Once cryptocurrency reaches a scammer’s wallet, it is typically shuffled from wallet to wallet in a complex web of transactions between scammers and money launderers (sometimes the same people), with each wallet accumulating funds from additional victims along the way. While the vast majority of illicit commerce continues to use fiat currency such as the US dollar, cryptocurrency is the preferred medium of exchange on darknet marketplaces, cybercrime forums, and on CSAM sites. Uptime and comparison services provide sources of information about active markets as well as suspected scams and law enforcement activity. In the case of Nemesis Market — another platform covered in TRM’s reporting — US authorities sanctioned an Iranian national linked to more than USD two million in cryptocurrency transactions involving narcotics, stolen data, and illicit services. What’s significant about this estimate is that it covers only “drug-focused” darknet markets (DNMs), with TRM Labs using a definition of DNMs that excludes marketplaces that trade only in illicit cyberservices. The blockchain analytics firm has discovered that in 2020, the total revenue of the darknet markets significantly increased while the total number of transactions and marketplaces decreased.
Surge In New Scams As Pig Butchering Dominates
(b) Trading volume in dollars sent to a DWM compared with the total trading volume in its surrounding U2U transactions. (a) Total number of users interacting with a DWM against the total number of users forming U2U transactions. By analysing the temporal evolution of stable pairs, we unveil that DWMs acted as meeting points for 37,192 users (out of around 16 million), whose trading volume is estimated to be $417 million. Since users often migrate from one DWM to another12 and become users of multiple DWMs, the 40 ego networks are not isolated but can be combined to form one full network, as shown in Fig. We focus on two kinds of transactions, occurring (i) between the user and a DWM and (ii) between two users of the same DWM. Our analysis focuses on Bitcoin – the most popular cryptocurrency both on DWMs27,28 and in the regulated economy29,30.
The Emergence Of Marketplaces On The Darknet
- These underground online marketplaces have become breeding grounds for cybercrime, posing a significant threat to society as we know it.
- Even controlling for sanctions exposure, TRM Labs research found parasite exchanges to carry 45 times more illicit exposure than compliant exchanges, as a percentage of their volume.
- We assess the strength of a market’s dominance by the market share (i.e., the market revenue divided by the sum of the revenues of all markets) and by the length of the time interval the market remains dominant, as shown in Fig.
- Active from 2020 until June 2025, it amassed 600,000 registered users and 17,000+ listings.
- They often sell across multiple markets or operate standalone storefronts via encrypted apps like Telegram and Signal.
- On the same day, the FBI and Europol revealed they’d arrested 61 suspects and seized 50 darknet accounts worldwide.
Although blockchain forensics tools can assist with identifying the transactions that reach the VASP, investigators are required to apply for legal data access to obtain the necessary transaction data to identify the off-ramps. Chain-hopping refers to the practice of moving cryptocurrency from one blockchain to another. The suspect used cashiers checks and cryptocurrency ATMs to transfer USD 565,000 on behalf of the criminals that committed fraud in order to steal the victim’s funds. TRM Labs showed that North Korean cyber actors used Tornado Cash to launder over USD 1 billion of stolen funds in at least ten major cryptocurrency heists. They operate by connecting trading partners seeking to buy or sell cryptocurrency without a third party intermediary.
Dark Web Marketplaces: Major Takedowns And How Police Dismantle Them
Such migration of users is aided by communication via online forums and chats on the dark web14,15. For example, users migrate to alternative DWMs when a DWM that they trade on closes12,13. They offer a variety of illicit goods including drugs, firearms, credit cards dumps, and fake IDs4. Users in such stable pairs turn out to be the ones with the largest trading volume on DWMs. Recently, two interview-based studies have suggested that DWMs may also promote the emergence of direct user-to-user (U2U) trading relationships. Community consensus and users close to the Abacus team ruled out an FBI operation as a likely reason, leaning more towards an exit scam explanation for the sudden takedown of the platform.
Best Practices For Monitoring And Mitigating Risks
Hence we do not distinguish multisellers by the number of markets in which they operate. We assess the strength of a market’s dominance by the market share (i.e., the market revenue divided by the sum of the revenues of all markets) and by the length of the time interval the market remains dominant, as shown in Fig. To study the distribution of the trading volume between users, we analyse the total money received and sent by each user.
They function primarily as black markets, selling or brokering transactions involving drugs, cyber-arms, weapons, counterfeit currency, stolen credit card details, forged documents, unlicensed pharmaceuticals, steroids, and other illicit goods as well as the sale of legal products. To ensure transaction security and protect buyer information, sellers on darknet markets use encryption techniques and anonymous communication tools. Popular cryptocurrencies such as Bitcoin and Monero are often used for transactions in these markets. To access darknet markets, you can use common methods like Tor browser and virtual private networks (VPNs).
Mastering AI Security With ISACA’s New AAISM Certification
Individuals began using the darknet to pseudonymously sell illegal content without face-to-face interaction. Given the darknet’s infrastructure, which is hidden behind onion routing, the darknet attracts sites whose proprietors want to remain anonymous. There are certain sites on the darknet (and on clearnet) which attempt to manually track and publish sites on the darknet, but common browsers do not link directly to darknet.
