An underground online marketplace that sold illicit goods including guns and drugs has suddenly vanished without trace, taking with it as much as $100 million worth of Bitcoin, in what has been labelled as the “Biggest Darknet Scam Ever”, according to Deepdotweb.com.

Sheep Marketplace is one of a number of Deep Web sites that emerged in recent months, following the FBI’s closure of the popular Silk Road marketplace last October. But now, users of the site, which could only be accessed via the anonymous Tor network and would only accept payment in Bitcoin, believe that the site was a scam from the very beginning.

At the weekend, Sheep Marketplace’s admin took the site offline, posting a message claiming that it had been hacked with more than 5,400 Bitcoins stolen (worth approximately $5.6 million at the time of writing). But in fact, estimates since then suggest that the true scale of the theft is much, much larger, with almost 100,000 BTC believed to have gone missing, equivalent to more than $100 million.

Was it a SheepMarket Scam?

The finger of suspicion points to Sheep Marketplace’s operators for good reason. Apparently, issues began late last week, when the site suddenly began preventing users from withdrawing the Bitcoin in their accounts.

Coindesk reports that administrators informed users that the site was undergoing “organizational changes”, and would be able to access their money within a few days, only for the site’s forums to close down shortly afterwards. Then on Sunday, Sheep Marketplace shut down altogether, with the following message posted on its home page:

The plot thickens…

Evidence has since emerged that points to the administrators involvement in the heist. A website called SheepMarketScam.com has been following the events surrounding the heist since the site first began refusing withdrawals, and believes that more than 40,000 BTC belonging to site users has been transferred to a Bitcoin address used by the site’s operators.

These claims have been corroborated by a Reddit user, throwme1121:

“Look up your Sheep deposit addresses on Blockchain. Follow any outgoing money. It’s a mass exodus of BTC from Sheep addresses to external holding wallets.”

throwme1121 also noted that around 40,000 BTC had passed through the same address, noting that its first transaction dates back to November 8.

And thickens…

Since then, a UK-based Redditor who is presumably also one of the site’s victims, appears to have taken it upon himself to track down the missing Bitcoin. In one post on Reddit, sheeproadreloaded2 said that his own investigations of the blockchain revealed the movement of around 96,000 BTC through two separate ‘Bitcoin mixer’ services, which are designed to make the cryptocurrency harder to keep track of.

sheeproadreloaded2 claims to have tracked the coins to a number of new wallets that he believes belong to the SheepMarketplace’s operator. To let him know that he’s chasing him, sheeproadreloaded2 claims to have sent 0.00666BTC to each wallet he’s discovered:

“I think he’s asleep now in the Czech republic. When he awakes, he will see my 666 next to his 96,000 stolen, freshly-laundered bitcoins.”

Unfortunately for SheepMarketplace users, tracking down the wallets are one thing, but catching the perpetrator himself is going to be much more difficult. Neither the FBI nor the Secret Service have offered any comment on whether or not they were responsible for seizing the Bitcoins, nor have they said if they’re investigating any “fraud allegations”. No doubt they know something’s gone down, but with the vast majority of the site’s users being involved in illicit dealings of drugs and guns, it’s unlikely anyone’s going to make a complaint.

Whether or not the theft was carried out by the site’s operators, or hackers as they claim, it serves to highlight just how risky it is to do your business over the Deep Web.

photo credit: James @ NZ via photopin cc