Feds get second guilty plea in takedown of dark web Empire Market

Both men charged with co-creating the dark web marketplace Empire Market have now pleaded guilty to federal drug conspiracy charges.

Raheim Hamilton, 30, of Suffolk, Virginia, entered his guilty plea in a Chicago federal court this week, closing the book on one of the major cybercrime cases of the early 2020s. Prosecutors said the market was responsible for $430 million in transactions involving illicit goods such as heroin, methamphetamine, cocaine, counterfeit currency and stolen credit card information.

Hamilton ran the marketplace from 2018 to 2020 with Thomas Pavey, 40, of Ormond Beach, Florida, prosecutors said. They were both charged in 2024 with a variety of offenses that could have led to life sentences in prison. Pavey pleaded guilty in January 2025 to similar drug charges. They each face a maximum 10-year sentence.

“Hamilton admitted in a plea agreement that he and Pavey designed Empire Market to help its users avoid detection by law enforcement and to assist users with laundering money from the illicit transactions,” prosecutors said.

Hamilton will be sentenced in June. A sentencing date has not been set for Pavey.

The market was one of the largest of its kind, with more than 1.6 million unique registered users and 4 million separate transactions, prosecutors said, with drug sales being the most prevalent activity.

Empire Market suddenly disappeared in the summer of 2020, with operators stealing an estimated $30 million in bitcoin from users.

As part of his plea deal, Hamilton agreed to forfeit approximately 1,230 bitcoin (worth about $108 million) and 24.4 Ether coins (about $71,000), as well as three properties in Virginia. Previously Pavey agreed to forfeit approximately 1,584 bitcoin (about $139 million), two boxes containing 25-ounce gold bars, three automobiles and two properties in Florida, prosecutors said.

Empire Market arose after the takedown of the notorious AlphaBay market in 2017, with Hamilton (aka  “Sydney” and “ZeroAngel”) and Pavey (aka “Dopenugget”) modeling their site after it. In announcing charges against Hamilton and Pavey in 2024, prosecutors said they had sold counterfeit U.S. currency on AlphaBay. 

Empire Market was organized under categories like “Fraud,” “Drugs & Chemicals,” “Counterfeit Items,” and “Software & Malware.” 

U.S. government and international law enforcement actions against cybercrime forums have continued in earnest since the AlphaBay takedown. 

The FBI apparently seized another cybercriminal site, RAMP, this week. International operations also recently targeted marketplaces such as BreachForums, BidenCash and Archetyp.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Joe Warminsky

Joe Warminsky

is the news editor for Recorded Future News. He has three decades of experience as an editor and writer in the Washington, D.C., area. He previously he helped lead CyberScoop for more than five years. Prior to that, he was a digital editor at WAMU 88.5, the NPR affiliate in Washington, and he spent more than a decade editing coverage of Congress for CQ Roll Call.

 

Total
0
Shares
Previous Post

China-Linked UAT-8099 Targets IIS Servers in Asia with BadIIS SEO Malware

Next Post

Researchers Uncover Chrome Extensions Abusing Affiliate Links and Stealing ChatGPT Access

Related Posts

Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure

Four distinct threat activity clusters have been observed leveraging a malware loader known as CastleLoader, strengthening the previous assessment that the tool is offered to other threat actors under a malware-as-a-service (MaaS) model. The threat actor behind CastleLoader has been assigned the name GrayBravo by Recorded Future's Insikt Group, which was previously tracking it as TAG-150.
Read More

⚡ Weekly Recap: IoT Exploits, Wallet Breaches, Rogue Extensions, AI Abuse & More

The year opened without a reset. The same pressure carried over, and in some places it tightened. Systems people assume are boring or stable are showing up in the wrong places. Attacks moved quietly, reused familiar paths, and kept working longer than anyone wants to admit. This week’s stories share one pattern. Nothing flashy. No single moment. Just steady abuse of trust — updates, extensions,
Read More

SecAlerts Cuts Through the Noise with a Smarter, Faster Way to Track Vulnerabilities

Vulnerability management is a core component of every cybersecurity strategy. However, businesses often use thousands of software without realising it (when was the last time you checked?), and keeping track of all the vulnerability alerts, notifications, and updates can be a burden on resources and often leads to missed vulnerabilities.  Taking into account that nearly 10% of
Read More