Monero-enabled XMR/USD AlphaBay is purportedly the world’s top dark web marketplace. But it follows a quirky rule: Russia, Belarus, Kazakhstan, Armenia, and all “Kyrgyzstan-related activity” are excluded.
Why The Exclusion: An AlphaBay staff, who chose to remain anonymous under the pseudonym of DeSnake, told Benzinga that the exclusionary rule is unrelated to the sanctions recently imposed on Russia and its allied countries over the recent invasion of Ukraine.
“The reasons for not including those countries as operations are pretty simple. There is a golden rule: you do not s*it where you sleep,” the staff member said.
DeSnake said the team behind AlphaBay is based in a member state of the Commonwealth of Independent States (CIS), formed after the dissolution of the Soviet Union in 1991, and looked to avoid any criminal offense under intertwined laws in the regional intergovernmental organization.
CIS comprises Russia and former Soviet nations such as Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, and Uzbekistan.
‘Common Strategy:’ DeSnake pointed out that this strategy “is common for people of the trade” and said that there is evidence of this practice “dating back many many years ago by other forums, chat rooms, (malware) groups” and other criminal organizations.
As cybersecurity firm Malwarebytes points out in a 2021 article, “ransomware really, really doesn’t want to run in Russia or members of the CIS, and it never has.”
None of the top ransomware studied by Malwarebytes runs in CIS countries, despite actively operating in the rest of the world when the research was being conducted.
If ransomware runs in a CIS-linked organization by mistake, the team often apologizes and hands the decryption keys over for free. In one such example, a representative of ransomware group Avaddon apologized to a victim company and offered to fix its systems after finding out it had a branch in Armenia.
Other Risks: As explained by Malwarebytes, Russia has no extradition treaty with the United States, meaning that Russian cybercriminals have little to fear as long as they do not commit crimes in CIS countries.
DeSnake admitted that users might leverage the anonymity of the dark web and Monero to skirt the restriction, but the vendor would risk losing his deposit if he is discovered and banned.
The employee also said AlphaBay would not assist with such transactions, which means there would be no dispute resolution service.