2 Sentences and an Exit Scam: It's Been a Big Week on the Dark Web

The dark web's largest illegal marketplace went offline last Monday. It was the start of a bad week for cybercriminals.
Gavin Butler
Melbourne, AU
yellow brick market
Yellow Brick Market disappeared from the darknet just days after DarkMarket

A lot’s happened in the world of the dark web over the past 10 days.

Last Monday, authorities shut down DarkMarket, a website that was described as "probably the largest illegal marketplace on the Darknet", following the arrest of its primary operator in Germany. By the time the website was taken down and its server was turned off, it had accumulated nearly half a million users and more than 2,400 vendors who collectively exchanged some $170 million USD worth of Bitcoin and Monero cryptocurrencies.


It was a big win for prosecutors of transnational cybercrime and a big loss for denizens of the darknet. But it was also just the first in a series of noteworthy events.

Three days later, without warning, another, mid-seized illegal marketplace named Yellow Brick Market (YBM) disappeared from the dark web—along with all of its users' cryptocurrency. YBM regulated transactions via a financial arrangement known as “escrow”, where the marketplace holds the money until the buyer receives their product and then releases the funds into the vendor’s account. When YBM disappeared, those funds went with it.

It’s as yet unclear whether the market administrators intentionally ran off with users’ money, or whether law enforcement arrested those in charge. While market seizures often come with a public announcement from authorities, it’s not unheard of for marketplaces to vanish without a trace—and as Darknetlive points out, YBM has a history of dropping off the grid.

Moreover, anonymous darkweb journalist @dark.fail revealed on Twitter that there are murmurings suggesting a worker at DarkMarket also worked at YBM. It’s possible—though hard to confirm—that the two disappearances, within a few days of each other, were related.

A day after YBM vanished, the owner of a Bulgaria-based cryptocurrency exchange was sentenced to 121 months in prison. Rossen G. Iossifov, 53, owned and managed RG Coins: a platform used by fraudsters and online criminals and allegedly designed for the purpose of money laundering.


The court heard that “Iossifov and his co-conspirators participated in a criminal conspiracy that engaged in a large-scale scheme of online auction fraud that victimized at least 900 Americans.” Money swindled from defrauded victims was converted to cryptocurrency—the dominant currency of the darkweb—and transferred to online money launderers like Iossifov.

Over the course of three years, the Bulgarian was found to have laundered five million dollars through RG Coins.

Then, on Monday, exactly a week after the closure of DarkMarket, a father and son in the Netherlands were each sentenced to three-and-a-half years in prison for selling drugs on the darkweb. The duo were found to have sold and exported large quantities of MDMA, 2C-B and cocaine through illegal online marketplaces—the father packaging and mailing the drugs while the son controlled vendor accounts.

Investigators raided the father’s homes in the small Dutch towns of Appeltern and Beuningen last August, seizing 6,795 grams of MDMA, 32 grams of cocaine, 39 grams of amphetamine, 36 LSD tabs, and 351 grams of 2C-B from the former, as well as 50 tabs of LSD and 1.9 grams of MDMA from the latter. 

Both the father and the son were sentenced to 42 months, minus the time served during pretrial detention.

Follow Gavin on Twitter