Buyers send money to the marketplace, which in turn sends the money to the seller. Thus, further analyses in this direction have been hindered by the lack of heuristics able to identify these two key classes of actors in transaction networks and their roles in the structure and dynamics of the ecosystem. One of the most common risks when accessing darknet markets is ending up on a fake or cloned site. Cybercriminals create convincing imitations of popular dark markets to trick users into entering their login details or sending cryptocurrency to fraudulent addresses.
Market Features
We showed that a small fraction of traders is responsible for a large fraction of the trading volume, and by analysing the networks of buyers and sellers, we found different resilience regimes. Shocks tend to induce serious structural changes in the multiseller network, but impact the multibuyer network much less severely. Interestingly, the S2S network shows an intermediate level of resilience, which suggests that the S2S network might play the role of a supply chain network on the dark web. Furthermore, after a shock, the activity of buyers is resumed almost immediately, while the activity of sellers recovers more slowly. These different regimes suggest that the ecosystem’s resilience is mainly supported by the high demand of buyers rather than the response of the sellers. To analyse the connectivity of the whole ecosystem, i.e., how markets are connected with each other, we consider sellers and buyers that are simultaneously active on multiple platforms.
Moreover, data scraped from the DWMs cannot assess the U2U transactions which account for the largest fraction of the total trading volume of the ecosystem13. Always transfer your cryptocurrency to a personal wallet under your control before making purchases on darknet markets. Never send coins directly from an exchange, and avoid storing funds in market-hosted wallets. By controlling your own keys, you significantly reduce the risk of losing access to your money if a market exit scams, gets seized, or simply goes offline. Cryptocurrencies offer financial innovation and decentralization but also pose risks related to money laundering, fraud, and cybercrime.
Law Enforcement Takedown
They often sell across multiple markets or operate standalone storefronts via encrypted apps like Telegram and Signal. Operational security has increased, with mandatory PGP encryption, two-factor authentication, and more frequent use of VPNs and anonymization tools. Abacus’s exit follows the June 16, 2025 law enforcement seizure of Archetyp Market, marking the latest in a series of shutdowns in the Western DNM ecosystem. Community consensus and users close to the Abacus team ruled out an FBI operation as a likely reason, leaning more towards an exit scam explanation for the sudden takedown of the platform. In what concerns user deposits, TRM Labs reports that the platform received last month an average of $230,000 per day, across 1,400 transactions. In the meantime, the US government is working on developing state-of-the-art blockchain forensic analysis tools for tracing private coin transactions and Japan has passed a ban on Japanese exchanges offering privacy coins altogether.
Evolution Of The Darknet Ecosystem
Then, we investigate both market star-graphs and user-to-user networks, and highlight the importance of a new class of users, namely ‘multihomers’, who operate on multiple marketplaces concurrently. Specifically, we show how the networks of multihomers and seller-to-seller interactions can shed light on the resilience of the dark market ecosystem against external shocks. Our findings suggest that understanding the behavior of key players in dark web marketplaces is critical to effectively disrupting illegal activities. Transactions on Hydra were conducted in cryptocurrency and Hydra’s operators charged a commission for every transaction conducted on Hydra. Even as major darknet platforms fall, TRM Labs data shows that the ecosystem remains highly adaptive.
The Dark Web As A Platform For Crime: An Exploration Of Illicit Drug, Firearm, CSAM, And Cybercrime Markets
According to analysis by TRM Labs’ blockchain intelligence team focused on darknet market ecosystems, Empire Market was one of the largest Western darknet markets in operation during the relevant period. During this period deposits to darknet markets dropped significantly and no new leader emerged as vendors and buyers tended to avoid darknet markers while the dust settled. Darknet markets provide a secure platform for trading various goods, including pharmaceuticals and digital products, using cryptocurrencies like Bitcoin. Popular darknet market lists and links help users navigate the best options, ensuring access to verified darknet sites and marketplaces. The darknet drug market continues to grow, with 2025 projections indicating expanded availability and improved user experience.
