Abacus Darknet Market Allegedly Plotting Exit Scam with User Bitcoin Funds

In early July 2025, the largest Bitcoin-enabled Western darknet marketplace, Abacus Market, unexpectedly went offline, triggering widespread speculation of an exit scam or covert law enforcement seizure.

Users reported withdrawal failures days before the shutdown, and despite administrator “Vito” blaming a distributed denial-of-service (DDoS) assault, deposits plunged from an average of USD 230,000 daily to just USD 13,000.

Blockchain intelligence firm TRM Labs has since assessed that the marketplace’s operators likely absconded with user funds, although the possibility of a secret seizure remains on the table.

Market Exit and Withdrawal Woes

In the final week of June, traders began encountering errors when attempting to withdraw Bitcoin (BTC) from the platform’s multisignature escrow wallets.

This anomaly is a hallmark of an impending exit scam, given that operators typically lock funds to prevent users from retrieving deposits.

On the darkweb forum Dread, “Vito” claimed the issues stemmed from a DDoS attack coupled with an influx of users fleeing the recently seized Archetyp Market.

Yet on-chain data revealed a 94 percent drop in deposit transactions between June 28 and July 10, offering little reassurance to the community.

Amid this turmoil, security analysts employed on-chain monitoring tools to trace Abacus’s hot wallets.

Using a sample Python snippet, investigators queried the TRM BLOCKINT API to fetch real-time balances:

pythonimport requests

API_KEY = "YOUR_TRM_API_KEY"
address = "1AbcXyz123ExampleBitcoinAddr"
url = f"https://api.trmlabs.com/v2/address/{address}/balances"
headers = {"Authorization": f"Bearer {API_KEY}"}
response = requests.get(url, headers=headers)
data = response.json()
print(f"Balance for {address}: {data['balances'][0]['amount']} BTC")

This script underscores how blockchain forensics can rapidly reveal liquidity movements in suspected exit scams.

Market Evolution and Monero Adoption

Since its launch in September 2021 as Alphabet Market and subsequent rebrand in November 2021, Abacus distinguished itself by supporting both Bitcoin and Monero (XMR), the latter offering enhanced privacy via ring signatures and stealth addresses.

By 2024, Monero accounted for roughly 70 percent of Abacus’s total volume, underscoring a broader shift towards privacy coins within darknet markets.

TRM analysis indicates that nearly half of the new marketplaces in 2024 accepted only Monero, up from one-third in 2023, signaling operators’ growing reliance on obfuscation techniques to evade on-chain surveillance.

The platform’s user base swelled after rivals such as ASAP Market voluntarily shut down in July 2023 and law enforcement raided Incognito Market in March 2024.

Abacus’s rapid ascent culminated in a monthly sales peak of USD 6.3 million in June 2025—just weeks before its abrupt disappearance.

Law Enforcement Strategies and Future Outlook

While no official seizure banner appeared on Abacus, past operations like Onymous (2014) and Operation Bayonet (2017) demonstrate law enforcement’s preference for intelligence-led takedowns.

Modern tactics focus on vendor arrests rather than wholesale market shutdowns, disrupting activity across multiple platforms simultaneously.

Covert seizures allow agencies to gather deeper evidence before announcing arrests, reducing the risk of vendor flight.

The fallout from Abacus’s exit is accelerating vendor migration to smaller, script-based DNMs and encrypted chat platforms such as Telegram.

Successor markets—like DrugHub and TorZon—now face a difficult choice: pursue growth and risk detection, or prioritize stability at the expense of volume.

As law enforcement hones its strategies and blockchain intelligence tools evolve, the darknet ecosystem remains caught between expansion and self-preservation in an increasingly hostile environment.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates