Ecosystem · exit scams

Darknet Exit Scams: Incognito, Abacus, and the Pattern

The exit scam is the cryptomarket economy's endogenous failure mode: the party holding everyone's money is the party that vanishes with it. The documented cases around the black ops market's operating window make the mechanics — and the warning signs — unusually legible.

Sources: DOJ announcements (May 2024) · Chainalysis 2026 report and BleepingComputer (Abacus, Jul 2025) · NDARC bulletins (Elysium, MGM Grand, Ares) · Searchlight Cyber guide (Incognito)

The mechanism, in one paragraph

A custodial escrow market holds buyer deposits until orders finalise. At any moment the administrator controls a pot worth every open order plus every idle balance. Exiting means freezing withdrawals, silently — then draining the pot while the frontend performs normalcy, or simply disappearing. Monero-only policies remove the blockchain trail for most of the drain; they do not remove the motive, which is structural: the pot is one decision away from being revenue.

Case file: Incognito Market — March 2024, exit with blackmail

Incognito's exit is the documented worst case because it monetised the victims twice. Searchlight Cyber's guide reconstructs the week: withdrawal failures reported from 6 March; on 10 March a site message promised one "final little nasty surprise" — the administrators' threat to publish vendors' real identifying data unless they paid to keep operating under new management. The market had also retained data enabling that blackmail. In May 2024 the US Department of Justice announced the arrest of an administrator known as pharoah — identified as Rui-Siang Lin — which makes Incognito the rare exit scam that converted into a prosecution. Two lessons sit in this file: exit risk and blackmail risk are the same custody problem, and pseudonymous administration did not prevent arrest.

Case file: Abacus Market — July 2025, the wave-maker

Abacus — per Chainalysis, the largest Bitcoin-based DNM for western customers — degraded through June 2025 access problems into a July exit. On-chain tracing recorded more than $200,000 moved out of its hot wallet as the exit unfolded (portal copy about a "94% deposit collapse" is unverified colour). Its significance exceeds its pot: Chainalysis documents the migration it triggered, with TorZon emerging as the dominant western-facing market and the inter-DNM supply network re-routing around the hole. Every growth story in the 2026 research data — including the black ops market's top-five finish — is downstream of this exit. Full reconstruction: the 2025 wave.

The NDARC closure column

Research bulletins provide the least sensationalised exit record available, because closures simply stop producing listings. In the June 2025–May 2026 monitoring window: MGM Grand closed voluntarily; Elysium exit-scammed; Ares closed for reasons the researchers could not determine; and two monitored sites were dropped entirely after the community reported them as scam markets — born bad, ejected by the ecosystem's only quality-control mechanism. Three closures and two ejections out of nineteen markets in twelve months is the base rate every participant in this economy faces, including everyone who deposits on the black ops darknet market.

Warning signs the record supports

• Withdrawal friction precedes the exit. Incognito: withdrawal failures four days before the blackmail note. Abacus: a month of access problems. "Technical difficulties" affecting money movement and nothing else is the single most repeated tell.
• Forced finalisations. Auto-releasing escrow early converts buyer protection into vendor payouts the administrators can tax or sweep.
• Data-retention surprises. Incognito could blackmail vendors because it had kept what it claimed not to keep. No user can audit this from outside; it is why the custody itself, not the UI, is the risk.
• Boom-time entrants. NDARC's window saw seven new markets open. New supply in a booming field includes both genuine shops and short-fuse scams — the two ejected sites were operating during the same months the black ops market was climbing.

The walletless counter-design

Darkmatter's documented "walletless" architecture — no custodial balances, payments routed toward vendors without a market-held pot — is the ecosystem's one structural answer to exit risk: you cannot steal a pot you never hold. The cohort comparison places the black ops market on the other side of that design line, which is a fact about risk, not morality: its Monero-only policy obscures the pot's movements; it does not remove the pot.