An exit scam is the deliberate shutdown of a darknet marketplace by its administrators after accumulating user funds in escrow — taking the money and disappearing. It is one of the most significant financial risks for darknet market participants and has affected platforms of all sizes, from small niche markets to some of the largest operations in the ecosystem. Understanding how exit scams work and how to identify the warning signs is essential risk management knowledge.
How Exit Scams Work
Darknet markets that use custodial escrow hold buyer funds on behalf of pending transactions. At any given moment, a market may hold substantial cryptocurrency in its hot wallets — funds belonging to thousands of buyers awaiting order completion. An exit scam occurs when market administrators drain these wallets and cease operations.
The mechanics vary. Some exit scams happen suddenly: the market goes offline and the wallets are emptied within hours. Others are more gradual: administrators slowly increase withdrawal friction, prolong dispute resolution, and introduce technical "issues" that delay fund releases while simultaneously extracting funds. The gradual approach allows larger accumulation before the final exit.
Historical Examples
Empire Market (2020)
Empire Market was one of the largest darknet markets operating in 2020, with an estimated 1.3 million listings and hundreds of thousands of users. In August 2020, the market went offline following what appeared to be a sustained DDoS attack. However, it never came back online, and the administrators were suspected of executing an exit scam. Estimated losses to users were reported to exceed $30 million in cryptocurrency.
Other Notable Examples
Wall Street Market (2019) executed a documented exit scam in which administrators gradually gave themselves elevated permissions, drained vendor accounts, and then attempted to extort vendors with their personal information before disappearing. The German authorities subsequently arrested suspects identified through investigative work unrelated to the scam itself.
Warning Signs of Impending Exit Scam
- Unusual DDoS "attacks": Platforms claiming continuous DDoS issues as cover for extended downtime while withdrawing funds.
- Withdrawal delays: Sudden implementation of new withdrawal procedures, extended processing times, or new verification requirements.
- Admin communication blackout: Support staff and admins becoming unreachable or providing only vague responses to inquiries.
- Increased finalize-early pressure: Market policies being changed to encourage or require FE transactions, maximizing fund exposure.
- No escrow verification: Markets that cannot demonstrate provably solvent escrow or that resist independent fund verification.
- Unusual rule changes: Sudden changes to vendor bond policy, escrow rules, or fee structures shortly before downtime.
How to Minimize Exposure
The most effective protection is limiting the funds you hold on any platform at any time. Deposit only what is needed for imminent transactions. Do not maintain a standing wallet balance on market accounts. Always use escrow for all transactions — never finalize early with unknown vendors. Diversifying across multiple platforms (if any platform activity is contemplated) reduces single-platform exposure.
Custodial escrow carries platform-level risk. Market administrators control the escrow wallets. No regulatory framework protects users from exit scams. Minimize funds held on any platform to limit potential losses.