Exit Scam Unfolding
“This is where the real lack of oversight is in the cryptocurrency industry.” Nishizaki paid more than $30,000 in dozens of cryptocurrency transfers between March 2024 and June 2025, according to transaction records she provided to ICIJ. ICIJ and its media partners interviewed 45 victims of sophisticated cryptocurrency scams on four continents. “This allows them to cash out into traditional currency or effectively give the cryptocurrency a veneer of legitimacy as they move it on.”
Today, no single player is dominant like these marketplaces were before their takedown, with administrators preferring to specialize in particular types of goods and services. These tools enable a rapidly growing cohort of organizations around the world to safely embrace cryptocurrency-related transactions, products, and partnerships. TRM provides blockchain intelligence to help financial institutions, cryptocurrency businesses, and public agencies detect, investigate, and manage crypto-related fraud and financial crime. Though the drug transactions were limited to Russia and its geographic neighbors, the cyber and money laundering tools were available to anyone in the world willing to pay.
Relative to their volume, parasite exchanges facilitate as much as 100 times more illicit on-chain activity than their mainstream counterparts, according to research by TRM Labs. He allegedly converted some of the funds to bitcoin and “used a portion of the rest to start his own lucrative cryptocurrency ATM business.” In cases where the initial funds are received in cryptocurrency, for example from theft, extortion or illicit commerce, placement involves obscuring their origins and converting them into more widely-accepted or less traceable forms. During this initial stage of money laundering, criminals can use the profits obtained through illegal activity to purchase cryptocurrencies. Criminals are interested in collecting funds via a non-reversible format that is nearly instantaneous.Money laundering involving cryptocurrency largely follows the same path as its conventional counterpart, starting with placement, followed by layering and integration.
The analysed dataset includes about 31 million transactions among more than 16 million users. Overall, our study provides a first step towards the understanding of how users of DWMs collectively behave outside organised marketplaces. One might therefore hypothesise that U2U trading is also a prevalent feature on regulated online marketplaces. Moreover, our analysis paves the way to a deeper understanding of U2U transactions in online marketplaces. In particular, our dataset does not include any attributes related to either users or their Bitcoin transactions, such as, whether the transaction represents an actual purchase or not.
In panels (b, c), we show the number of all sellers and buyers per quarter, respectively. Evolution of buyers and sellers in the ecosystem of DWMs. The classification method is robust with respect to the values assigned to the classification parameters, and returns reasonable estimates compared against a benchmark of nine markets (see Supplementary Information Section S1). Our method identifies sellers, whereas buyers are entities which are not classified as sellers. To characterize the structure and dynamics of the ecosystem of DWMs, we start by classifying all traders either as buyers or sellers. Analogously, we identify and characterise ‘multisellers’ (i.e., multihomers that are sellers) and ‘multibuyers’ (i.e., multihomers that are buyers).
- In that instance, the virtual asset service provider (VASP) involved in the transfer of the bitcoin to the would-be killer cooperated with authorities in providing details of the suspect.
- But with blockchain intelligence advancing and global partnerships strengthening, law enforcement is better positioned than ever to detect, disrupt, and dismantle these operations.
- Despite advanced obfuscation, blockchain intelligence remains a potent investigative tool.
- In 2020–and remember we still have one month left in the year–there were only 37 active darknet markets, the lowest number of darknet marketplaces seen since November 2017.
In cases where we’re able to confirm such information, we count the transactions as illicit in our data. Such transactions are virtually indistinguishable from licit transactions in on-chain data, although law enforcement with off-chain information can still investigate these crimes using Chainalysis solutions. Since 2020, our annual estimates of illicit activity — which include both evidentiary attributions and Chainalysis Signals data — have grown by an average of 25% between annual reporting periods. Much of that growth came from various types of illicit actor organizations, such as vendors operating through Huione, which provide on-chain infrastructure and laundering services for high-risk and illicit actors. According to our metrics today, it looks like 2024 saw a drop in value received by illicit cryptocurrency addresses to a total of $40.9 billion.
Because they are already active in more than one market, the migration cost for the multihomers is usually smaller compared to that for non-multihomer users, especially for sellers, that need to rebuilt their reputation23. With the advent of several markets at the beginning of 2014, the number of multisellers rapidly grows, representing more than 20% of all sellers until the beginning of 2016 (see Supplementary Information Section S3). The large number of U2U-only sellers is in accordance with previous results that showed that the trading volume in the U2U network is significantly larger than that of DWMs13 (also see Supplementary Information Figure S8).
Many vendor shop owners also trade simultaneously on DNMs.Generally offering a limited range of products, sometimes only one or two types of drug, vendor shops first gained prominence in the wake of Operation Onymous in 2014. By contrast, the largest Western Bitcoin DNM currently in existence – ASAP Market – accounted for less than 10% of global DNM market share. They are distinct from independent single-vendor shops that also sell illicit drugs, and from other types of fraud stores.As much as USD 1.49 billion was spent on DNMs in 2022, according to TRM Labs research. A smaller and more elusive subset of illicit commerce concerns child sexual abuse materials (CSAM). In 2016, two thirds of crypto hack volume was on Bitcoin; in 2022, it accounted for just under 3%, with Ethereum (68%) and Binance Smart Chain (19%) dominating the field.
