Darknet market exit scam warning signs, and how each 2024–2026 closure ended
DarkMatter stopped paying withdrawals in late September 2026 while it kept taking deposits, and Nexus vanished on 8 October with its multisig escrow still running: the two darknet market exit scams of this autumn. In an exit scam, the market's own operators shut it down and keep the coins users had on it, meaning account balances, coins in escrow and the deposits taken in its last days. A seizure, where police take the servers, and a planned closure, where users get time to withdraw, end a market differently and cost its users different things. DarkMatter's warning was the classic one and could have been caught; Nexus showed that multisig does not take the risk away.
Exit scam, seizure or closure: what each ending costs
| Exit scam | Seizure | Planned closure | |
|---|---|---|---|
| Who ends it | The market's own operators, without warning | Police, usually after months or years of investigation | The operators, with notice |
| Coins on the market | Taken: balances, open escrow, the last deposits | Seized as evidence, then forfeited | Paid out to users who withdraw before the deadline |
| User records | Stay with the people who just robbed you | Become evidence and lead to further arrests | Stay with the operators |
| The address afterwards | Dark, or a "maintenance" page still taking deposits | A police seizure banner | Dark |
| Recent case | DarkMatter and Nexus, 2026 | Archetyp, 2025; Nemesis, 2024 | White House Market, 2021 |
The endings can stack. Incognito Market shut down in March 2024 as an exit, and its operator then demanded payment from users to keep their messages and order records private. Incognito's owner pleaded guilty in New York in December 2024. An exit does not protect the people who run it, and it does nothing for the users whose records they kept.
The markets that closed from 2024 to November 2026
| Market | Ended | Type of ending | Where the losses fell |
|---|---|---|---|
| Nemesis | March 2024 | Seized by German police with US support | Everyone in its database: the seized servers fed arrests a year later |
| Incognito | March 2024 | Exit, then extortion | Balances, then users whose records were held over them |
| Archetyp | 11–13 June 2025 | Seized; administrator arrested in Spain | Coins on the market, and the moderator and top vendors arrested alongside him |
| Abacus | July 2025 | Went dark while withdrawals were failing | Balances users had been trying to pull out |
| DarkMatter | Late September 2026 | Exit | Balances, plus every deposit made after withdrawals had stopped |
| Nexus | 8 October 2026 | Exit with multisig escrow running | Coins that sat outside the multisig protection, explained below |
| Prime | October 2026 | Offline, cause unknown | Not known; no cause has been stated |
Prime is the case to be careful with. An unexplained outage can be an exit, a seizure not yet announced, or a technical failure, and the honest label is "unknown" until a seizure banner, a signed staff message or several weeks of silence settles it. What a user does in the meantime is the same either way: stop sending coins, and treat any "Prime is back" link as phishing until it comes in a message signed by Prime's old key. Which markets are still answering this month is on our darknet market list.
Exit scam warning signs, in the order they usually come
Exits are rarely sudden from the inside. In the ones we have followed, the signs arrive in roughly three stages, and the useful thing is to recognise the first stage, because by the third your coins are already gone.
- Weeks before
- Support replies slow down. Staff posts on Dread get rarer and stop carrying a signature. "Temporary" withdrawal limits or new withdrawal fees appear. The market courts deposits with bonuses, fee cuts or raised limits. A rival has just closed and new users are pouring in, which swells the pot an exit would take.
- Days before
- Deposits clear at once while withdrawals sit in "processing". That gap is the single clearest sign there is, and it was DarkMatter's whole last chapter. Maintenance notices appear with checkout still open. Disputes are paused. Staff nudge buyers to finalize early.
- The end
- The site stops answering, or keeps a front page up that still accepts payments. Staff accounts go quiet or vanish. Sometimes a story about a hack or a raid goes up, to buy a few more days of deposits.
Any market you hold coins on can be checked against this in ten minutes:
- Withdraw a small amount, or watch an escrow release, and time it against the market's usual window.
- Read the newest posts in the market's Dread community, sorted by new, for stuck withdrawals and unanswered tickets.
- Check the date on the latest signed staff message. Unsigned notices about money are the ones to distrust.
- Compare how fast a deposit is credited with how fast a withdrawal leaves. A widening gap is the stage-two sign.
- Keep nothing on the market between orders. It is the only check that still protects you when the other four come too late.
Why multisig escrow did not protect Nexus users
Multisig escrow puts an order's coins in an address that needs two signatures from three keys, one each held by the buyer, the vendor and the market, using the M-of-N scheme set out in Bitcoin's BIP 11. Done properly, the market cannot move the coins on its own; it needs the buyer or the vendor to sign with it. That is real protection, and it covers much less than the word suggests.
