Skip to main content
  1. Posts/

Icarus Market Exit Scam - A Chronology of Events

·6 mins
Ixonae
Dark Markets Cyber Crime
Ixonae
Author
Ixonae

Only a couple of weeks after Empire Market exit scammed, Icarus follows its steps in a somewhat similar way, and we can hear claims of FBI involvement. Let’s look at the chronology of events.

On September 9th, the market became unavailable. Shortly after that, LaRouge, the main moderator communicated on Dread that the market was ongoing unexpected maintenance and would be back online within a couple of hours. A couple of hours later, we learned that the maintenance was due to server migration. Until then, nothing is impossible. One could have assumed that they had a single point of failure and that this server failed.

LaRouge announces an unexpected maintenance
LaRouge shares the maintenance reason

A little later, on September 11th, Mitsuki12, one moderator explained that the migration was due to traffic increase. This explanation would have made sense right after Empire’s exit scam, but the growth of new users to other significant markets was somehow stable, so we can assume that if Icarus’s servers were insufficient for the traffic, this wouldn’t have been something unexpected by then.

Mitsuki12 says the server migration is due to the traffic increase

On September 12th, three days after the first announcement, Mitsuki12 posted that, without any news from higher-ranked people, and if things were not back online, he would publish what he thought happened to the market. The post suggested that he had no news from the admin for an extended time period (“being in the dark is not my kind of thing”).

Mitsuki12 promised update on Icarus

He promised to post the update the next day at 8 pm CET, which he did. The post (deleted since) stated that in his opinion, the market was gone, and added some message to the staff that seemed a bit threatening, even if the message was not very explicit.

At the same time, he changed the description of the market on the Dread sub, and replaced the URL with “(not anymore)”.

A not-so-friendly update on Icarus by Mitsuki12

Later, he was removed from the moderators’ list on Dread’s thread and claims that it was done by the other member of the staff on the 14 September around 13:00. Note that as of today, the “(not anymore)” URL did not change. So if another member of the team really removed him from the mods, it seems that he agrees with this analysis.

Mitsuki12 claims he’s been deleted from moderators list

Since then, there doesn’t seem to be any activity from the staff. The last post by LaRouge was on September 15 at 21:12, the IcarusMarket admin account has no posts since the beginning of the events, and neither does Azaeel’s (the other moderator).

The other people involved are quiet these days, but that is not the case for Mitsuki12 who continued posting various things on Dread after this. While I consider that some things he claims are not impossible, a good part of it sounds like straight BS.

The 15 September at 11:25, he made a post(1) (the first visible) on /IcarusMarket (the original one was just /Icarus). Now, he threatens the admins to go after them thanks to his old team in the private sector, and their contacts with Law Enforcement Agencies, but he gives them until the 22 at 8 pm CET “to decide”. What it means is not clear, and he replied in the thread that what he wants is “confidential, at least for now”.

Update about Icarus on the new sub

Interestingly, he doesn’t seem to consider this to be blackmail or extortion. I guess the definition of words changes a lot from one person to another.

Mistsuki2 claims his post is no blackmail

Another piece of interesting information that you would have caught is that he claims the FBI found the servers, which caused the admins to run away. The FBI would have been able to track down the server because of the admins bad OpSec (no details provided).

Apparently, without that, there would have been no exit scam. Even though Misuki12 claims that, as he was the last in the chain of command, he wouldn’t have known.

Comments on the Icarus Market Update Thread
Comments on the Icarus Market Update Thread

I believe that what the ex-moderator is saying must be heard with care, but all the elements are showing that this is an exit scam, so he is definitely right on that.

As for the FBI claim, is not impossible that they would have found the server, but if they did, things don’t seem right (I’m not a LE expert, so I might make some wrong assumptions):

  • The ex-mod says the FBI found the servers (not seized them), and that as a consequence, admins shut everything down. I would not bet on the probability that the admin was aware of that without a seizure. Also, if they did find the server, why didn’t they try to overtake it, or at least tap it?
  • If they seized the server, there should have been some announcements somewhere, or maybe some arrests, but nothing was announced.
  • If admins had that bad of an OpSec, it seems hard to believe the FBI couldn’t track them down once they found the servers.

Furthermore, in my opinion, the whole claim about Mistsuki being related to private companies working with LE is a complete fantasy. If it was really the case, he would be totally stupid to say that publicly, and I don’t see people at a reputable company helping him with some personal vendetta (although an anonymous tip is a possibility). Also, he claims he’s an analyst, but the whole training of an AI model does not make sense. You don’t train an AI with a ridiculously small amount of data.

As for his claims that most of Empire’s vendors went to Icarus without overthinking, it is just unfounded. From the monitoring I started on August 25th on Dark and WhiteHouse Market, both gained respectively 6.07% and 10.76% new vendors in a two weeks period.

Finally, regarding the claims that there were plans for the future of the market, I would say this is believable as, as the following screenshots show, the staff recently made a significant number of updates.These updates include upgrading to the V3 of onions services. V2 services will still be able to run until the second half of next year, so there would have been no point for them to do this upgrade if they were planning an immediate exit.Some researchers have been saying for a while that this market will exit. One possibility is that it was on their plan for the middle-term future, but that the influx of funds caused by old Empire’s customers was enough money for their liking.

Icarus latest update a few days before the exit scam
Icarus hidden service V3 upgrade announcement

With a bit of patience, we will know if the FBI story is true, but in my opinion, Mitsuki12 is just hurt he wasn’t part of the plan (or just didn’t realize what the plan was), and he would like a slice of the cake or a bit of attention. I don’t think anything will happen on the 22nd, but let’s wait and see.


Notes:

(1): An error was present in this phrase. I told before that the thread was created by Mistsuki12, while it was created by Azaeel. The thread was apparently used in private when the market was still functional to test various writing techniques in order to gather more vendors and buyers.