Empire Market: The $30 Million Exit Scam That Shook the Dark Web

Published on April 17, 2026 · About 11 minutes read

On August 22, 2020, around 6:00 AM UTC, Empire Market — the largest dark web marketplace at the time, the direct successor to AlphaBay after its 2017 takedown — silently went dark. No farewell message. No official announcement. No migration to a mirror. Just .onion addresses refusing connections, total silence on Dread and community forums, and approximately $30 million in Bitcoin that had just left the escrow wallets toward unknown destinations. The largest exit scam in dark web history was underway. This article traces the timeline, the warning signs, the impact on the site's 1.3 million users, and the largely futile attempts to track down the operators.

Origins: Empire Market and the post-AlphaBay era

Empire Market launched in February 2018, six months after AlphaBay's seizure (July 2017) and in the vacuum created by Operation Bayonet. The site was presented by its operators — under the pseudonyms "Dopenugget" and "Melvin" — as AlphaBay's natural successor, with a near-identical interface, a similar commission structure, and a promise of technical stability.

The timing was perfect. Former AlphaBay and Hansa users (Hansa having been shut down simultaneously in Operation Bayonet) were looking for a new home. Dream Market was still running but beginning to show technical weaknesses. Wall Street Market was rising but had a mixed reputation. Empire arrived with solid arguments: Monero (XMR) support from day one, multi-signature architecture, an experienced moderation team (including former AlphaBay moderators).

The meteoric rise (2018–2020)

Empire's growth was spectacular. Public metrics (DNStats, Dark.Fail, Dread) show near-linear progression:

February 2018 — Launch. 2,000 listings, 100 vendors.
End of 2018 — 25,000 listings, 1,200 vendors.
Mid-2019 — 50,000 listings, 3,500 vendors.
End of 2019 — 100,000 listings, 5,000 vendors.
Summer 2020 (peak) — 1.3 million registered users, approximately 14,000 vendors, 180,000 active listings.

At its peak, Empire held approximately 50% of the global dark web market by transaction volume. Monthly revenue figures oscillated between $40 and $60 million depending on the period. The standard commission was 4%, meaning estimated gross revenues of $1.5 to $2.5 million per month for the operators.

Warning signs in July–August 2020

In retrospect, several warning signs were visible in the weeks before the exit scam.

DDoS attacks and extended maintenance

Empire Market suffered massive DDoS attacks starting in May 2020. The operators cited these attacks to justify maintenance windows, slowdowns, and — crucially — periods when withdrawals were disabled. These windows, initially lasting a few hours, stretched to full days in July and August 2020.

Inconsistent communication

Dopenugget, who regularly communicated on Dread (the reference dark web forum), progressively spaced out his posts. His last messages dated from August 15, 2020, a week before the disappearance. The tone seemed reassuring, but several experienced observers noted a shift in writing style suggesting either that someone else was at the keyboard, or that Dopenugget was writing under significant pressure.

Blocked withdrawals

In the 10 days before the shutdown, many vendors reported on Dread that their withdrawal requests were systematically "processing" without ever completing. Deposits were still being accepted, but nothing was going out. This pattern is the unmistakable signature of an exit scam in preparation — the operators still accept incoming funds (to maximize the haul) while blocking outflows.

August 22, 2020: the disappearance

On August 22 around 3:00 AM UTC, Empire's escrow wallets began draining their contents into a set of intermediate wallets. Blockchain analysts would identify these transactions in the days that followed — approximately 2,638 Bitcoins (equivalent to $30 million at August 22 exchange rates) transferred in about twenty successive transactions, visibly automated.

At 6:00 AM UTC, Empire Market's official .onion addresses (there were three in rotation to resist DDoS) all became simultaneously inaccessible. The URLs of the official mirrors too. Administrator accounts on Dread fell silent. The complete absence of communication ruled out the hypothesis of a police seizure (which would have been publicly claimed by authorities) or a technical incident (which would have prompted an announcement).

By 10:00 AM UTC, the community diagnosis was in: it was an exit scam. HugBunter's alert post, founder of Dread, became one of the most-read threads in the forum's history, with thousands of replies from stunned vendors and users tallying their losses.

Human and financial impact

The damage from Empire Market's exit scam spans several dimensions.

Buyer users

Approximately 300,000 to 400,000 users had funds in escrow or on deposit at the time of closure. Individual amounts ranged from a few tens of dollars (orders in transit) to several thousand (professional bulk buyers). The total amount lost on the buyer side: approximately $12 to $15 million.

Vendors

Vendors were hit harder. Each vendor had to deposit between $2,000 and $5,000 as a "vendor bond" (security deposit) to be authorized to list. With 14,000 active vendors, that represents a minimum of $30 to $70 million in bonds, the vast majority of which was never returned. On top of that, recent unsettled sales were also lost.

