Clarification: A previous version of this article failed to properly explain that Gustav had stopped attacking White House Market, Monopoly Market, and Darkmarket.
“ps admins you can mark Grey Market as scam exited and ban all our official accounts”
-- Grey Market admin in a post on Dread
After more than a week of intermittent uptime, the market went completely offline between four and six days ago. Different users have provided Darknetlive with different dates and it looks as if vendor mirrors worked for longer than the public mirrors. On December 27, one vendor wrote that they had lost access to the market (via vendor mirrors) “two days ago.” A number of buyers complained about 502 errors since before December 25. Nevertheless, vendor mirrors completely stopped working at some point after Christmas.
As a result, incoming and outgoing payments also stopped. Customers could not finalize the orders they had received and vendors could not withdraw any Bitcoin. Some stood up for the market on the market's subdread. In an official announcement thread, one vendor wrote, “yea you are right, they have been great and i don't think is an exit scammed [sic].” The vendor also wrote that Grey Market had blocked new transactions since “2-3 days before the ddos” and that a market planning on exit scamming would have allowed transactions until the very end.
Distributed Denial of Service
Grey Market was one of several small markets struggling under the weight of an especially powerful DDOS attack. According to a market administrator familiar with the ongoing attacks, the actor responsible is essentially able to take any onion service offline. Facebook's onion service is one of very few exceptions acknowledged by the attacker.
One market administrator told Darknetlive that Grey Market had used the ongoing DDOS attack as an excuse for the rogue administrators actions. The actor responsible for the DDOS has also attacked markets such as White House, Monopoly, and Darkmarket. The attacker eventually stopped hitting those three markets. All three are still here. Several smaller markets, such as Yellow Brick and BitBazaar, are allegedly struggling under the same DDOS attack.
But an exit scam is an exit scam. The Grey Market administrator responsible for the message on Dread claimed the theiving administrator had used the chaos caused by the DDOS attack to “take a chance” at emptying the market's cold storage. The DDOS attack could have inspired the theft of the funds in cold storage but marketplaces with their own wallets can steal funds at any given time.
Below is the message posted on Dread by u/DrkMrkRIP. The user created a new account to post the message instead of using one of the existing Grey Market accounts. However, the signature checks out. If some random person has access to their primary PGP key, the market has more serious concerns than a DDOS attack.
-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512hello everyonei am grey market admin and we had another admin lets call him billy. billy was in charge on promotion and only he has access to all our official accounts here.as you know last few weeks we had bad ddos attack so while we were very busy to fight billy took his chance and stole all money from cold storage. few days later we had to stop market because we cant pay back. billy’s searching is already on the way we will try to return as much as possible we need time. if everything is good we will back in few months with new ddos and scam proof market we will try to make multisig escrow as simple as possible other ways are not safe for vendors and customers.we apologise for spoiled xmas and new year we feel the same, peace brosps admins you can mark Grey Market as scam exited and ban all our official accounts-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEx4j2V/O4jCTyHuuXovMw5Y3DBO0FAl4LHYsACgkQovMw5Y3DBO2+nhAArQq2DR2fEAGFZdphUQtOaR9xd8K7bpH1kY/PIqT+3KJ8Sm9JkgqhNsVHxvVmaHXyh+rkECLg5H50g5z8ymNjeFWVW6im5HPtdMdle3TS/CxxMhqBlJv2bSUTq7Rh3qi6B8ZLOj8DvymNwaXNLve6jtK11Vb04GGxYGySYTJYm/wSj4QvYOtytWS77US24z+Lk5Ip+4J1HNZDZMOM9WDMXQMtUosV2e+JHAypm8MZIz1CiZ3bZDD9O63lrZx2QVzcP3GHjgax89xQgvarnzvUlkUuopBwFpwf5pb4feAEubGx3GAM36ox/soJeyr94Il0/z+KdjAb0h71vv/6A5jnUXjbvRBZ7W7gw4Rcj5sT8WURUO3ePa+0PHtrc08KmPQG49NfDrAeFuWCpyGk+JbYPki7ATP2rL4CAzx3OoxhblG7NJkdEG5keXzeeapc1eQUWSuNiYGH4TkNWkvoWw2AycoRPnnQVsj0Y4ynUJBnXGANFDwmiuEKqaY1OpnNtbU701N9+2V/qKknbdqKBsAosvSNGWM9r8sBMWQ/2EL/AhZOWAgMBebTcoIjaHDV+wOoniRMz2jBrf+3mHA6xDr29VLvHZDizt80UZeFK1BKFFCz/fGKeoP6UYuVghGm0z9bjWnMw8K/36Ie+ScToqEAKxlHevnm89YTRVY4vMiP8RQ==Tb6e-----END PGP SIGNATURE-----
Here is the marketplace's PGP key as saved on the market's subdread wiki: