On 21st May 2024, /u/MommaBear, one of the 2 administrators of SuperMarket, announced that all the market's wallets have been drained.
MommaBear's statement about the situation:
At approximately 02:31 UTC on Tuesday May 21 2024, I discovered that both the cold storage escrow and joint-pocket (commission) wallets were completely empty. Both wallets had sent funds to a the same address that I do not recognise. As soon as I made this discovery, I went through and changed all of our server's access keys to mitigate any further damage. After doing so I reached out to dread staff to notify them of the situation.
MommaBear claims that co-administrator, /u/FatherBear, was the only other person that had access to the wallets, and believes the market was not compromised, rather his co-administrator has stolen the funds:
/u/FatherBear is the only other person that had access to these wallets and at this time I have no reason to believe they are compromised. At this time I can confidently say /u/FatherBear is in possession of all market funds. It is my belief that they got spooked with the news surrounding Pharoh and decided to take the funds and run.
The current status of the market:
At this time, all SuperMarket onions are shut down and orders are paused. I will update you all soon with more information.
Read the signed message here.
Previous Drainage of Wallets
2 months earlier, on 8th March 2024, somebody exploited a bug in SuperMarket that allowed them to drain all the funds in the market's wallet.
The market claimed the bug was in Monero's developer software, and not the market:
Approximately 1 hour after the bug had been made public it occurred again completely draining the market wallets. During our research we found that the bug was a result of the Monero RPC becoming overloaded and was not a bug in the market itself.
The administrators took full responsibility for the issue and refunded all stolen funds from their personal wallets.
black father goes out for the milk many such cases