Exit Scams
The most destructive and financially devastating scam in the darknet ecosystem. A marketplace or vendor strategically builds trust over months — sometimes years — accumulating funds in escrow, then vanishes overnight with all held assets. Warning signs include: sudden policy changes requiring Finalize Early (FE), unexplained withdrawal processing delays, admin inactivity on Dread and community forums, decreasing vendor participation, and unusual spikes in new "verified" vendors appearing simultaneously.
The psychology: Exit scams exploit sunk cost fallacy — users who have invested months building vendor relationships and market reputation are psychologically reluctant to withdraw funds, even when warning signs appear. This cognitive bias is deliberately leveraged by exit scammers who introduce FE requirements gradually.
Notable examples: Evolution Market (2015, ~$12M stolen), Empire Market (2020, estimated $30M), Abacus Market (2025, ~$12M). The pattern is consistent: even long-running, seemingly stable platforms with years of operational history can exit at any time. No market is immune — the only defense is minimizing escrowed exposure.
Phishing Clones
Pixel-perfect replicas of legitimate markets designed to harvest login credentials and wallet information. Attackers register near-identical .onion addresses (often differing by a single character) and distribute them through forums, "helpful" DMs, fake directory sites, and SEO-manipulated clearnet pages. In 2026, AI-generated phishing pages can replicate target markets within minutes of deployment.
Scale of the problem: For every major darknet market, there are typically 5-15 active phishing clones running simultaneously. Some clones intercept transactions rather than credentials — allowing users to "log in" normally while silently redirecting deposit addresses. See our detailed anti-phishing guide for comprehensive defense strategies.
Fake Vendor Operations
Vendors who create the appearance of legitimacy through manufactured trust signals. Tactics include purchasing aged accounts with established history, self-reviewing through multiple sybil identities, exploiting marketplace review system bugs, and "selective scamming" — fulfilling most orders legitimately while scamming high-value transactions. Red flags: impossibly low prices for premium products, refusal to use escrow, new accounts with suspiciously perfect records, pressure to finalize early, and communication that pushes urgency ("limited stock").
Defense: Look for vendors with 500+ organic transactions, a rating above 4.8 over 6+ months, and a consistent presence on Dread. Cross-reference reviews — if all positive reviews share similar writing patterns, they may be fabricated.
Honeypot Markets
Markets or services secretly operated by law enforcement or intelligence agencies to identify and prosecute users. Honeypots function normally — sometimes for months or years — processing legitimate transactions while systematically collecting identifying information from participants. The Hansa Market operation (2017) is the definitive example: Dutch police operated the market for a full month after seizure, capturing thousands of vendor credentials, shipping addresses, and buyer identities.
Critical insight: Honeypots are, by design, impossible to detect with certainty from the user side. This is why OPSEC must be maintained unconditionally — not as an optional precaution, but as a default posture. Assume every platform is compromised until proven otherwise, and behave accordingly.
Social Engineering
Attacks that exploit human psychology rather than technical vulnerabilities. Attackers impersonate administrators, moderators, or trusted community members using cloned profiles, stolen PGP keys, or fabricated authority signals. They use urgency ("your account is compromised, verify now"), authority ("admin security check"), and fear ("your order has been flagged") to trick targets into revealing credentials, clicking malicious links, or sending funds to attacker-controlled addresses.
2026 threat landscape: AI-generated voice cloning and deepfake technology have lowered the barrier for sophisticated social engineering attacks. Voice messages from "admins" can now be synthesized from short audio samples. The counter-measure remains unchanged: verify everything via PGP-signed messages on the official platform. If a message cannot be PGP-verified, treat it as hostile regardless of how convincing it appears.
Detection Methods
| Scam Type | Key Indicator | Defense |
|---|---|---|
| Exit Scam | Withdrawal delays, FE pressure | Minimize escrowed funds, diversify |
| Phishing | URL character changes | Manual URL verification every time |
| Fake Vendor | Too-good prices, no escrow | Always use escrow, verify history |
| Honeypot | Undetectable by design | Maintain OPSEC regardless |
| Social Eng. | Urgency, authority claims | Zero-trust policy, PGP verify |
Golden Rules
- Always use escrow — never finalize early for unknown vendors
- Cross-verify all .onion URLs from multiple independent sources
- Never trust DM links, even from "helpful" users
- Maintain full OPSEC at all times — assume everything is a honeypot
- Keep minimal funds on any single platform
- Research vendor and market reputation on Dread before transacting