Versus Darknet Marketplace Closes Due to Security Flaw
The operators of the popular English-language darknet marketplace Versus, which launched about three years ago, have announced its closure after discovering a serious bug that could have exposed its database and revealed the IP addresses of its servers. According to Bleeping Computer, darknet marketplaces (and their users) are always extremely protective of information about their physical infrastructure, as exposure could lead to operators being identified and arrested. After finding several vulnerabilities, the Versus team decided to shut down the marketplace, believing it was too risky to continue operations.
Security Issues and Community Concerns
The problems began last week when information about poor security on the marketplace was posted on Dread, including a proof-of-concept exploit for Versus and details on how to access the site’s server file system. Following this, Versus went offline for a security audit. The site’s operators stated that they had already conducted two previous audits after suspicions of serious issues and even real hacks. This time, after going offline, users grew concerned that the Versus team might be attempting an exit scam or that the FBI had already seized the site. However, the operators soon returned with an official announcement, confirming the closure of Versus.
Official Statement from Versus Operators
“We understand that in recent days there has been a lot of concern and uncertainty regarding Versus. Most of you rightly assumed that our silence was because we were quietly assessing the reality of a possible vulnerability.
After thorough investigation, we discovered a vulnerability that allowed (read-only) access to a six-month-old copy of our database, as well as a potential leak of the IP address of one server we had used for less than 30 days.
We take any vulnerabilities very seriously and feel it’s important to address the concerns raised. Most importantly: there was no server breach, and users/vendors have nothing to worry about as long as they use standard and basic opsec methods (such as PGP encryption).
Once we found the vulnerability, we faced a choice: recover and come back stronger (as we have done before) or gracefully step away. After much thought, we chose the latter. We built Versus from scratch and have operated for three years.”
Next Steps for Vendors
The announcement ends with a notice to vendors, promising to soon provide a link to complete transactions and withdraw any remaining funds on deposit.