Although the S2S network is composed only of U2U transactions, all categories of sellers (i.e, market-only, U2U-only, and market-U2U) are present in the S2S network. In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers. Therefore, we analyse the temporal network where nodes are the active markets and an edge between the nodes represents the number of multibuyers between them, what we henceforth call the multibuyer network. In particular, multihomers that are sellers in multiple markets are multisellers, and similarly for buyers we have the multibuyers. To analyse the connectivity of the whole ecosystem, i.e., how markets are connected with each other, we consider sellers and buyers that are simultaneously active on multiple platforms.
To study the performance of sellers, we analyse the quarterly median income, i.e., the quarterly median of the money received by each seller, for each category and multisellers, as shown in Fig. However, compared to sellers, the drop is notably smaller, and the number of buyers rapidly recovers to previous values. The number of market-U2U and market-only buyers also drops as a consequence of operation Bayonet.
- Fraud shops are services found mainly on the dark web that sell stolen data and personally identifiable information (PII), which cybercriminals use for scams, identity theft, and ransomware attacks.
- We should note though that some of the highest-earning markets shown above only serve specific countries or regions.
- In 2019, the FBI started its investigation into Genesis Market and enlisted other government agencies and law enforcement organizations across the world, working towards the market’s closure on April 4, 2023.
- A large number of services pretend to be a legitimate vendor shop, or marketplace of some kind in order to defraud people.
- On July 31, the Italian police in conjunction with Europol shut down the Italian language Babylon darknet market seizing 11,254 Bitcoin wallet addresses and 1 million euros.
Mysterious wallet linked to Abraxas darknet moves $144m to Bitcoin mixer Illicit crypto addresses received over $24b in 2023, Chainalysis says Illicit crypto volume decreased to $34.8b in 2023, TRM Labs says This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. While DNM and fraud shop revenues declined in 2024 following years of concerted international law enforcement efforts, these platforms have managed to sustain their operations by adopting new tactics. Using a series of search warrants and subpoenas, the NYPD found the suspects’ online raw material purchases, and uncovered a crypto dimension to the case, not publicly shared until now.
Government Shared Services
Many low- and middle-income countries, despite high crypto adoption, lack strong regulations, increasing their vulnerability to financial crimes. Cryptocurrencies decentralized and borderless nature complicates regulatory oversight, enabling illicit financial activities. Money laundering through NFTs thrives on anonymity and subjective pricing, making it difficult to track illicit transactions. The cryptocurrency space remains vulnerable to scams that exploit investor trust and security weaknesses.
Cyble Partner Network (CPN) Join Us
Various cryptocurrencies such as Bitcoin and Monero can be used to make purchases. But once you start doing illegal things, like buying drugs or stolen credit cards, that’s when you’re breaking the law. Some are looking for illegal stuff they can’t buy elsewhere, like drugs or counterfeit documents. It’s been a constant back-and-forth between cybercriminals and law enforcement, with each new site trying to be smarter and more secure than the last. It was the first big site where people could anonymously buy drugs using Bitcoin, and it gained a lot of attention, until it was shut down by the FBI in 2013. By supplying stolen data, these dark web links fuel many online scams and identity theft operations, playing a critical role in the darker aspects of the internet.
Dark Web Intelligence Market Growth Forecast
Retail vendors appear to be holding a greater portion of their proceeds on-chain than wholesale vendors, while wholesale vendors (those who distribute drugs in large quantities) are making greater use of DeFi. Nemesis Market also saw its demise in March, when German authorities seized its infrastructure, along with $102,000 in cryptocurrency. While these outfits are not traditional DNMs, their success highlights how drug vendors are scaling their operations throughout Russian-speaking countries.
Latest shifts in the darknet trading landscape as of February 2025. The top performers of 2025, ranked by trade volume and market influence. Bohemia maintains 22,000+ listings and $3M monthly BTC trades, with a 6% market foothold. Alphabay reigns supreme with 60,000+ listings and $20M monthly trades, dominating 20% of darknet commerce via BTC and XMR.
Abacus Upgrades
The recovery pattern is fairly consistent until the Hydra Marketplace closure, after which no dominant darknet market emerged. While tactics like these may have helped boost revenue for both markets, again, they have yet to match Hydra’s sizable financial success. And, perhaps the most aggressive marketing stunt the darknet market ecosystem has seen yet, in December of that year, Kraken Market wrapped a bus in an advertisement that included a QR code for the market’s website. The chart above shows that, while values haven’t risen back to 2021 levels, darknet market revenue has slightly rebounded since Hydra’s closure in 2022.
Darknet Market And Fraud Shop BTC Revenues Decline Amid Years-long International Law Enforcement Disruption
- Hydra, which operated almost entirely in the Russian language and whose sellers were primarily based in Russia, Ukraine, Belarus, Kazakhstan and surrounding countries, used many of the features of prior marketplaces, such as a user-friendly interface, clean images of the advertised products, seller review systems, and simple, escrow-based purchases.
