Cyber Incident Victim: Cannazon
Date:
Nov 2021
Location:
—
Summary
A dark web marketplace specializing in marijuana products permanently ceased operations following a debilitating distributed denial-of-service attack, with administrators citing mitigation efforts and denying allegations of fraudulent exit scams. Operational disruptions and partial outages heightened community suspicions, prompting an apology for lack of transparency while advising vendors on retrieving transaction data. The shutdown raised concerns about impersonator sites attempting to exploit former users, compounding existing risks associated with illicit platform participation including potential fraud, compromised personal data, and product safety hazards.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Cannazon, a prominent dark web marketplace specializing in marijuana products, experienced a significant distributed denial of service (DDoS) attack at the beginning of November 2021. The attack severely disrupted operations, prompting administrators to implement partial shutdowns and reduce order processing capacity to mitigate its effects. These measures generated uncertainty within the user community, fueling suspicions of an impending exit scam—a scenario where marketplace operators abscond with user funds. On November 23, 2021, administrators issued a signed message using the market’s PGP key, announcing their decision to permanently retire the platform and explicitly denying any intention to orchestrate an exit scam. The message acknowledged operational challenges caused by the DDoS attack and apologized for lacking transparency during the mitigation period, stating this approach was necessary to prevent opportunistic exit scams by vendors.
The administrators formally took Cannazon offline on November 29, 2021, marking the conclusion of its operations. In their final communication, they outlined a process for vendors to retrieve signed Bitcoin multisig transactions through an encrypted message scheduled for publication on the Dread forum later that week. The shutdown eliminated a major cannabis-focused dark web marketplace, creating a vacuum likely to be exploited by fraudulent actors impersonating the original site via cloned platforms on new Tor addresses. The incident underscored recurring vulnerabilities in dark web markets, including service instability from targeted attacks, trust erosion between users and operators, and the persistent risk of financial fraud despite security assurances. No law enforcement action or data breach was explicitly linked to the incident in available reporting.