Another Marketplace Seizure Or a Scam? (Andromeda)

Posted by: DeepDotWeb

November 18, 2014

Update: Confirmed as scam – details at the end of the post.

Today, almost 2 weeks after Operation Onymous , another dark net market suddenly shut down, displaying the “This hidden site has been seized” banner, This time, it was Andromeda market:

It is not fully clear if the shut down is indeed another seizure, or if the administrators decided to do an “exit scam,” and placed this banner as their alibi. Additionally, this market was not listed on the official list of seized sites pubslihed by the FBI. However, there is always the possibility that the market was seized and kept alive by Law Enforcement to secretly gather data on its users, like the United States Federal Bureau of Investigation have done in the past.

Since Operation Onymous, Andromeda has had serious malfunctions; multiple users suggested that the dark net market might be compromised by Law Enforcement. Some time later, a comprehensive Reddit thread, discussing this possibility, was deleted along with the original poster’s account.

The main reasons for why the dark net market could be considered compromised were summarized later by galaxyandspace, a moderator on /r/darknetmarkets:

• Vendors public keys where changing
• Withdrawals where disabled for 12+ hours
• An admin was PMing users on the forum for their pin and passwords
• Administrative silence since the post onymous announcement.
• Weird/inconsistent wording in that message from the admins
• Edit: admins asking for home addresses to send free MJ to, for some of the users.

Without any official statement from Law Enforcement, the question of whether Andromeda’s closing was a legitimate seizure or a scam will remain open for now.

Additionally, 2 other dark net markets are down at the moment. We will observe the sites and provide updates when we have further information.

Supports for the scam theory

1.As someone posted here:

http://silkroad6ownowfk.onion/login = Real LE takedown shows on all former pages the takedown notice.

http://andromedam363aux.onion/login.php = Fake takedown – does show still same file not found message as before.

2. We received the following info from a vendor on Andromeda:

1. Orders could be paid for the usual way up til about a week ago.
2. Then mid week – u saw a new web page note saying that “deposits aren’t necessary.  Pay for ur order at checkout directly to a wallet!”
3. When users finalized orders on the last few days, the withdrawals would not work for vendors.
4. Somebody on forum then claimed they found a trick to allow them to basically send coins from their and wallet to the premium vendor upgrade wallet address which would then in turn allow the vendor wallet to function again.
5. I dont know that number 4 is true for sure – but next day, the trick became impossible to try because vendor wallets and buyer wallets were simply gone from view so everybody had 0 coins at that stage and a new andromeda wallet addy associated with their acct.
6. At that stage, u could then lookup ur andromeda original wallet on blockchain and u saw the coins being systematically emptied into a particular single address (30 bitcoins or so but was still ticking away upon last check).  Can send u the address if u want it.
7. U also saw vendor profiles being updated to say “do not place orders or deposit coins here!  Scam warning!”.  But then the next day, theyd be rolled back to look like vendor was open for business.  Listings too going from disabled to reenabled.

The above information has not yet been verified, but it sounds similar to the things that happened on Sheep, Pandora & The pirate market before they executed their exit scam.

3. New Diabolus / SR3 market looks very similar to Andromeda and its former incarnations, Darkbay, UltraVioletCity—in terms of design and code, and another past attempt at…. Silk road3 (From the market list changelog: “15.4.14 – Changed SilkRoad 3 name to Andromeda“). So, this market is basically:  Darkbay = Ultravioletcity = Silk Road 3 (past) = Andromeda = Diabolus = Silk Road 3 (current)

4. And the final point of evidence supporting the scam theory can be found right here, written by Gwern.

Updated: 2014-11-18