Shame". Their business survives, and we keep a great market as a resource.

So what's the problem you ask? If Agora, by seeing what happened to Bitcoin Blender, realized that they couldn't be honest about what really happened to them, like say a security breach that cause coins to be stolen, because they would be effectively blacklisted and their business killed, they would make the wise yet dishonest choice of claiming all their problems were due to a DDOS attack. I'm not saying that's what happened, but if Agora was breached I can guarantee you that is the story they would spin, and I wouldn't blame them for obvious reasons.

If the recent problems with Agora were due to a hack would it be possible to determine with some blockchain analysis?

Posted May 18, 2015, 1:47 PM UTC

06
hacksforcrack•

It is unlikely but it depends on the way they decide to spread their coins across addresses.

1
UDNMOP•

How unlikely? I only have a very basic understanding of it, I was thinking if a market had been hacked and were trying to cover it up and pay back the BTC they lost would it be possible to see on the blockchain? With all the markets down atm I think it's quite likely that someone is attempting to find weak spots and hack them.

I know that market wallets are easily identifiable on the blockchain because they use automatic tumblers that always follow the same pattern. If all of a sudden that pattern changed could that indicate a hack or exit scam, or would a hack or exit scam be identifiable in that way?

1
pickpocketit•

The act of trying to recover the btc and searching for it leaves them exposed, more then initially, making it possible, yet unlikely

1
[deleted]•

Without admin control of the server, you aren't going to know all the wallets associated with Agora. You can search your address and follow your commision to a hefty wallet, but you wont find anything suspicious about that.

The only time you are going to start seeing transactions that point to an exit scam will be after everyone is already sure it is happening. Withdrawals will stop, as they have before, and at that point, its pointless to search the blockchain because you aren't going to get your money back if it is happening anyways.

With all this said, I don't think Agora is trying to hide anything from us as much as I think they are being extremely cautious. They could care less about if their site is more down than up. That could very well be the difference between freedom and jail time. Its an absolute internet empire at this point. The less information they give to the public, the better. Security always surpasses the customer with markets with inelastic illegal products.

1
UDNMOP•

I'm so much concerned about Agora specifically. I think the attacks happening atm could be trying to find weak spots in markets and hack them, it could be someone casting a wide net to find an easy target.

Without admin control of the server, you aren't going to know all the wallets associated with Agora. You can search your address and follow your commision to a hefty wallet, but you wont find anything suspicious about that.

AFAIK it's not very hard to find all of the wallets associated with a DNM:

https://www.reddit.com/r/DarkNetMarkets/comments/2ocdk1/tumbling/cmm1a8a

1
[deleted]•

You could trace funds going into DNM's huge wallet, and find all the wallets associated with it, but it wouldn't really do you any good in detecting an exit scam. The very first thing that will happen is all withdrawals will stop.

You dont need blockchain to discover this, Im sure this sub will have their pithforks out in no time. All of the exit scams I know of happened with deposits ceasing, and then wallets being emptied, and then being tumbled.

Any markets first visible move in an exit scam will ensure the user can do nothing to stop it, whether they simply and literally remove the withdrawal button on the site or shut it down entirely. Finding all the wallets is possible, you're right, but there isnt a big list of them afaik, and they wont shed light on anything we wont already know as far as an exit scam.

If the site was hacked or if a vulnerability was exploited, the hacker wont walk away with all of said DNM's coin because their fortune isn't in an online wallet. And the amount of online wallets that have the potential to be "hacked" would make it very hard to find or trace.

This is how I understand it, at least.

1