Interception report
View Reddit discussion about darknet market↗Mars Market: what the search results do not tell you
Type a marketplace name into a search engine and you will not find the marketplace. You will find a page offering to hand it to you — often styled as a directory, with badges, an uptime figure quoted to one decimal place, and a copy button. That page is the first step of the fraud, and for most people it is the only step they ever see.
Before you click
We publish no marketplace links, no .onion addresses, no mirror lists and no rankings. If a page you found offers an address with a copy button, you are looking at the problem, not the solution.
This site is a warning, not a doorway. That distinction is the whole point of it.
Mechanism
The chain has five links, and you only ever see two of them
Interception sites are not improvisation. They follow a repeating commercial template, and the template works because the person arriving is already motivated, already impatient, and has no way to verify anything they are shown.
- Step 01 — Interception
The name you searched belongs to nobody on the open web: the marketplace does not advertise, the real brand has no clearnet presence, and the query is therefore unowned. Around it a ring of domains is registered to capture the traffic. The two competitor examples we were asked to review resolve to a single shared engine — different domain, identical page.
- Step 02 — Authority theatre
Badges are added: verified, PGP-signed, uptime 99.4%, response time 2.8s, last updated October 2026. None of it is measured by anyone. It is text on a page written by the party that wants your deposit.
- Step 03 — Handoff
You copy an address. Whether it resolves to the genuine service or a pixel-identical clone is not something you can determine from the outside. At that point the fraud has already succeeded structurally, whichever site you land on.
- Step 04 — Deposit
Small amounts clear. Confirmation is fast, fees look normal, the interface behaves. This is the trust-building payment and it is a cost of doing business for the operator, not a service to you.
- Step 05 — Extraction
Money leaves one of two ways. Either the operator takes the escrow and disappears — the exit scam — or the site you were sent to drains the wallet on deposit. The difference matters to investigators and not at all to the balance.
Figure 1
The page is built to look audited. Nothing on it can be audited.
Set out side by side, the elements stop reading as evidence and start reading as a sales layout. Every part of it is produced by the same party that wants the deposit, and most of it cannot be checked from outside at all.
Claim and reality
Three claims, and what each one actually proves
“PGP-verified address”
Proves that somebody signed something
A signature establishes that whoever held a private key wrote the message. It says nothing about whether that person operates a marketplace. If the key arrived on the same page as the address, you are verifying the page against itself.
“Uptime 99.4%”
Proves that a number was typed
No independent monitor publishes availability data for hidden services. The figure is self-reported by the site whose only business is sending you somewhere else. It is a design element, not a measurement.
“2-of-3 multi-signature escrow”
Proves nothing unless you hold a key
Multi-signature custody only constrains an operator if the second and third keys sit with parties who can refuse. Buyers on these platforms routinely deposit without controlling any key at all.
Recorded losses
Documented cases where the money did not come back
These are the cases that were large enough, or careless enough, to end up in court filings, seizure notices and analytics reporting. The unreported remainder is larger.
| Year | Case | Outcome for users | Documented scale |
|---|---|---|---|
| 2013 | Sheep Marketplace | Operators disappeared | ~40,000 BTC |
| 2015 | Evolution | Exit scam | ~$12 m |
| 2019 | Wall Street Market | Exit scam, then arrest | ~$11 m |
| 2020 | Empire Market | Exit scam | ~$30 m |
| 2024 | Incognito Market | Escrow drained, users blackmailed with their own order records | Not fully quantified |
| 2025 | Archetyp Market | Seized by law enforcement, 16 June | Servers and funds |
| 2025 | Abacus Market | Went dark in July, no seizure notice | Hot wallet emptied |
Sources listed at the foot of this page. Figures are as published by the cited organisations; several are estimates.
Context
The market is large, and almost all of it is one language
- $1.7 bn
Cryptocurrency received by darknet marketplaces in 2025, up roughly 20% on 2024.1
- Over 90%
Share of that volume that flowed through Russian-language marketplaces.1
- 288
People arrested across nine countries in Operation SpecTor, with €50.8 m in cash and virtual currency seized.4
- $21 bn
Total losses reported to the FBI's Internet Crime Complaint Center for 2025, with cryptocurrency complaints among the costliest.6
Read those four lines together and the risk profile of a first-time visitor becomes obvious. The overwhelming majority of the traffic and the money sits in a market where you have no standing, no recourse, no identity and no exit. Interception sites exist precisely because that market is large enough to make search traffic worth harvesting.
Sequence
Thirteen years of the same ending
Fifteen closures are documented well enough to date. Six of them were the operator leaving with the balance, six were law enforcement removing the site, and only three were enforcement operations aimed at vendors.
-
The first generation goes down and the pattern is set: the operator is arrested, or the operator leaves with the funds. Customers are a witness list, not a client base.
-
Simultaneous takedowns and, in at least one case, continued operation under law-enforcement control — an operation that produced evidence against thousands of users who believed the site was safe.
-
Servers and wallets are seized in Germany in coordination with US authorities. The largest single disruption in the ecosystem's history does not reduce demand.
-
A nine-country operation produces 288 arrests and the largest co-ordinated seizure of cash and crypto to date, drawn from a market that had already been infiltrated at the code level.
-
Within five weeks, one market is seized and another disappears without a seizure notice, taking its hot wallet with it. Both outcomes are routine now.
If it has already happened
You have less time than you think, and more options than you expect
Funds move on-chain in minutes, but the trail persists indefinitely and investigators routinely use it years later. The first 72 hours are the only window in which exchanges, banks and police can act on a live trail. What you do in that window — and the order in which you do it — materially changes the outcome.
What to do in the first 72 hours Twelve rules that reduce exposure