- Only coins inside a multisig address are covered. Account balances, finalize-early orders, direct-pay orders and Monero payments sit outside it. Markets rarely offer Monero multisig at all, so on a market taking both coins, much of the money is never in a 2-of-3 address.
- The buyer has to hold the third key. A buyer who never supplied a key of their own, or let the market generate one in the browser, has handed the market two keys out of three.
- Market and vendor together make two. Vendor accounts the market runs itself, or a vendor paid to sign along, are enough to release coins.
- Nobody checks the address. A buyer who does not confirm the payment address is built from their own public key is taking the market's word that it is multisig at all.
Whatever Nexus took, it took through those gaps, because a correctly built 2-of-3 address with the buyer's own key cannot be emptied by the market alone. For anyone weighing a multisig market now, the protection is real only if you supply your own key, check the address, and accept that it works in Bitcoin, the coin that leaves the public trail our Monero vs Bitcoin privacy explainer traces.
Who loses what in an exit, by how you paid
| Your coins were | Market exits | Market is seized | Vendor vanishes |
|---|---|---|---|
| A balance in a market wallet | Lost | Seized | Untouched |
| In central escrow on an open order | Lost | Seized | Refunded, if staff rule for you |
| In 2-of-3 multisig, with your own key | Out of the market's reach; releasing them needs the vendor's signature with yours | Out of police reach too, for the same reason | Refundable: you and the market sign them back |
| Finalized early | Already with the vendor | Already with the vendor | Lost |
| Paid by direct pay | Already with the vendor | Already with the vendor | Lost |
A walletless market has no first row, which is why its exits cost users less: only open orders are exposed. Mars works that way, and our overview of Mars Market explains its escrow and when it is skipped.
What police get when they seize a market's servers
Everything on them: usernames, password hashes, private messages, order histories, the PGP public keys on every profile, vendor payout addresses, wallet files and server logs. At Archetyp, police took the market's servers in the Netherlands offline, arrested its administrator, a 30-year-old German national, in Barcelona, and arrested a moderator and six of its biggest vendors in Germany and Sweden, eight arrests in all, with assets worth €7.8 million seized. The market had run for more than five years and carried about 17,000 listings. Eurojust's release on the Archetyp operation has the full account.
The banner is the start of a seizure, not the end. In May 2025 the US Justice Department announced 270 arrests of dark web vendors, buyers and administrators across four continents under Operation RapTor, and said the leads came from infrastructure seized from Nemesis, Tor2Door, Bohemia and Kingdom Market. The Justice Department's RapTor announcement sets out how. A seized database keeps producing cases for years after the market is gone.
Police do not always switch a seized market off, either. In 2017 Dutch police took over Hansa and ran it for about a month before closing it, recording what its users did in that time. A market that still works is not proof that nobody else is running it.
What a seizure cannot open is a message you encrypted on your own machine to the other party's key, unless the police also hold that key. What it can follow is money: a wallet file listing every Bitcoin deposit address, set against a public ledger, leads back toward the exchanges those coins came from.
What happens to a dead market's address
After an exit, the address usually goes dark, though not always at once: a market draining deposits keeps its front page up behind a "maintenance" notice until the operators stop bothering. After a seizure, the address shows a police banner, because the police now hold the onion key. In both cases the key still exists, and whoever holds it can bring the address back serving anything. A dead market's address is never safe again, and the October 2026 GoBalance flaw made that wider: a key worked out from what an address published while it was running stays good after the market dies.
Around the old name a second crop grows: lookalike addresses, "new official mirror" posts, and directories that keep the name listed for the traffic it brings. Treat every one as phishing. A genuine new address would come in a message signed by the market's old key, checked the way our guide on how to verify an onion link describes.
Can a dead market come back?
Not the one you lost money on. An exit-scammed market has no reason to return to the people it took from, so "Nexus is back" posts are phishing, or a new crew borrowing a known name to collect deposits. Seized markets have returned as names: AlphaBay was relaunched in 2021 by one of its original staff, four years after police took it down, and Flugsvamp is on its fourth version. Each of those is a new market with new risks. Old accounts, balances and reputations do not carry over, and a returning name calls for more checks, not fewer. A market that closed by plan, as White House Market did in 2021, stays closed.
Are offers to recover lost market funds real?
No. The pitch arrives in several costumes: a "blockchain forensics" service, a hacker who can reverse the exit, a lawyer with a class action, someone posing as police with a way to release seized coins. Nobody can reverse a confirmed Bitcoin or Monero payment. Coins taken in an exit are with the people who took them, and coins seized by police are evidence that ends in forfeiture, not in refunds to anonymous account holders. Anyone who asks for a fee up front to get your money back is collecting a second payment from the same loss.