Cyber Security News

Abacus Dark Web Market Suspected of Exit Scam with Held Bitcoin Funds

The largest Bitcoin-enabled Western darknet marketplace, Abacus Market, has gone offline amid widespread suspicions of an exit scam that may have cost users millions of dollars in held cryptocurrency funds.

TRM Labs, a blockchain analytics firm, assesses that the marketplace’s operators likely shut down operations and disappeared with users’ Bitcoin and Monero deposits in early July 2025.

Market Disappearance Follows Warning Signs

Abacus Market’s infrastructure, including its clearnet mirror sites, became completely inaccessible in early July 2025, just weeks after users began reporting significant withdrawal issues.

The warning signs emerged in late June when frustrated users flooded darkweb discussion forums with complaints about frozen funds and delayed transactions.

The marketplace’s administrator, known by the pseudonym “Vito,” initially attempted to reassure users through posts on the Dread forum, claiming that an influx of users from the recently seized Archetyp Market and distributed denial of service attacks were causing technical difficulties.

Screenshot of Abacus admin’s Dread post explaining why the marketplace was down

However, the darknet community remained largely skeptical of these explanations, leading to a dramatic decline in user confidence and deposit activity.

Data analysis reveals the extent of user exodus from Abacus Market in its final weeks. Between June 1 and June 27, 2025, the platform processed an average of $230,000 in daily deposits across approximately 1,400 transactions.

Following the withdrawal complaints, this activity plummeted to just $13,000 across 100 deposits between June 28 and July 10, 2025.

This collapse comes after Abacus had experienced its most successful period, generating $6.3 million in sales volume during June 2025 alone, largely attributed to users migrating from the law enforcement-seized Archetyp Market.

Originally launched as Alphabet Market in September 2021 before rebranding to Abacus in November 2021, the platform had steadily captured market share in the Western darknet ecosystem.

The marketplace particularly focused on Australian customers while offering a comprehensive range of illicit drugs including stimulants, psychedelics, opioids, and prescription medications.

Abacus’s market dominance grew from just 10% in 2022 to over 70% by 2024, following the voluntary closure of ASAP Market and law enforcement seizure of Incognito Market.

The platform supported both Bitcoin and Monero transactions, with analysts estimating total sales between $300-400 million when accounting for privacy coin transactions.

Industry experts suggest that Abacus’s very success may have precipitated its downfall. Large, prominent marketplaces often become priority targets for law enforcement agencies worldwide.

The recent seizure of Archetyp Market in June 2025 likely intensified pressure on remaining major platforms, potentially motivating administrators to exit while ahead rather than risk capture.

The disappearance of Abacus represents the latest consolidation in the darknet marketplace ecosystem, where operators increasingly face the difficult choice between continued profits and personal freedom.

Stay Updated on Daily Cybersecurity News . Follow us on Google News, LinkedIn, and X.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…

1 day ago

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…

1 day ago

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…

1 day ago

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…

1 day ago

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…

1 day ago

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…

1 day ago