The Dark Web’s Top Drug Market, Evolution, Just Vanished | Hacker News Reader

The Dark Web’s Top Drug Market, Evolution, Just Vanished

wired.com

134 pointsnmc108 comments

Open articleView on HN

"You knew what I was when you picked me up," said the snake as it slithered away.

For those not getting the reference http://www.gballard.net/lifes_lessons/girl_rattlesnake/

Some of course prefer the Al Willson musical version

https://www.youtube.com/watch?v=T_ZBqpEUbik

Clasic Northern Soul

Or the Scorpion and the Frog [1]

[1] http://www.aesopfables.com/cgi/aesop1.cgi?4&TheScorpionandth...

I had only ever heard the scorpion version, never the snake. I MUCH prefer the scorpion version because it focuses on the scorpion and not the frog.

The scorpion dooms himself by his own nature, where as the girl is merely trusting and punished for it.

According to http://en.wikipedia.org/wiki/The_Frog_and_the_Mouse , you can find each moral in Aesop, with the frog and the mouse teaching that evil destroys itself and the farmer and the viper teaching that you're a fool to hope for anything but evil treatment from evil. Presumably, you'd target the first lesson at people you wanted to shape up, and the second one at the excessively giving.

On a different note, http://en.wikipedia.org/wiki/The_Scorpion_and_the_Frog is only listed in WP's "apocryphal" subcategory of Aesop's fables, dated to 1954. What's it doing on "www.aesopfables.com"?

In the version told in the Star Trek: Voyager episode Scorpion, the girl is a fox and the snake is a scorpion (hence the show's title)

http://www.imdb.com/title/tt0708968/quotes?item=qt0492714

While I understand the point of the fable, I don't get this version at all. Snakes don't rely on lures or deception; they sneak up on their small prey and try to keep out of the way of larger animals. I feel particularly well disposed towards rattlesnakes because they advertise that they don't want to be messed with. Rather like sharks, I feel like hey get a bad rap. Of course the author has rather obvious religious sensibilities, so perhaps that influences his perspective.

Don't be fooled; that story is many centuries old. Snakes are traditionally villainous because they can kill you; I doubt there was ever more to it.

Fun fact: monkeys have been observed to scream in fear on seeing a piece of rubber hose lying on the ground. There are good historical reasons for people to hate snakes.

One slight detail from that page, for those whose remembrance of history is a little faulty:

   Benjamin Franklin (6th US president, inventor, 1706-1790)

Perhaps in an alternate universe?

江山易改秉性难移

Google translate says: Leopard change its mettle difficult to move

To a Chinese speaker: Is this a botched translation or is the parent's comment nonsense?

I assumed it might be "A leopard doesn't change its spots" and searching that got me here:

http://dictionary.cambridge.org/dictionary/english-chinese-t...

(which matches the above characters)

Hard to see how that translation could have come about, since there is no reference to a leopard, or any animal, in the Chinese. The leopard can only be in there by reference to translations of the entire idiom as "a leopard can't change its spots", but then I'd expect google translate to just give you "a leopard can't change its spots".

The "mettle difficult to move" bit is a fairly direct translation of the last four characters. CC-CEDICT glosses this saying as "rivers and mountains are easy to change, man's character much harder", which again renders the characters fairly directly.

Not to add insult to injury, but these people posting on Reddit complaining about the money they have lost are opening themselves up to massive prison sentences. Reddit is a US site; all it takes to arrest everyone posting is to subpoena Reddit, get their IP's/emails/whatever, then raid their houses looking for drugs and whatever other contraband the police can find. Complaining publicly that you lost money on a site whose sole purpose was to sell illegal items is plenty of probable cause - especially with several implied death threats and people saying they may be killed over missing funds right in the thread. The feds will be all over this.

Not that they shouldn't complain somewhere, but maybe keep it on the darknet sites.

I'd presume they are posting to Reddit cia TOR, so I doubt subpoenaing Reddit would give much new information.

I thought about that, but you never know. There are other bits and pieces available...email, which might lead to a real IP via another subpoena if the person isn't careful, ad/tracking cookies, etc. I would guarantee you that some of these people aren't being that careful with their clearnet activities.

Would it be worth investing those kind of resources into tracking lower-tier sellers or buyers though?

Well....reading the thread, there are people claiming that drug gangs are going to kill people (both the owners of the site and people who are going to come up short paying their suppliers), at least one person seriously talking about suicide, and another saying that he has contact info for the owners. I can't say what resources they will put into it, but there are a ton of law enforcement red alerts and more than enough probable cause in that one thread to subpoena Reddit.

