Tor darknet closes, thieves make off with millions in Bitcoin

News by Doug Drinkwater

Evolution, a drugs and criminal market hosted on the Tor anonymity network, has been closed, with its owners suspected of stealing up to £10 million worth of Bitcoins as part of an exit strategy.

Evolution was founded on January 14 and quickly became a haven for drug lords, gangs, criminals and hackers-for-hire in the wake of the Silk Road shutdown in 2013, and the Silk Road 2.0 takedown last year.

However, it emerged on Tuesday that the site has been closed down with many speculating that the two administrators – bearing the monikers ‘Kimble' and ‘Verto' - have upped and left, stealing around £8 million to £10 million worth of Bitcoins in the process.

“I hate to be the bearer of bad news, but I've been for suspicious the past few days with withdrawals not working and admins usually are more forthcoming in explaining to me why they're slow but they weren't this time. Just kept giving me time-frames,” said NSWGreat, who claims to be moderator of the site, in a Reddit post.

Security expert Brian Krebs added that the administrators had “direct access to a tempting amount of virtually untraceable currency", noting that various people who bought and sold on the site had taken to Reddit to claim that admins had absconded with their money. Some on forums have, however, also claimed that these Bitcoins may have been hacked and stolen by a third-party source, although experts agree that this is unlikely.

“One of the two big marketplaces on the Darknet known as Evolution has suddenly dropped off the face of the Darknet,” Ben Ali, investigator at darknet intelligence provider Centient, told “Unlike Operation Onymous that took place a few months ago there is no indication that law enforcement took down the newer black market. Instead it has just vanished.”

Ali notes that members of the marketplace had been complaining about halted withdrawals in the days leading up to the closure, and said that the admin's complaint of a ‘technical difficulty' hinted at a possible exit strategy.

“That admin of this site blamed this on a technical difficulty. This is one sign we have seen previously before that signals this site could be preparing for an exit.  This site was known to be one of the stable marketplaces with very little downtime, which would suggest that this was planned."

“As well as this one of the Bitcoin wallets, investigators here believed to belong to Evolution has also been drained of its contents which would suggest that this is indeed an exit scam by the owners of this website.”

Ali, who detailed how Evolution and Agora had risen in popularity in the months that followed Operation Onymous, said that most on the marketplace will likely move on elsewhere. “With this marketplace now gone, members of this website will most likely move to another marketplace, which will most likely be Agora as this marketplace is the second biggest marketplace after Evolution.  As well as moving we could also see a new marketplace being formed to fill the void of Evolution.”

Dr Gareth Owen, senior lecturer for the school of computing for the University of Portsmouth, told SC that Bitcoin is not the most secure currency, especially in underground markets run by dubious characters.

“"There's little honour amongst thieves is the saying.  If you trade on an anonymous bitcoin market engaging in illegal activity then I would suggest the operators don't have the security of your money as their principal interest.”

“Bitcoin has a troubled history with lots of people losing their money to exchanges and less than honest sites.  Despite popular belief Bitcoin is not anonymous and is an easy route to deanonymise users or operators of hidden sites.”

Crime & Threats

Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews