U.S. customers predominantly purchase drugs from these groups that are known to have used crypto to source fentanyl precursor chemicals from labs based in China. Fentanyl and fentanyl-laced drugs also arrive in the United States through Latin America based cartels. The chart above shows that ASAP and Mega Darknet markets led the large retail and wholesale segments respectively. While tactics like these may have helped boost revenue for both markets, again, they have yet to match Hydra’s sizable financial success. Darknet markets were one of two categories of crypto crime that saw revenues rise in 2023.
In 2019, the FBI started its investigation into Genesis Market and enlisted other government agencies and law enforcement organizations across the world, working towards the market’s closure on April 4, 2023. Though it’s common for fraud shops to operate on the dark web, Genesis Market was accessible on the clearnet via Google search, and simply required an invitation code to create an account. One fraud shop that provided services like these, Genesis Market, saw its end last April after a coordinated, international law enforcement effort called Operation Cookie Monster closed it down, and OFAC sanctioned it.
There is no proof this money was passed on willingly by the darknet markets – it may have been stolen from them – but Milchakov called his drug-dealing supporters “true patriots of Russia.” Fraud shops are a unique segment of darknet markets that sell stolen data such as compromised credit card information and other forms of personally identifying information (PII) that can be used for fraudulent activity. Classic darknet markets sell diverse illegal goods; data stores focus on leaked or stolen data like credentials, databases, and ID records. Russian-language darknet markets comprised 95% of all crypto-denominated illicit drug sales on the dark web in 2023 In 2023, Russian-speaking actors were responsible for an astonishing 95% of all crypto-denominated illicit drug sales conducted on darknet markets. But darknet marketplaces entered the spotlight at the start of the COVID-19 pandemic, when the combination of a public health emergency, an economic crisis, and disinformation panic pushed some merchants and customers into the shadow economy.
Russia Slams Life Sentence On Hydra Darknet Market's Founder
On the Russian Market, a dark web marketplace, credentials stolen by malware are listed for sale like items on an online shop. They found that Russian-language dark marketplaces are super busy. According to the report, various Russian-language dark web marketplaces have been moving vastly high volumes of money using Western crypto exchanges. CTS Market is also a representative of Russian marketplaces and acts as a store that presents its products in the other large marketplaces on our list.
Hackers Use Microsoft Teams To Spread Matanbuchus 30 Malware
One of the key factors driving this shift is the increased focus on security. This “market cannibalization” has further destabilized the landscape, pushing vendors and buyers to seek refuge in smaller, more secure spaces. It blends illegal trade with extra features like gambling, all while maintaining a clear and accessible structure. The site is accessible via both Tor and the clear web, and its layout closely resembles that of Abacus Market, which makes navigation very user-friendly.Notable features include an automated carding shop, an escrow system for manual orders, and a dashboard that displays balances in both BTC and Canadian dollars (CAD). Additionally, it offers automatic purchases, buyer protection, and even a loyalty points program.Since its launch, it has conducted several massive data leaks.
- During a series of raids, law enforcement reportedly uncovered drug production labs set up within the suspects' homes.
- During 2018 and 2019, Interpol and the European Union brought together law enforcement agencies from 19 countries, leading to the identification of 247 high-value targets and the sharing of operational intelligence required for effective enforcement.
- The US government has sought to remind countries and ports that receive shadow vessels of the costs and environmental harm that could result, but this has not led to any significant change in behavior.
- In particular, the Norwegian Coastal Administration found that within a few months of Russia’s invasion of Ukraine, the sailing pattern of the tanker fleet from Russian Baltic Sea ports had changed.
- These sites cater to cybercriminals seeking valuable data, such as credit card numbers, login credentials, and personal information.
- We don’t yet have confirmation of OMG offering money laundering services, but again, the on-chain data suggests it likely does.
V Can Countries Block The Dark Fleet?
The world of the darknet has always attracted the attention of the masses. By leveraging automated dark web monitoring, organizations can mitigate risks, and take preventive measures before the leaked data is exploited. Manual monitoring of the dark web is inefficient and risky due to the sheer volume of data involved. In addition to its emphasis on stolen credentials, 2easy Market offers a variety of cybercrime tools, such as hacking services, exploit kits, and other resources for conducting cyberattacks. This platform has rapidly become a key player in the fraud market, trading in PII and SSH credentials while making use of both the clear and dark web.
The color of the lines show the former Hydra users’ category of activity and the thickness of the lines show the proportion of their activity flowing to new markets after Hydra was shut down. We can investigate this by using on-chain data to look at where former Hydra users migrated after the market was closed. While drug markets’ collective revenue hasn’t recovered fully, it climbed slowly back toward previous levels in the second half of 2022. Known as 'dark markets', these countries are proving the ultimate challenge for companies to promote their products. The marketplace also facilitated sales of false identification documents, hacking tools and services, and money laundering services for bitcoin.
Silk Road — the marketplace that garnered the most brand recognition before it was closed down in 2013 — served over 100k customers in the two years it was operational and was reportedly a USD 1.2 bn operation at its peak, Wired tells us. You need a special key to access the dark web, the most common of which is Tor, open source browser technology that allows anonymous dark browsing at no charge, research platform Internet Retailing notes. German authorities last week shut down Russian-language darknet platform Hydra, seizing its servers along with USD 25 mn in BTC. Cybersecurity researchers have uncovered a dangerous tool causing a stir on the dark web and within
Government Shared Services
Many human rights and free press organizations have a presence on various dark nets. Iran is a country that has a unique relationship with the dark web. Could the increase in dark web usage, more specifically Tor, simply be state-sponsored cyberwarfare vs. the general population?
