Historical Darknet Markets: Agora

Agora is a rare example of a darknet market done well, nestled between the original Silk Road and the Wall Street Market. It launched on December 3, 2013, soon after the shutdown of two of the largest darknet markets at the time: Sheep Marketplace (closed December 1st) and Black Market Reloaded (closed Dec 2nd). Though not without the drama and upheaval that any darknet market may expect, Agora was a very smooth and upstanding operation, and the largest market in operation for long of its lifetime. On September 6, 2015, it made a dignified goodbye.

Agora was created with the goal of correcting Silk Road’s failings, particularly in terms of OpSec for its users and administrators. Almost nothing is known about Agora’s architects or administration, except that they recognized the value of good business in establishing reputations in the industry of anonymous online markets. They were also good custodians of funds, rising to the top of the darknet market when Silk Road 2 was hacked, resulting in the loss of 40% of user funds, and then again the following year after the exit scam of Evolution, formerly the largest market at the time.

Silk Road 2, Dream Market, Evolution, Outlaw Market, and Nucleus were among Agora’s contemporaries and main competitors. Agora performed more business than any of its predecessors, with the exception of Dream, which lasted much longer than any other market: an estimated $220.7 million across 630,000 transactions throughout the course of its history. This corresponds to an average of $10.5 million in monthly sales, making it a massively successful darknet market operation by any measure.

To put things in perspective, the original AlphaBay – widely regarded as the most successful darknet market after Hydra – generated an average of $11 million in sales per month over the course of its existence, outperforming Agora by only $500,000 per month. Agora achieved all of its success through the employment of a custom codebase and design that were neither intuitive nor user-friendly, but what it lacked in aesthetics it made up for in trustworthiness and competency.

The market had roughly 7,400 listings after five months of operation, significantly more than its nearest competitor, Silk Road 2. By September 2014, less than a year after its launch, it had surpassed the size and volume of the old Silk Road, with over 16,000 listings. When the decision was made to close shop, Agora did it the proper way, providing its members two weeks’ notice and allowing them to withdraw their funds from the market.

Bitcoin Fog

Agora was first advertised on Bitcoin Fog, a Bitcoin mixing service, and the two businesses eventually formed a collaboration, with Bitcoin Fog serving as Agora’s official mixer. Bitcoin Fog collaborated with other darknet markets like as Silk Road, SR2, Evolution, and AlphaBay. The mixer lasted around nine and a half years before its owner, Roman Sterlingov, was arrested while traveling to the United States. Investigators had apparently been following his internet activities for several years and had been waiting for him to visit the nation.

Sterlingov, a Russian and Swedish citizen, first launched his mixing service on Satoshi Nakamoto’s Bitcoin Forum in October 2011 as Akemashite Omedetou. The site was constantly monitored by authorities since it was known to have received coins from darknet market drug dealings and numerous hackers. Authorities were able to connect Sterlingov to the site through bitcoins he paid to it through a MtGOX account under his own name. Sterlingov, according to court records, conducted “a series of minor value transactions” to Bitcoin Fog in October 2011 in order to “beta-test (the) new software” ahead to its introduction, which led to his identification and capture.

Overall, it is estimated that Bitcoin Fog mingled about 1.2 million bitcoins, or $335.8 million based on the price of BTC at the time the coins were delivered through the service. Sterlingov is thought to have made roughly $8 million by imposing a 2% fee on each transaction (plus tips and gifts) — many of which went to or came from Agora. Prosecutors claim Sterlingov posted the following remark on Bitcoin Fog in anticipation of the debut of Agora:

“The marketplace is run by partners we trust completely, both in terms of not being a honeypot (if they were, we’d be in jail).”

Though Bitcoin Fog was frequently accused of theft or loss, it lasted as long as it did because it was, for the most part, an honest operation, founded and maintained by one of the first people to grasp the need of severing blockchain linkages when dealing BTC on darknet markets.

