English-language dark web marketplace Versus announces closure after hacking attack

Versus Market is one of the most popular English-language dark web marketplaces, one of the largest and one of the longest-running dark web marketplaces, with a history of over 3 years, and after World Market and Dark0de Market "exited the scam" and shut down one after another. Versus Market was upgraded to become one of the largest dark web marketplaces after the World Market and Dark0de Market were shut down.

When conducting criminal activities on the dark web, dark web marketplaces must hide their physical assets; otherwise, their operators risk being identified and arrested. The same applies to users and vendors, who need to remain anonymous when using dark web marketplaces. Any breach of trust to protect their information puts the platform at great risk.

Launched three years ago, the Versus dark web marketplace is very popular among the cybercrime community, offering drugs, coin mixing, hacking services, stolen payment cards and the buying and selling of compromised databases. After discovering a serious vulnerability that could have allowed access to its database and exposed the IP addresses of its servers, the administrators of Versus Marketplace chose to shut down the site.

Versus Marketplace Hacked

Shortly after the Versus Marketplace administrators announced that the Versus Dark Web Marketplace was in invite mode, the Versus Marketplace was completely hacked. This means that the dark web marketplace "has been completely taken over. Databases, files, cryptocurrency wallets, real IPs, etc. were exposed."

The low security of the marketplace was exposed last week when a hacker leaked a PoC on the dark web forum Dread about how to access the Versus Marketplace web server file system.

The hack was first verified by DeSnake, the administrator of the AlphaBay marketplace, who said the hack was so thorough that the Versus marketplace administrator did not have a chance to fix the problem and implied that the Versus marketplace could go offline at any time due to an exit scam.

Paris, the administrator of the Dread forum, also confirmed the hack, saying that the hack was indeed real and that the vulnerability had been on the Versus servers for almost 3 years, meaning that there was little chance that it would not be used by LE (law enforcement) and that the marketplace should not be used from that point on.

It is recommended in the Dread forum that due to the most extreme security vulnerability that Versus marketplaces have had in the last few years, it is highly recommended to stop using Versus marketplaces and continue using other top dark web marketplaces that do not have such security vulnerabilities, such as AlphaBay, ASAP, Abacus and other dark web marketplaces.

After suspicions of serious flaws or even actual hacking, Versus Marketplace went offline for a security audit, as the site says it has done twice before.

After going offline, users began to worry that Versus Marketplace was running an exit scam, or that the FBI had taken over the site, and the various assumptions that typically accompany these sudden moves.

Versus Marketplace administrators announce they are shutting down the marketplace

Hours after the hack of the Versus Marketplace was announced, its administrators took the marketplace offline. the administrators of the Versus Marketplace have remained silent, not announcing anything about why the marketplace was shut down or when it would come back online.

A few days later, also on the dark web forum Dread, a post with a similar title to the one that Versus Marketplace's administrators had announced a few weeks earlier that Versus Marketplace was invite-only, in a thread titled "Well …… that's it folks! " in the thread. The admin posted that he had taken the marketplace offline to check on the hack.

The marketplace administrator claimed that the hack was on a read-only copy of the marketplace status from 6 months ago and that there may have been an IP leak of a server he used last month.

Faced with these findings, the administrator said he had two choices - either fix the problem and continue to operate the marketplace, or shut it down. He chose to close the marketplace. Vendors will get a working link to get their money back without having to wait 90 days for an automatic refund.

The main management of the Versus Marketplace with posted the following post containing the PGP signature.

Dear Community,

There is no doubt that there has been a lot of concern and uncertainty regarding Versus in the last few days. Most of you that have come to know us have rightfully assumed that our silence has been spent working behind the scenes to evaluate the reality of the proposed vulnerability. After an in-depth assessment, we did identify a vulnerability which allowed read-only access to a 6+ month old copy of the database as well as a potential ip leak of a single server we used for less than 30 days. We take any and every vulnerability extremely seriously but we do think that its important to contend a number of the claims that were made about us. Specifically of importance: there was no server pwn and users/vendors have nothing to worry about as long as standard and basic opsec practices have been utilized (for example, PGP encryption)
In many ways, we are glad to see the community coming together to improve everyone's security, this was our dream from the beginning with Versus, though we will say that there was a clear agenda behind the way this was originally handled, but we leave you to draw your own conclusions
Once we identified the vulnerability, we were posed with a fork in the road, to rebuild and come back stronger (as we had done before) or to gracefully retire. After much consideration, we have decided on the latter. We built Versus from scratch and ran for 3 years. We built a community and even became the #1 DNM when we never intended for that to be the goal. At a certain point, there is no further way up to go, only down, and in this business it is best to not make decisions out of pride. While we are not ending on the note that we would have liked, we hope that the truth about the actual scope of the vulnerability, combined with the impact we have had on the community, leaves users remembering Versus fondly for years to come. Versus Market has officially retired and we thank you for your support and being part of something that hopefully defined the future of DNM's.

For all our vendor:
We will soon publish a link where you guys can get your transactions without the locktime. No need to wait 90 days.
It was a good run and I would like to thank you all.

All the best,
William Gibson

Versus Marketplace has been hacked several times and it is not possible to confirm whether it is in the hands of law enforcement

The Versus Marketplace was once accessed on the dark web at http://pqqmrifxej23sb5h4brmelbe25mpthkxabqfhte5jy3wijfllaktylqd.onion/

The Versus Marketplace was exposed in March 2020 for an IP leak and suffered a massive bitcoin theft from users' wallets in July 2020. In both cases, the platform took the blame and was completely transparent about what happened.

This allowed Versus to move forward and become a massive marketplace in terms of user numbers and transaction volumes. However, the management of the marketplace with probably realize that the risk of exposure is too great to continue.

Whether law enforcement has exploited the existing vulnerabilities remains to be seen in the coming weeks/months.

As far as "ODN" is aware, with the disappearance of the Versus marketplace, the relaunched AlphaBay marketplace is now officially the largest dark web marketplace in the world once again.