German police takes down Kingdom Market cybercrime marketplace

The Federal Criminal Police Office in Germany (BKA) and the internet-crime combating unit of Frankfurt (ZIT) have announced the seizure of Kingdom Market, a dark web marketplace for drugs, cybercrime tools, and fake government IDs.

The law enforcement operation also included authorities from the United States, Switzerland, Moldova, and Ukraine, while one of the administrators has been arrested in the US.

Kingdom Market was an English-speaking marketplace on the dark web with international reach that has operated since March 2021. Platform members sold drugs, malware, cybercrime services, stolen personal information, and forged documents, and paid in cryptocurrencies such as Bitcoin, Litecoin, Monero, and Zcash.

According to a BKA press release, the marketplace hosted 42,000 items for sale, 3,600 of which were from Germany. The authorities mention that Kingdom Market had tens of thousands of customer accounts and several hundred registered sellers.

BKA's press release concludes that investigations to identify the people who operated the illegal market are underway, now also aided by analysis of the seized server infrastructure.

So far, one arrest has been confirmed, that of Alan Bill, aka "Vend0r" or "KingdomOfficial," a Slovakian who allegedly held an administrator role on the darknet platform and acted as a moderator for the market on Reddit.

US court documents state that Alan Bill was arrested on December 15, 2023, with the US government unsealing the complaint against the suspect yesterday.

Community response

On Dread, a Reddit-like darknet forum, users claiming to be members of the now-seized platform mourn the money lost, which they had deposited on Kingdom Market's escrow for future purchases.

Moreover, Dread staff mentions unofficial information about the arrest of multiple individuals who had access to the market's server infrastructure.

A message sent by the German authorities using the market's official PGP key to registered members initially raised suspicion in the community, with many calling out the operators for exit scamming.

However, BKA's official announcement today about the seizure confirmed that it was a law enforcement operation.

With Kingdom Market offline and the chances of its return being slim, other market operators have already taken to Dread to invite sellers to join their platforms.

Using KELA's threat intelligence tools, BleepingComputer has found two invitations from the Drughub and Cypher markets to "Kingdom refugees," which are excellent examples of how competitors quickly take advantage of such incidents.