The Unknown Darknet Shopper

The Random Darknet Shopper was a “live mail art installation” created by Swiss artists Carmen Weisskopf and Domagoj Smoljo that consisted of an internet shopping bot that randomly purchased products from Agora that were advertised for $100 in BTC or less. Between October 2014 and January 2015, the bot acquired 12 different things from the marketplace, including a pair of Nike sneakers, a baseball cap with a hidden camera, a fake Sprite can used to house drug stashes, a fake Louis Vuitton handbag, and 10 real Ecstasy pills.

The pills, which were marketed as carrying 120 mg of pure Ecstasy, were eventually analyzed and confirmed to contain 90 mg of MDMA, after which they were destroyed by law authorities. They were presented briefly as part of an exhibit as part of an art installation before being confiscated. In a December 2014 interview with The Guardian, artist Smoljo responded, “We are the legal owner of the drugs – we are accountable for anything the bot does, as we executed the code.” “However, according to our counsel and the Swiss constitution, art in the public interest is allowed to be free,” he continued.

View from the show gallery with Agora-purchased artifacts. !MEDIENGRUPPE BITNIK is the source.

With the exception of one handbag, all 12 purchases made by the bot arrived more-or-less as described, and the artists were repaid their BTC. As a result, the artists described Agora’s service as “amazing.” After Agora shut down in September 2015, the bot moved to AlphaBay, where it continued to make purchases until February 2016. The front page of the art project includes images of the majority of the things acquired at the two marketplaces as well as their packaging. When asked why the art piece was produced, co-artist Weisskopf had the following reaction.

“The arts should be able to reflect what is going on in modern society in a contemporary way… We genuinely want to provide new venues for people to think about the items sold on these markets. Why are they being traded? “How do we cope with these areas as a society?”

Evolution Exit Scams

For long of its existence, Agora was overshadowed by Evolution, a flashier market that benefited from stronger promotion and a more proactive community. Verto, the mysterious man behind the famed Tor Carding Forum, started it in January 2014. Unlike Agora, which had a bespoke codebase that made the market’s design awkward in places, Evolution was built with Laravel, an open-source PHP framework that allowed for a more flexible structure and elegant interface. This made market navigating smooth and intuitive, contributing to its early appeal among buyers.

Outside of its appearance, Evolution was strikingly similar to Agora, with a wide range of listings for drugs, guns, and fraud-related commodities, while still prohibiting the sale of illicit pornography, Ponzi schemes, and assassination-type services. Evolution had a strong Reddit community where individuals freely discussed their experiences with sellers and the market itself, helping to generate buzz on the clearnet. Evolution also benefited from the fact that it loaded quickly on mobile devices, garnering it the distinction of being one of the first “mobile-friendly” darknet markets.

Great site design, regular uptime, and fantastic community building, on the other hand, proven to be non-indicators of market integrity, as these elements are not always reflective of a market’s admin’s goals. Evolution shut offline without warning or explanation on March 18, 2015. On the same day, the market’s subreddit was made private, making it inaccessible to everybody, forcing market attendees to face the terrible truth that they had been exit scammed. Verto had vanished, taking with him an estimated $12 million in BTC in escrow and user account balances.

The six months following Evolution’s exit were a period of significant volatility on the surviving darknet markets, which suffered from rising downtime and were unreachable. Some of this downtime was caused by administrators attempting to tighten security measures in their own markets, while others were caused by “denial of service” attempts. These attacks were typically intended to disrupt market operations in order to extort money from moderators or entice customers to join other markets. The wrath of such attackers did not spare Agora.

Weapon Sales Banned

One of the few negative characteristics of Agora is that it has resulted in more publicly-known arrests of weapons traffickers than any other darknet market. Sales of fatal weapons on darknet markets has existed since the original Silk Road, however they were never widely popular or thought to be a good idea by most vendors. Nonetheless, multiple gun and ammunition sales occurred on Agora during its first year and a half of operation, resulting in the arrest of dozens of sellers and customers from various nations.