- The North Korean launderers quickly began to route big portions of the stolen funds to a crypto service called THORChain that lets people swap one digital currency for another.
- In the banking sector, for instance, regulators expect firms to show proof that they have carefully tested their systems for monitoring dirty money.
- This ongoing cat-and-mouse game poses a significant technical challenge in combating the activities within darknets.
- U.S. customers predominantly purchase drugs from these groups that are known to have used crypto to source fentanyl precursor chemicals from labs based in China.
Each offers unique strengths in cryptocurrency trading and escrow security—essential for navigating the onion network. It is one of the most active and up to date markets and always provides new and updated malware and data. Freshtools is a unique marketplace in that it does not only provide the stolen data, but it allows criminals to purchase MaaS which can cause further damage to the victims. Its commitment to privacy, diverse product offerings, and robust security measures make it a preferred choice for users seeking discreet transactions within the darknet. Established in 2022, Torzon market is one of the biggest and most diverse marketplaces on the dark web. Its focus on financial fraud and high-value transactions has attracted a dedicated user base, contributing to its growing reputation and market value.
NFTs, DeFi, And The Next Wave Of Crypto Crimes
Many sites use Bitcoin multisig transactions to improve security and reduce dependency on the site's escrow. This led to the rise of Dread, the dedicated darknet discussion forum and the news site Darknetlive (since closed). In June 2025 Europol took down the Archetyp Market with an estimated 3200 registered vendors and 600,000 customers worldwide. Further market diversification occurred in 2015, as did further developments around escrow and decentralization. Not long after those events, in December 2013, it ceased operation after two Florida men stole $6 million worth of users' Bitcoins. Atlantis, the first site to accept Litecoin as well as Bitcoin, closed in September 2013, just prior to the Silk Road raid, leaving users just one week to withdraw any coins.
Notably, the number of multisellers suffers the largest drop of \(-99\%\) by the end of the first quarter of 2018. Then, after operation Bayonet, the number of sellers in all categories and multisellers significantly drops, as shown in Fig. In all panels, the dashed vertical line marks the time of operation Bayonet. The empty point on the multiseller median income line demarcates the quarter with only two multisellers. (b) The number of buyers for each category and multibuyers per quarter. (a) The number of sellers for each category and multisellers per quarter.
The results of these markets are higher quality and lower prices of psychoactive substances as well as a lower risk of violent incidents. Some users report the online element having a moderating effect on their consumption due to the increased lead time ordering from the sites compared to street dealing. Online forum communities provide information about safe drug use in an environment where users can anonymously ask questions. Their aim was to explore the ethical and philosophical implications of these markets, which, despite high-profile internationally co-ordinated raids, persist and flourish. He recommends verifying market employees carefully, and to weed out law enforcement infiltration through barium meal tests.
“It's a game changer in terms of overall online criminal markets, and it's huge for victims of online fraud. The largest dark-net marketplace to have ever existed has been shut down,” says Elliptic cofounder Tom Robinson. When WIRED asked Telegram about Elliptic's findings regarding both markets, the company responded with broad bans of Xinbi Guarantee and Haowang Guarantee accounts. By Elliptic's accounting in a January report, the market and its rebrand had facilitated more than $24 billion in total transactions, which would make it by far the largest single black market operation in the internet's history. Haowang Guarantee, the crypto-fueled crime bazaar more widely known by its original name, Huione Guarantee, declared in an announcement posted to its website sometime in the last 24 hours that it would be shutting down. If there’s one constant in the crypto space and finance more broadly, it’s that money never sleeps.
Abacus Market Disappears In Suspected Exit Scam As Western Darknet Turmoil Deepens
The encryption inherent in the Tor protocol ensures that all data packets are routed through multiple relays, effectively obscuring the origin and destination of the traffic. The feedback and rating systems further enhance reliability, creating an ecosystem where reputable vendors are easily identifiable and low-quality products are quickly filtered out by the community. Sellers frequently provide detailed laboratory analysis results to verify the purity and composition of their products, a practice that has become a standard expectation for discerning buyers. The inventory is systematically organized, allowing users to filter products by substance type, purity, and geographic origin of the vendor. The operational model is built on customer satisfaction and repeat business, which incentivizes vendors to maintain high standards.
To trace Huione’s activity, ICIJ developed its own methods for analyzing transactions done in the stablecoin tether. In the U.S. alone, the FBI estimates Americans lost $9.3 billion to crypto crimes in 2024, a 67% increase from the previous year. To see how digital currency is used to supersize scams, ICIJ and its partners examined Forsage, one of the largest alleged crypto scams in recent years. “Crypto offers criminals a financial system that’s very efficient compared to the old days when a cartel would have to stuff cash into the back of a Cadillac,” Griffin said. “If they kick criminal actors off the platform, then that’s a big revenue source that they lose, so they have an incentive to allow this activity to continue,” said John Griffin, a blockchain data expert at the University of Texas at Austin. OKX said that it has been working with the U.S. government on the matter, sometimes initiating engagement.