If you're the kind of person who is smart enough to use Tor properly, you're the kind of person who is unlikely to be complaining about money you lost in drug trades on a high-profile web site.

Even smart people make mistakes, especially after seeing other seemingly smart people making those mistakes.

Given that these are people who put significant amounts of money at risk in unregulated and outright illegal businesses; you may be making unwarranted assumptions about their intelligence and operational security.

Is it illegal to use these sites? Surely, they would have to explicitly say that they purchased/sold drugs (or something else illegal) for a subpoena and later search warrant to be legal.

Is it illegal to use them? No. Does talking about how much money you lost when a known illegal drug marketplace goes down give the police probable cause to believe that you may be dealing or buying drugs? Most likely, yes.

I'm not a lawyer, but that sounds a little dicey to me. I think for getting search warrants, you need probable cause to believe that somebody has a specific amount of a specific drug or other contraband, ideally in a specific place. Claiming on an anonymous website that you lost some amount of money on a site known for trafficking mostly contraband sounds more like a fishing expedition - you have no way to tell if they were lying entirely, or what they supposedly lost money on, or if it's actually illegal in their jurisdiction. You generally can't, or at least aren't supposed to be able to, get a warrant based on a hunch that somebody is doing something illegal.

This is perhaps cause to open an investigation on somebody, but I'd think they'd have to actually contact these people and complete a sale for something illegal to move forward with legal action. Which would probably not be worth the trouble for most agencies capable of doing that sort of thing, unless they had reason to believe that you were a pretty big fish.

I don't understand why vendors would keep a lot of bitcoins on the site, instead of withdrawing them as quickly as possible.

This guy apparently had 300BTC/$85k on there! http://np.reddit.com/r/DarkNetMarkets/comments/2zeuxo/compla...

Escrow, funds are only released once the buyer confirms that he received the shipment. If you have a ton of outstanding orders, you are going to have a lot of funds frozen in escrow.

I thought the whole point of bitcoin was that it was peer-to-peer with no chargebacks or centralized middlemen?

A side benefit, but I wouldn't say the whole point. There are some cases where middlemen are necessary - the difference being that they're a lot more avoidable with BTC than they are in meatspace. (Credit cards, authorities who rob people carrying large amounts of cash, and so on.)

I'm not positive that bitcoins offer much more protection from robbery than cash, given the situation here.

They offered protection, though didn't they? Evolution had multiescrow, they wouldn't have gotten those funds would they have?

I'd much rather have someone charge up fraudulent charges on my credit card than Bitcoin, I would much more likely be getting that money back and letting the CC fraud department deal with it. That guarantee is a major selling point of why so many people use credit cards in the first place.

The bitcoin model alone doesn't fit buying drugs online. The purpose of escrow is a mutually agreeable middleman to facilitate a transaction, especially when parties that do not trust each-other can not exchange goods and payment in person.

I still don't understand how this helps though - couldn't the person still get their shipment and claim they never received it in order to trick the middleman to return their funds?

How does the middleman have any ability to investigate or know who to believe?

In one model of escrow, the middleman receives both the goods and cash before distributing them to the other parties. Potentially doing some inspection of goods at the time too.

In another model, more common on the internet, the middleman holds the money from the buyer while the seller ships the goods to the seller. They can't guarantee the buyer does not lie to the middleman, but it changes the incentive structure around fraud. Especially so when the middleman runs or has connections to the marketplace.

Bitcoin allows transactions that only become valid once 2 of 3 people sign them. If the three people are buyer, seller, and arbitrator, you can have escrow without trusting a third party. There have already been commercial services along those lines.

Seems to me that any dark service that doesn't do it that way probably shouldn't be trusted.

>arbitrator

Is the arbitrator not a third party?

Not one that you need to trust.

You need to trust either the buyer or the arbitrator actually. In this case some money might have been lost due to malicious buyers (and the absent arbitrator).

You have to trust the arbitrator to make fair decisions, but the arbitrator has no ability to steal the money.

The transaction simply moves funds between buyer and seller. If buyer and seller both sign the transaction, it completes without the arbitrator's involvement. If buyer and seller dispute, then the one who hopes to complete the transaction signs it and contacts the arbitrator, who will either sign, or not sign, but either way never gets possession of the funds.

