Four of the largest criminal marketplaces on the dark net were unreachable on Friday, prompting speculation about police activity.
All four marketplaces – the Dream Market, the Trade Route, the Tochka Free Market and the creatively named Wall Street Market – allowed anonymous users to trade illicit goods in cryptocurrencies.
It is not unusual for such marketplaces to disappear with their customers’ cash, which they often hold as an escrow service, but the fact that the four largest have vanished simultaneously has provoked interest.
Users of dark net discussion forums on the open web have warned that the sites could be targeted by a Distributed Denial of Service (DDoS) attack – a way of forcing websites offline.
“Whether or not it’s law enforcement carrying out the attacks is another question, as it could just as easily be well organised cyber criminals or even a state, in an effort to gain access to cryptocurrency,” one user wrote.
North Korean hackers have been accused of attempting to steal Bitcoin as international sanctions begin to bite.
Particularly fresh in most observers’ memories is July’s closure of two of the largest dark net markets in a major international police operation.
Previous law enforcement takedowns of dark net markets have replaced front pages with notices informing users that the sites have been seized, rather than them just being left unavailable.
Law enforcement agencies in the US, UK and EU told Sky News they had no statement to make.
Dr Steven J Murdoch, a research fellow at UCL who is a member of the Tor project – which received US federal government funding – told Sky News: “There are a few possibilities of what is going on.”
He explained that as all four marketplaces use the Tor anonymity network, it is almost impossible to determine the cause of their disappearance, although alternate links to Dream Market are functioning.
“There’s not much that can be found out on the root cause of the downtime, because the approaches that Tor takes to protect users of the network also interfere with usual techniques for tracing the origin of problems.
“All I can see is that the connection is timing out, which could be the result of many types of network issues.
“For example, it might be a coincidence, it might be that these sites share some sort of infrastructure and so all went down simultaneously, or it could be some sort of attack.”
“Another possibility is that the markets have upgraded to a new version of Tor, which seems to be causing problems with services in some situations. The Tor developers are investigating.”