Cyber Incident Victim: Solaris
Date:
Jan 2022
Location:
Finland
Summary
A large darknet marketplace specializing in illegal substances was hijacked by a competitor known as Kraken, which exploited critical vulnerabilities in the victim's code to compromise its infrastructure. The attackers gained access to stored cleartext credentials, cryptographic keys, and internal systems, subsequently redirecting the marketplace's Tor site to their own platform and disabling its Bitcoin payment server to halt transactions. This takeover resulted in the complete loss of operational control for the affected service, including its source code repositories and financial capabilities, while transferring a significant portion of its user base to the rival platform. The incident was motivated by competitive market interests rather than political objectives, leveraging the breach to absorb customers and undermine trust in the compromised marketplace.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The Solaris darknet marketplace, specializing in illegal drugs and substances, was hijacked by a competitor named Kraken on or around January 13, 2023. Kraken executed a hostile takeover by exploiting critical vulnerabilities in Solaris’ infrastructure, redirecting Solaris’ Tor site to Kraken’s platform. Blockchain analysts at Elliptic confirmed no cryptocurrency transactions from Solaris’ wallets after January 13, indicating a disruption of financial operations coinciding with the attack. Kraken publicly claimed responsibility, stating they had identified severe flaws in Solaris’ codebase, which allowed them to compromise servers hosted in Finland over a three-day period. During this time, attackers exfiltrated cleartext passwords, cryptographic keys, project source code, and GitLab repositories. Kraken also disabled Solaris’ Bitcoin payment server, effectively halting all transactional activity on the platform.
Solaris had emerged months earlier following the seizure of Hydra, another major darknet market, rapidly capturing approximately 25% of the illicit market share with an estimated $150 million in sales. Resecurity reported Solaris gained 60,000 new user registrations post-Hydra, dwarfing Kraken’s growth of roughly 6,000 users. The hijacking redirected Solaris’ user base to Kraken, consolidating market influence and undermining confidence in Solaris’ security. Kraken’s operators, described as pro-Kremlin but motivated by commercial interests rather than politics, framed the attack as a strategic acquisition to absorb a rival’s infrastructure and customers. The incident left Solaris inoperable, with its infrastructure and data fully compromised, while Kraken leveraged the breach to expand its operational footprint and user traffic. No law enforcement or third-party response actions were documented in the available reporting.