If both the buyer and the arbitrator are anonymous, how do you know that they aren't the same person?

They're actually pseudonymous, so they can have reputations. If the other party insists on an arbitrator you've never heard of, you probably shouldn't agree to those terms.

The arbitrator will usually be known by reputation, i.e. always the same key id.

The article mentions that Evolution provides such a service, but it didn't get heavily used. Quoting from the article

>That system, would require at least two out of three parties in a transaction—the buyer, the seller, and Evolution’s administrators—to sign off on a deal. But due to its complexity, buyers rarely used the feature.

Edit: apparently this does not use bitcoins version of it, but their own that requires them to hold the funds in escrow. Which seems pretty stupid.

Once again user experience trumps security

Apparently Evo admins stopped processing withdrawals a week ago. Vendors wouldn't be able to transfer money to a local wallet even if they wanted to. Disabling autowithdrawals should have been a sign of impending doom.

That said, some people probably just leave money in their accounts anyway due to convenience/laziness.

> * Vendors wouldn't be able to transfer money to a local wallet even if they wanted to.*

So this guy made $85k in a week? Or do we suspect that he was one of the lazy ones?

maybe not 85k a week, but it wouldn't be unreasonable to amass close to that amount of money in the span of 2-3 weeks

"NSWGreat described confronting Evolution’s two pseudonymous owners, Verto and Kimble, who he or she says then admitted they were closing the market and stealing its funds. “I am so sorry, but Verto and Kimble have f–ked us all."

With no chat logs, all we go by is this guy's word? What are the odds he was in on the heist?

Also, this reminds me of when Max Butler did a brute force take over of all the carders markets and then created his own "super carders forum" by hacking in and then wiping their databases and then repointing their domains to his. While this is probably not in the realm of possibilities, if this site does come back, people had better be very, very weary of who's actually running it.

Lessons learned and all that jazz I suppose.

> With no chat logs, all we go by is this guy's word?

You mean, besides the market & forum being down since 8PM yesterday, withdrawals failing since at least Saturday, no communication from the operators, at least one other employee saying it's an exit scam, and blockchain movements of large amounts of funds?

> What are the odds he was in on the heist?

We can't rule out a scenario like NSWGreat expected to receive a cut, but it's clear that when he went public, he helped some people save money by not continuing to deposit funds.

Also if people buy it, this guy has free reign to pick any two people on the planet that he doesn't like and effectively end their lives.

There are people on reddit raising funds to doxx the people who ran Evolution.

Jesus... a whole lot of shadowbans are going to happen once the admins wake up. Maybe even some subreddit bans.

I also read today there is a bitcoin wallet floating out there with something like 400K bitcoins in it that people think might be the stolen Evolution funds.

Nothing's going to happen. This happens every time a big market like Sheep goes down - a lot of people who knew better start talking big online and huffing and puffing and bluffing, along with the occasional scam 'send me BTC and I'll track down the admins!'

One Evolution (ex-)staff member claims that 130,000 BTC (~$35 million) were stolen:

http://www.deepdotweb.com/2015/03/18/interview-with-nswgreat...

Aaaand its gone... and I bet with gazillions of the user's bitcoins (this is becoming a classic)

Although it takes a certain amount of guts to steal from drug dealers. They don't generally bother with suing you in court to recover their funds :-)

If "drug dealers" can find you, then so can LE. If LE can find you, you're cooked already and shouldn't be playing.

Yes, definitely it takes a big pair... I reckon the admins of these sites must be the same kind of people that don't really care stealing from anybody, even big banks.

What I don't understand is why after so many thefts the users (sellers and buyers) still trust this kind of underground services without demanding additional security measures like multi-signature wallets.

So why haven't markets that utilize Bitcoin escrow transactions taken off yet?

"The site gained users’ trust by offering a feature known as “multi-signature transactions,” designed to prevent exactly the sort of bitcoin theft its administrators are now accused of."

Seems like the site's differentiating feature was multiparty escrow transactions but weren't used often due to hassle?

Pretty much, yeah. It was available but not very many people used it.

Evolution did use escrow, except that they were the middle man between buyer and seller. Even with escrow you still have to put your trust in someone else.

Even with escrow you still have to put your trust in someone else.

Not with Bitcoin. With multi-sig transactions you don't have to trust the escrow agent to not steal your money (assuming you're confident the escrow agent is not also the other party in the transaction): https://en.bitcoin.it/wiki/Contracts#Example_2:_Escrow_and_d...