Despite those moves, Russian darknet markets still dominate, compared with other regions. With over 14,000 members, the site used Tor and used some escrow features like Silk Road-like darknet markets, but otherwise many deals took place off-site using off-the-record messaging. Compliant financial institutions, crypto exchanges, and other platforms that facilitate crypto transactions also use blockchain analytics tools to monitor and potentially block transactions flowing to or from darknet marketplaces.
Swedish Court Acquits Alleged Russian 'Agent'
Ransomware and cryptocurrency-based crimes saw a significant increase in 2025, with $2.17 billion stolen from crypto platforms, surpassing the total for all of 2024. These sites cater to cybercriminals seeking valuable data, such as credit card numbers, login credentials, and personal information. As of 2020, nearly 57% of the dark web was estimated to contain illegal content, including violence and extremist platforms. Telegram channels supplement traditional onion sites, blurring lines between the dark web sites and more mainstream communication tools.
Alcohol Advertising & Dark Markets
Earlier this month a Kraken employee told Russian news website Lenta.ru that the market had a dedicated PR department. However, the deposit address overlap and instantaneous mass migration of Hydra users to OMG following Hydra’s shutdown suggests that it’s certainly possible. We can see this on the chart below, which shows the total amount sent by each market to shared deposit addresses.
Russia Delivers Historic Life Sentence To Suspected Founder Of Darknet Marketplace
Four of the top five highest-earning darknet markets in 2022 were conventional, drug-focused darknet markets, while just one, Brian Dumps, was a fraud shop. Hydra Market, which was considered to be the world's largest and oldest darknet marketplace of illegal items and services, was seized and shut down by German authorities in coordination with U.S. law enforcement Tuesday, the U.S. “Russia has fostered an illicit finance ecosystem of darknet markets, non-compliant crypto businesses, ransomware, and paramilitary groups. According to a recent report from the Global Initiative Against Transnational Organized Crime, drug traffickers continue to find ways to connect with buyers through darknet markets and cryptocurrency transactions. But as we can see, due to the migration process and the redistribution of the Russian market by other darknet marketplaces, the sanctions may have a much lower effect than what was originally intended. Mega’s popularity started to skyrocket after Hydra was buried, and it is currently on track to become one of the largest darknet marketplaces in Russia.
In total, darknet markets and fraud shops received $1.7 billion last year, a rebound from 2022 — the year that saw the sizable Hydra Marketplace close. It could be a hacked device, or an innocent oversight from the billboard’s operator, but there’s no denying that Russia is a far friendlier place for darknet markets to operate than many countries. Driven by large platforms such as Kraken, Mega, and Blacksprut, Russian darknet markets control 93% of the global share, generating approximately $1.5 billion in revenue in 2023 alone. Recent data presented by blockchain intelligence platform TRM Labs reveals that these markets accounted for an alarming 80% of the $1.49 billion worth of illicit drugs purchased in 2022. Russians sent around $169 million to the various darknet marketplaces, and received $119 million from such sites.
In mid-January, personal android applications of the darknet markets began to appear on Google Play, after their removal, sites began to place APK files for downloading the application in their telegram channels and sites. After this event, Russian darknet markets began to fight for the place of the market leader, arranging cyber attacks on each other and using aggressive advertising on the streets of Moscow. The Russian darknet market conflict is a cyber conflict in the Russian darknet drug market, which began after the closure of the largest marketplace Hydra in April 2022.
For instance, we see single vendor shop revenue spike beginning around March, around the same time traditional darknet market revenue began to fall. Setting up a single vendor shop allows those vendors to save on fees that would ordinarily go to the administrators of a traditional darknet market. Market — all gained their initial market share in the wake of Hydra’s collapse, with on-chain data suggesting these markets made concerted efforts to attract former Hydra users and vendors. Hydra Market led the way once again as the highest-earning darknet market in 2022, even though it was sanctioned by OFAC and shut down in a joint U.S.-German operation in April — no other market beat the revenue lead it built up in those four months. Total darknet market revenue for 2022 ended at $1.5 billion, down from $3.1 billion in 2021. The darknet, or dark web, is the collection of websites hidden from normal search engines and web browsers, with users accessing it with browsers that hide their identities.
- “Alex”, a drug dealer from Moscow who did not want to give his real name for fear of being identified by police, said since Russia’s invasion of Ukraine “MDMA, LSD, and ketamine are almost impossible to find.
- Darknet marketplaces are commercial websites accessed by an encrypted browser which operate on the dark web, functioning primarily as black markets for illegal activity or substances.
- Virtual currency is often the payment method of choice on darknet marketplaces because illicit actors who transact on the darknet often incorrectly believe virtual currencies to be an anonymous and untraceable means of exchange.
- Before German police seized Hydra Market's servers in a joint action with the United States in April 2022, effectively taking down the entire operation, Hydra Market was the world's largest darknet market for selling drugs and money laundering.
- Digital access for organisations.
- Many of the tools sold on Russianmarket, such as phishing kits or ransomware, have been linked to major cybercrime syndicates that target individuals, corporations, and even governments.
Afilipoaie said analysis by TRM Labs shows a wide variety of criminal groups are laundering funds through these platforms, including those connected to non-drug related crimes, such as those selling credit card data and other personal information through fraud hubs, where people’s stolen identities are traded online. There is direct evidence that two of the three markets in question offer money laundering services. In the post-OMG dominance period, OMG retained a number of those former Hydra counterparties, but lost a significant share of their illicit activity to the other two markets across all categories.
