Kingdom Market: Seized Across Five Countries

A market on Tor and I2P

Kingdom Market launched in March 2021 as an English-language marketplace with international reach, and it leaned into resilience from the start. Unusually, it was reachable on both the Tor network and I2P (the Invisible Internet Project), a second anonymity network meant to keep it accessible if one were blocked or attacked. It focused on drugs but also brokered malware, criminal services, stolen personal data, and forged documents, from passports to driver's licenses.

Its payment menu was broad and privacy-conscious: buyers could pay in Bitcoin, Litecoin, Monero, and Zcash, and the operators took a 3% commission, charging vendors a €500 bond to start selling. By late 2023 the market carried more than 42,000 listings, around 3,600 of them from Germany, with tens of thousands of customer accounts and several hundred sellers. On paper it was a mid-to-large, well-defended operation. On the server, it was one config file away from disaster.

The leak that doomed Kingdom Market

The decisive failure had nothing to do with Tor or I2P. Kingdom's backend leaked its true clearnet IP address through misconfigured HTTP server headers, the precise kind of mistake that follows from copying a default setup, in this case the default nginx configuration that an Eckmar-style "how to build a market" guide hands new operators. Once that address was exposed, the physical server could be located directly, and every layer of anonymity above it became beside the point.

What makes Kingdom a cautionary tale rather than bad luck is that the community saw it coming. Dread users had flagged the IP leak roughly six months before the takedown, with the forum's administrator posting a public warning after another user verified that the leaked address really belonged to the market. There were other tells, too: the admins once emailed a directory from a plain Gmail address, and quoted text revealed their computer was configured in French. The warnings were there in public, and the market kept trading on a server whose location was effectively already blown.

Why running on two networks did not save it

Kingdom's dual-network design conflated two different properties: reachability and survivability. Running on both Tor and I2P made the market harder to block or knock offline, a hedge against denial-of-service pressure and network outages. But being blocked was never the threat that ends these markets. The threat is being located, and that is a question about the server, not the overlay network carrying traffic to it.

So the redundancy answered a question law enforcement was not really asking. No matter how many anonymity networks front a service, they all ultimately point at a machine somewhere, and the moment that machine's address leaks, every one of those networks is bypassed at once. Kingdom had two front doors and left a window open. Its decisive vulnerability was operational, a configuration error, and no amount of network hardening compensates for a server that announces where it lives.

The multinational takedown

The seizure landed on 16 December 2023. Germany's BKA and the Frankfurt cybercrime prosecutor (ZIT) led the operation and took down the market's server infrastructure, which was distributed across several countries. They did not do it alone: the investigation drew in law-enforcement partners from the United States, Switzerland, Moldova, and Ukraine, five jurisdictions cooperating against a single market.

That lineup of agencies, visible right down to the seals on the seizure banner, is now the standard shape of a darknet takedown rather than anything exceptional. A German core paired with international partners had already closed Hydra in 2022 and would later end Nemesis and Archetyp. For an operator, the practical meaning is stark: you are not hiding from one national police force but from a standing coalition that shares servers, subpoenas, and forensic analysis across borders.

Fallen Kingdom: when police hold the keys

The takedown came with a flourish that doubles as the sharpest lesson on this page. After seizing the market, German authorities rebranded its banner "Fallen Kingdom", and then used Kingdom's own PGP private key to send cryptographically signed messages to its users on the forum Dread, including word that the alleged admin had been arrested.

Sit with what that means. A PGP signature is supposed to prove a message genuinely comes from the market's operators, the exact check tordark urges on every page. But a signature only proves control of the private key, and once police seize that key, they can sign as the market with perfect authenticity. The lesson is not that verification is pointless; it is that a signature proves who holds the key, not that the holder is friendly. It is a reason to keep keys out of a market's reach where you can, and a reminder that the safest assumption after any seizure is that the operators' identity has been fully compromised.

The man behind "KingdomOfficial"

Unlike the Russian and Iranian operators elsewhere in this archive, Kingdom's alleged administrator was within reach of Western law. US authorities charged Alan Bill, a 30-year-old Slovakian known online as "Vend0r" and "KingdomOfficial," who had also moderated the market's presence on Reddit. He was arrested on 15 December 2023 at Newark Liberty International Airport by the FBI and Homeland Security Investigations, a day before the public seizure.

A grand jury in Missouri indicted him on ten felony counts, including conspiracy to distribute controlled substances, identity theft, misuse of a passport, and money-laundering conspiracy; undercover investigators had bought methamphetamine, fentanyl pills, stolen personal data, and even a US passport through the market to build the case. Bill was later sentenced to years in US federal prison. His arrest is the part of the story the leaked IP made possible: find the server, and the human behind it is usually not far away.

Is there a Kingdom Market link?

No. Kingdom Market was seized on 16 December 2023, its Tor and I2P sites and clearnet mirrors replaced with the Fallen Kingdom banner, and it has not returned. There is no genuine Kingdom address on any network. Any "Kingdom Market link," "Kingdom onion," or I2P address you find today is a phishing clone built on the name to harvest logins and coins.

Kingdom carries an extra warning the others do not. Because police demonstrably held its signing key and were willing to sign messages as the market, you cannot even trust a "signed" Kingdom communication after the seizure. Treat every Kingdom address and message as hostile, enter nothing, and verify a live, operating market yourself with its own current PGP-signed canary instead.

Kingdom Market alternatives in 2026

Since Kingdom is gone, the practical question is where to trade with the least exposure now. The markets actually operating are tracked in tordark's verified darknet market directory, where general-purpose options like Nexus and TorZon cover the broad catalogue Kingdom did. Do not be reassured by a market advertising multiple networks or several coins, as Kingdom shows, those features address blocking, not the operational failures that actually get markets seized.

If privacy was your reason for Kingdom's Monero and Zcash support, the markets that take it furthest now settle in Monero only; DrugHub and DarkMatter are reported to refuse Bitcoin outright. Whatever you weigh, confirm the current address against a signed canary and keep nothing in escrow beyond an open trade.

What Kingdom Market teaches

Kingdom's lesson is that resilience features answer the wrong threat. Two anonymity networks and four cryptocurrencies make a market harder to block, but blocking is not what ends these operations, a leaked server address is, and that comes down to operational security an ordinary user can never see or verify. If a five-country coalition can seize a two-network market off a single misconfigured header, no amount of technical hardening makes a market a safe place to store funds. Add the Fallen Kingdom twist, police signing as the operators with the seized key, and the conclusion is humbling: you cannot audit a market's server hygiene, and you cannot always trust its signature after the fact. See the surrounding German-led cases across the archive, understand why uptime proves nothing in our guide to market scams, and verify anything in today's directory on every visit.

Common questions about Kingdom Market