As dshankar pointed out, Evolution supported these types of transactions but they were not widely used, presumably because they are more difficult than normal transactions.

They had some scheme where you had to give them all your coins first then they used their own software to gen multi-sig http://www.reddit.com/r/DarkNetMarkets/comments/24vio2/z/chc...

Probably because no bitcoin clients that aren't 3rd party (blockchain.info wallets) offer multi sig in an easy to use UI so nobody could figure it out and just trusted the admins of Evo.

You still need to find a trustworthy 3rd party "mediator" or escrow agent, whom still holds the ability to collude with either seller or buyer for a share of the funds withheld.

That is a good question. The Marketplace/TMP introduced full multisig support, but while admired for this, the users never materialized. For a while now, the trend has been against multisig, if anything; it seems that for all the moaning about exit scams, using multisig in Electrum is just too darn inconvenient compared to a centralized escrow market.

>While other sites followed the original Silk Road’s ethos of selling only victimless contraband

While human sacrifices may not be a literal ingredient of drugs, calling it victimless ignores a whole lot of problems caused by drugs. Buying pot from your friend who grows it is victimless. But fueling any black market, even one that avoids identity theft, means you are supporting the marketplace that provides service to drug traffickers of the sort that kill people or that delivers highly addictive drugs that ruin far more than just their user's own life. Yes, bad government laws have made these problems much worse and are preventing truly safe victimless market places that uses locally grown and produced drugs sold in moderation, but the black market is not victimless.

The drug cartels brutally murder thousands and commit many other crimes -- they are as brutal as ISIS in many ways -- they undermine and oppress entire countries and ruin large parts of American cities. Many organizations such as the Taliban and Hezbollah fund themselves via the drug trade.

Some people boycott companies over political issues; how many of them still buy drugs? Every user I know, to whom I've mentioned this issue, insists their drugs come from a friend who produces it at home. But somehow the drug cartels earn billions and have worldwide distribution networks.

Prohibition laws created the drug cartels. You don't see distillers killing each others in turf wars, quite simply because it would be highly destructive to their possibility of operating on the right side of the law.

To end the "wars" regarding drugs, you must end the war on drugs. Legalize everything. It won't eliminate drug abuse, just like legalizing alcohol didn't eradicate alcohol abuse, but it removes all the compounding effects caused by the substances being illegal by themselves.

Besides, legalizing is, from a moral perspective, the only right way to act.

Agreed. And then deal with it the same way you do with tobacco and alcohol, with social campaigns to raise awareness of the issues of addiction. We have a working model here for legal drugs that are just as bad or worse.

Working model? LOL.

I have never heard someone claim their heroin and cocaine were "homegrown".

I believe the equivalent for these would be sourced from non-cartel family farms. Fair trade drugs if you will. You can't really grow these in a 'home' because it takes lots of land.

This is another argument in support of legalisation. The 'war on drugs' is lost, and can never be won. Far better drugs are legalised, can be produced safely and with known purities. Governments can tax their sale (as per alcohol), and direct some funds into treatment programs for addiction.

See also: the diamond trade…

Applying your logic, purchasing anything from US, Saudia Arabia or Russian companies is "supporting the marketplace that provides service to" government officials and politicians "of the sort that kill", abuse and torture people.

Do you agree?

If you cast your logic-net wide enough, you can make all sorts of connections & correlations. Anything and everything indirectly funds anything and everything else.

You can't decide to shutdown all USA companies; or if you did you'd cause a lot more problems than you'd solve. But you can shutdown a website selling illegal drugs. And that would arguably solve more problems than it would cause.... arguably, maybe. I could cast the logic net even wider. The whole earth would be better off without humans probably. Do we want to have that debate? No. Humans, for better or worse, are here. The USA and its companies/corps are here and exist. That's gonna be a thing for the foreseeable future. A drug website is more reasonable to talk about if it should exist or not.

It is not reasonable to talk about the existence of black markets. They existed, they exist, they will exist. I am nearly sure that as an economic and social constructs digital black markets will outlive companies/corporations.

Also your reductio ad absurdum about humans is well, absurd.

And the scope of "purchasing anything from US, Saudia Arabia or Russian companies" ...is reasonable?

Indeed, a quite reasonable response to demonstrate the futility of the "drug users are financing cartels" argument.

Yes. Depending upon which candy bar I buy, I am indirectly supporting child slavery. Sadly almost nothing in our modern day society is victimless even though most pretend (or believe) otherwise.