Ripple effects

Empire's collapse triggered a massive crisis of confidence across the entire dark web ecosystem. Total transaction volume on marketplaces fell by nearly 40% in the months that followed. Professional vendors preferred to shift toward private channels (encrypted Telegram, Signal, private XMPP servers) rather than risk another exit scam on a new platform.

Blockchain tracing of the funds

Blockchain analysis firms — Chainalysis, Elliptic, TRM Labs — immediately traced the outgoing transactions. Their public and confidential reports allow the path of the funds to be reconstructed.

Step 1 — August 22–23, 2020: the 2,638 BTC from Empire's wallets are consolidated into 5 large intermediate wallets.
Step 2 — September 2020: the funds are fragmented into hundreds of small transactions and sent to mixers (Wasabi, CoinJoin via Samourai, CryptoMixer).
Step 3 — October 2020 to March 2021: a portion of the funds resurfaces on several small Eastern European and Central Asian exchanges, where they are converted into dollars or stablecoins.
Step 4 — 2021–2022: the remaining funds are laundered via DeFi activity (Uniswap, swaps to Monero via ThorChain, etc.) or remain dormant.

American authorities (FBI, HSI) and European authorities (Europol) collaborated on the case. In 2022, FBI agents recovered approximately $8 million in Bitcoin by identifying compromised wallets belonging to a Ukrainian intermediate money launderer. These funds were seized but not redistributed to victims (legally complex situation: the "victims" are themselves engaged in illegal activities and cannot claim compensable damages).

The operators' opsec

What distinguishes Empire Market from previous exit scams is the exceptional quality of the operators' operational security. Six years after the fact (in 2026), the real-world identities of Dopenugget and Melvin remain publicly unknown. None of the methods that enabled the identification of Ulbricht (historical BitcoinTalk posts) or Cazes (personal email) worked.

The most plausible hypotheses, advanced by independent OSINT researchers such as Chris Monteiro and Rémi Oddoux, place the operators probably in Eastern Europe and Ukraine. No direct evidence has been published. This suggests the operators had learned from their predecessors' failures: absolute separation of real-world and operational identities, exclusive use of Qubes OS and Tails, zero presence on social networks under their real identities, multi-hop wallets not linked to direct bank accounts.

After Empire: market fragmentation

Empire was never replaced. From August 2020 onward, the dark web market fragmented into several smaller players, each holding 5–15% of the total market, with no dominant champion. This fragmentation is partly strategic: professional buyers now fear concentrating their volume on a single platform.

The years 2021–2024 saw White House Market (voluntary operator shutdown in October 2021, with partial restitution to users — a rare and praised case), Versus Project, ASAP Market, Tor2Door, Archetyp, and Incognito Market (seized in 2024) come and go. None reached Empire's size at its peak.

In parallel, a shift toward private channels has been observed: encrypted Telegram with crypto payment bots, Signal groups, .onion XMPP/Matrix servers (see our guide on Tor). These channels partially escape law enforcement surveillance but pose their own risks (no escrow system, proliferation of individual scams).

FAQ about Empire Market

What is an exit scam?

An exit scam is the process by which dark web marketplace operators abruptly shut down the site and take the funds held in escrow (funds temporarily held during transactions). Users who had money awaiting delivery or confirmation lose everything. It is the most classic dark web scam — most major marketplaces have ended this way when they were not seized by police.

How much did Empire Market steal?

Estimates vary between $22 and $30 million in Bitcoin at the August 22, 2020 exchange rate, the official date of disappearance. The most commonly cited figure is $30 million. This includes escrow funds on ongoing transactions, user deposits, and vendor security deposits (often $2,000 to $5,000 per vendor).

Who were Empire Market's operators?

Two main operators are identified as 'Dopenugget' and 'Melvin' in the archives and testimonies. Dopenugget is believed to have been the initial founder, Melvin the lead technical developer. Their real-world identities were never established with certainty. Unverified rumors placed them in Eastern Europe and North America.

Were the stolen funds recovered?

Partially. Blockchain analyses by Chainalysis and Elliptic traced some of the Bitcoins to exchanges in December 2020 and 2021 (where some were converted). Around $8 million was tracked via mixers and tumblers. The rest disappeared into complex money-laundering channels, mainly through small Russian and Uzbek exchanges.

Were there any arrests?

No arrests of the main operators have been publicly confirmed as of 2026. Unlike the founders of Silk Road, AlphaBay, or Hansa, the real-world identities of Dopenugget and Melvin remained protected by exceptional operational security. Only a few major vendors on the site were subsequently arrested in parallel investigations.

Which marketplaces replaced Empire?

Empire's collapse created a major void. Several marketplaces tried to capitalize on it: White House Market (2020–2021, voluntary operator shutdown), Dark0de (2020–2022), Versus Project, ASAP Market, and more recently Abacus Market. None has regained Empire's size in terms of active users at its summer 2020 peak.