Empire Market: The $30 Million Exit Scam

The disappearance: $30M gone overnight

Empire Market went dark around 22 August 2020 and never came back. It had launched in February 2018 and grown into the darknet's most popular marketplace by traffic, home to roughly a million users, so when withdrawals stopped clearing and the site stopped resolving, an enormous pool of deposits was trapped behind it. Analysts estimated the administrators vanished with about 2,638 BTC, worth roughly $30 million at the time, though even that figure was uncertain because no single large movement of coins was cleanly identified at first.

What told everyone it was theft rather than a takedown was an absence. When police seize a market, they post a triumphant banner; when a market retires honestly, it signs a farewell and keeps withdrawals open, as White House Market would do a year later. Empire did neither. Vendors reported being unable to pull funds from 22 August onward, even through private links, and a head moderator known as "Se7en" confirmed on Dread only that the site was down. There was no signed word from the operators, and that silence was the answer.

The DDoS smokescreen

The genius of Empire's exit was that its cover story was true. The market had been pounded by extortion-driven DDoS attacks since 2018, and insiders said the operators were quietly paying an attacker known as "Gustav" between $10,000 and $15,000 a week to keep the site online. So when service degraded in its final weeks, "it's the DDoS again" was an entirely plausible explanation, the kind users had heard and accepted many times before.

That plausibility is exactly what made it a smokescreen. A real, recurring problem is the perfect alibi for a deliberate drain, because it explains away the slow withdrawals and patchy uptime that always precede a cash-out, and it buys the operators time while users assume the outage is temporary. By the moment people connected the stalled withdrawals to something worse than an attack, the admins were already gone. Whether the final DDoS was genuine or staged barely matters; the lesson is that a market blaming an attack for your stuck funds is rarely the victim it claims to be.

The exit-scam playbook to memorize

Empire's collapse has a rhythm worth committing to memory, because it recurs almost identically across exit scams: withdrawals slow, support goes quiet on forums like Dread, and a technical excuse, usually a DDoS, papers over the gap. When those three appear together, the safe assumption is an exit in progress, not a glitch. The community read it correctly here within days, even as moderators debated the details, and the "exit scammed" verdict stuck.

The gallows humor in the community said it all: users joked about being "so excited to lose more money" even as they refreshed dead links, because they had seen the pattern before and knew where it led. That dark fluency is the point. Empire is the case to study precisely so you can recognize an exit scam while it is happening rather than after your coins are gone, the same rhythm later replayed almost beat for beat by Abacus in 2025. Read our guide to spotting exit scams for the warning signs in detail.

Who ran Empire, and how they were caught

For years Empire's operators were anonymous, and the story seemed to end at the vanishing. It did not. In 2024, US prosecutors in Chicago unsealed charges naming two Americans, Thomas Pavey, known as "Dopenugget," and Raheim Hamilton, known as "Sydney" and "Zero Angel." The pair had a telling history: before Empire, they had sold counterfeit US currency on AlphaBay, and after that market fell in 2017 they built their own, running Empire from its February 2018 launch to its 2020 disappearance.

The scale the indictment revealed dwarfed the exit-scam headline: over its life Empire facilitated more than $430 million across some four million transactions, including roughly $375 million in drug sales, plus counterfeit currency, stolen card data, and malware. Hamilton pleaded guilty to a drug-conspiracy charge; Pavey agreed to forfeit around 1,584 bitcoin along with gold bars, cars, and Florida properties; and investigators seized roughly $75 million in cryptocurrency, cash, and precious metals. The coins that vanished in 2020 left a trail on the blockchain that, four years later, helped put names to the crown.

Is there a working Empire Market link?

No. Empire Market disappeared in August 2020 and has not returned, and with its operators now charged in the US, it never will. There is no genuine Empire address. Any "Empire Market link," "Empire URL," or mirror circulating today is a phishing clone built on the brand to do exactly what the original did on its way out, take your money, except a clone does it the moment you log in.

Treat every Empire address as hostile, enter nothing, and send nothing. A market that exit-scammed its users is the last name that deserves a second visit, and a familiar crown logo is bait, not reassurance. If you need a market that genuinely operates, verify a live one yourself with its current PGP-signed canary and start from the alternatives below.

Empire Market alternatives in 2026

Since Empire is gone, the only sensible move is a market you can actually verify. The ones operating now are tracked in tordark's verified darknet market directory, where general-purpose options like Nexus and TorZon cover the broad catalogue Empire did, each shown beside the signed canary that confirms its address.

Empire's specific lesson should shape how you use any of them. It accepted Bitcoin, Litecoin, and Monero and leaned on tumblers to hide funds, yet the chain still helped unmask its operators; the markets that take privacy furthest now settle in Monero only, with DrugHub and DarkMatter reported to refuse Bitcoin outright. Above all, behave as if any market could pull an Empire tomorrow: confirm the address against a signed canary, and never leave more in escrow than a live order needs.

What Empire teaches

Empire proves that popularity and uptime protect no one: it looked entirely normal until the day it did not, the same way the police-run Hansa had looked normal in 2017. The defense is behavioral and early, move money out promptly, distrust the DDoS excuse, and never leave more in escrow than a live trade needs, because once withdrawals stall the funds are usually already gone. And the 2024 charges add a second, slower lesson: the blockchain that the operators tried to launder their way across is patient, and a vanishing is not the same as an escape. Compare the near-identical 2025 collapse in the Abacus case study, learn the signals in our exit-scam guide, and read everything in today's directory with this disappearance in mind.

Common questions about Empire Market