Sheep Marketplace was an anonymous marketplace set up as a Tor hidden service. It launched in March 2013 and was one of the lesser known sites to gain popularity with the well publicized closure of the Silk Road marketplace later that year. It ceased operation in December 2013, when it announced it was shutting down after a vendor stole $6 million worth of users' bitcoins.
Bitcoin theft incident
In December 2013 Sheep Marketplace announced that one of the site's vendors exploited a vulnerability to steal 5400 bitcoins, valued at about $6 million at the time. According to Forbes, and The Guardian several users reported the site had started to block withdrawals of bitcoins more than a week prior to the theft. Users furthermore suggested the site's administrators held far more than 5400 bitcoins, pointing to records of a coincidental transfer of almost 40,000. As users in the site's forums began to complain and discuss the possibility of connivance, administrators took the forum offline.
Victims of the theft have attempted to identify the thief by sending "tagged" bitcoins to his accounts, using the public nature of bitcoin transactions to follow these moneys through the "blockchain" record of transfers. Within a couple days of the theft, a large amount of bitcoins were noticed being processed by Bitcoin Fog, a "tumbler" used to launder bitcoins by shuffling them between many accounts for a small fee. The size of the transaction, 96,000 bitcoins, caused Bitcoin Fog to fail, leaving the money traceable. Not long thereafter, the last known wallet of the user who had been presumed to be the thief was found to be a wallet owned by BTC-e, a large bitcoin currency exchange. This has led to speculation that the thief sent their money to the exchange in the hope of trading the coins for alternate crypto-currencies or moving to new wallets to further obfuscate their path.
In March 2015 Czech police arrested a man suspected to be the Sheep Marketplace thief when he paid for an expensive house entirely in bitcoins.
Finally in May 2016 the theft was traced to two men from Florida via tracing Bitcoin transactions via Coinbase.