We're talking victimless, not harmless. With drugs, there is no victim, because the person making the purchase is making a conscious choice to buy something to put into their body. They are well aware of the effects and risks.

Contrarily, identity theft is clearly not victimless. A person's credit card or social security number is taken from them without their knowledge or consent so that it can be sold.

To go on an anti-drug tirade here when your pedantry isn't even correct does no one any good. All you're doing is parroting and reinforcing negative drug stereotypes. You wouldn't be doing so if those sentiments weren't pushed on you since before you could even comprehend them.

Using drugs is victimless, but given that a lot of drug manufacture and cultivation is directly linked to organized crime, buying drugs is only victimless if you know for a fact that your drugs are ethically grown, fair trade, etc. Which you don't.

By that logic, there's a good chance you're a perpetrator of slavery due to the labor that put your computer and/or its constituent parts together...

For me, it's hard to avoid the conclusion that both you and the parent are right.

But it's easier to pretend that they are both wrong.

I would agree that buying a computer who uses conflict minerals is not a victimless act. I find that a lot of what we do in modern society is not victimless even though we like to pretend it is.

>They are well aware of the effects and risks.

First, many are not aware.

Second, there are other parties who are hurt directly or indirectly by the drug use (granted, this only applies to some drugs).

Third, there are victims in getting the drugs to the person (once again, not in all cases, but with the black market, you can't be sure which case you fall under).

Finally, much like with alcohol, just because I do not consider it victimless does not mean I am against it being legalized. In fact I think that legalization would greatly reduce the number of victims.

I think a better argument is that the SR guys were not above selling things like malware and (via The Armory) RPG launchers. The whole "victimless crimes" trope was pretty thin even at the start.

Recent HN posts of related Reddit comments:

https://news.ycombinator.com/item?id=9224517

https://news.ycombinator.com/item?id=9225154

Brokering narcotics and everything else to the entire world is an unsustainable business you have no safe country to flee to if caught or outed. Surprised these black markets don't just focus on one foreign market from their stronghold in Abkhazia or something.

Judging by the DPR trial these guys are not generally criminal masterminds.

setting up with iranian hosting might be a plausible way to go about it

And a great way to get yourself some terrorism related charges when you inevitably fuck up and leak identifying information.

Perhaps I don't understand Bitcoin well enough, but wouldn't these guys out themselves the instant they try and spend them because of the public transaction history?

There are tumbler services, no idea how well they work or how many are compromised but in theory it seems like it could work.

I'm surprised we haven't seen more theft and fraud with the tumblers. I used one out of curiosity about two years ago and the experience was basically to fill out a super shady looking webform, send the coins to the address it gives you, and then pray like hell that they come back out the other end.

It kind of ironic, but dark markets are in a great position to offer a coin re-tainting service.

It isn't quite the same thing as a tumbler, but they have busy addresses and lots of volume to obscure things with.

The CoinJoin proposal[0] by Greg Maxwell provides transaction-history-tracing erasure capabilities. JoinMarket[1] is a market driven approach to incent CoinJoin mixing

[0]https://bitcointalk.org/index.php?topic=279249.0 [1]https://bitcointalk.org/index.php?topic=919116.0

They only work for small volumes.

It depends on how bitcoin flowed through their system. If funds flowed through a small number of addresses, the stolen bitcoin could have ended up in dozens of addresses that are difficult to distinguish from the seller addresses (short of enumerating the great majority of addresses used by sellers).

It could also already be in cash.

The original article on wired magazine now returns 404, but we're starting a discussion about this on http://www.peerlyst.com/discussions/the-dark-webs-top-drug-m...

Peerlyst is a community of 17K+ security professionals, discussing 25 areas of security (content security, cryptography, identity management, privacy etc). Once joining, you get a feed relevant to your areas of interest.

http://www.reddit.com/r/sorryforyourloss

well looks like these thiefs selling their bitcoins will push down the prices....almost 40 million dollars they've stolen, how the fuck do they expect to cash out without getting caught?

Have any of the dozens upon dozens of mass-bitcoin thieves been caught?

I've never heard of it. Sounds like it's actually really easy to get away with it.

In small quantities.

Probably they're already doing it. I was wondering why the plunge in price during the last 24h, and then I found this thread. We were in our slow-but-steady way to recovery and bam! now back to downtrend. Always the same history. Shit happens...

Reply on news.ycombinator.com