In one of the most egregious cases of OpSec violation in dark web arms purchases, 48-year-old American Michael Focia was detained when undercover agents acquired a gun with his fingerprints on it from an Agora dealer known as RTBArms in October 2014. As a seller at Black Market Reloaded the previous year, Focia was accused of selling a.40 caliber handgun to undercover officers. Focia was discovered to have sold at least 32 firearms, shipping them as far away as Australia.

Agora dealer ‘weaponsguy’ allegedly mailed an imported weapon. Australian Federal Police (AFP)

Another intriguing incident involving an Agora-based arms dealer is that of weaponsguy, who is thought to be a US-based vendor whose account was surreptitiously taken over by law enforcement, who then utilized it to make undercover purchases to unsuspecting buyers. It is estimated that law enforcement made roughly 19 customer arrests in four nations that got weapons sent from weaponsguy.

The public exposure Agora received as a result of the recent run of weapons buyer arrests proved to be too much, and it was just not worth the bother to collect commissions from a rather limited category of purchases. On July 15, 2015, the Agora administrators posted the following message on the noweapons information page:

“Following our objective, we hope such artifacts could be purchased, but the current reality is that the format of a market like ours is not a good method to do so.” Weapons are difficult to ship, expensive, and encourage both fraud by dishonest vendors and honeypot ads by agencies looking for purchasers who may wish to obtain such weapons illegally from us. This has long been reflected in the volume and success rates of our listings in the firearms section.

At this point, continuing to list guns would be detrimental to our users.”

Agora Closes

Agora ceased trading in late August 2015, requesting that all market participants withdraw their bitcoin. Initially, market administrators raised security worries about a potential Tor vulnerability, worrying that their server locations would be deanonymized. Although the vulnerability was simply a theoretical issue at the time, it was determined that extensive software changes were required if the market was to remain operational. Admins later offered more information by sending a signed note explaining why they decided to take the market offline.

The remainder of the communication includes the following excerpt, which suggests that Agora intended to resume operations in the future, however this was not the case:

“At this time, because we don’t have a solution ready, it would be risky to keep our users utilizing the service because they would be in danger.” As a result, and much to our dismay, we have decided to take the market offline for the time being until we can develop a better alternative. This is the best option for all parties involved.

In the meantime (sic), we will try our best to settle all outstanding orders, and we urge all users who have money on their accounts to withdraw it as soon as possible, as we do not want to be held accountable for it during the time when the market will be offline.”

Agora followed through on their promise to allow consumers to withdraw their monies by taking the market down on September 6, 2015. Though the admin did include a new PGP key in their last mail to replace their current one, which was set to expire in November, they never used it to sign any communications, implying they had retired — at least under that name. As a result, it is unknown whether the Agora administrators ever resumed their work under the guise of another market.

Three competing markets benefited greatly from the demise of Agora, including Nucleus, Abraxas, and the most famous of them, AlphaBay, by taking in refugees eager to continue business elsewhere. Though larger darknet markets came and went in the years that followed, few (if any) matched Agora’s competency, professionalism, and dignity, which is warmly remembered by many in the community who were present at the time.

Timeline of Agora and Related Events

Oct 2, 2013 – Silk Road goes offline

Dec 2, 2013 – Black Market Reloaded hacked, goes offline

Dec 3, 2013 – Agora opens for business

Jan 14, 2014 – Evolution opens for business

May 2014 – Agora exceeds size of original Silk Road with over 16,000 listings

Nov 5-6, 2014 – Operation Onymous shuts down Silk Road 2, Cloud 9, and Hydra

Nov-Dec 2014 – Agora membership jumps 20%

Mar 18, 2015 – Evolution exit scams, Agora becomes #1 market

Jul 2015 – Agora sales peak at $25 million

Jul 15, 2015 – Agora bans sale of lethal weapons

Aug 2015 – Citing security concerns, Agora suspends trading, asks users to withdraw funds

Sep 6, 2015 – Agora closes

Leave a Reply