Improved Security Protocols
While Tor provides anonymity, combining it with a reliable VPN adds another layer of protection. A VPN hides your real IP address from your Internet Service Provider and ensures your Tor usage is not easily detected. Cryptocurrency has enabled Ponzi and pyramid schemes to evolve, luring investors with unrealistic profit promises.
Since 2020, our annual estimates of illicit activity — which include both evidentiary attributions and Chainalysis Signals data — have grown by an average of 25% between annual reporting periods. Assuming a similar growth rate between now and next year’s Crypto Crime Report, our annual totals for 2024 could surpass the $51 billion threshold. Following Europol’s takedown of Archetyp Market (one of the most established darknet platforms) on the 16th of June, users migrated to Abacus, making it the largest Bitcoin-enabled darknet market in the West by volume.
IT/Security Reporter URL:
- Therefore, we analyse the temporal network where nodes are the active markets and an edge between the nodes represents the number of multibuyers between them, what we henceforth call the multibuyer network.
- Interestingly, this vendor has also been a trusted supplier for OFAC-designated fentanyl traffickers Alex Adrianus Martinus Peijnenburg and Matthew Simon Grimm, having received close to $1.5 million in purchases from them.
- Today (June 16, 2025), Europol announced the successful dismantling of Archetyp Market, the longest-running darknet drug marketplace, following a sweeping international operation coordinated across six countries.
- Therefore, the S2S network appears to be more resilient than the multiseller network but less than the multibuyer network.
- The evolution of the multibuyer network follows a similar pattern to the multiseller network until 2015, despite a stronger polarization around Hydra instead of AlphaBay during 2017.
Their pseudonymous nature enables criminals to exploit blockchain technology for financial crimes, challenging regulators and law enforcement. For example, users migrate to alternative DWMs when a DWM that they trade on closes12,13. Such migration of users is aided by communication via online forums and chats on the dark web14,15. However, little is known about how DWM users trade and transact outside the DWMs. On the one hand, some recent works have shown that a significant number of DWM users trade drugs and other illicit goods using social media platforms, such as Facebook, Telegram, and Reddit16,17,18,19,20.
On January 12th 2022, UniCC – a darknet marketplace for stolen credit cards – announced its retirement on a prominent carding forum. UniCC had risen to become market leader following the retirement of Joker’s Stash, and amassed sales of $358 million. Law enforcement agencies have seen notable successes in identifying and apprehending darknet market operators. Their focus tends to fall on the largest markets, or those that have operated the longest. This attention can be too much for some markets, which will voluntarily close rather than remain an obvious law enforcement target for too long. Their operators must attract customers, deal with complaints and maintain infrastructure, all with the constant threat of arrest hanging over their heads.
Assess Stablecoin Ecosystem Activity
This increase may be due in part to the closures of top DNMs, the shift to the exclusive acceptance of XMR by other active markets, and delistings of XMR by popular centralized exchanges. The below graph shows an increase in Abacus sales (in BTC) following the closure of ASAP Market in July 2023, and a further increase following some CEXs delisting XMR. While Mega’s inflows declined by more than 50% year-over-year (YoY), Kraken DNM’s rose nearly 68% YoY. Kraken DNM, which billed itself as Hydra’s Market’s successor, received $737 million on-chain in 2024. Blacksprut, which rose to prominence with Mega in the wake of Hydra’s 2022 sanctions designation, law enforcement seizure, and subsequent collapse, came in third with 13.6% less revenue YoY.
The Dark Web Privacy Dilemma: Linguistic Diversity, Talkativeness, And User Engagement On The Cryptomarket Forums
In early July, 2025, Abacus Market, the largest Bitcoin-enabled Western darknet marketplace (DNM), went offline, rendering all internet-facing infrastructure, including its clearnet mirror, inaccessible. TRM Labs assesses that the marketplace’s operators have likely conducted an exit scam, shutting down operations and disappearing with users’ funds. Through 2021, BTC was unequivocally the cryptocurrency of choice among cybercriminals, likely due to its high liquidity. Since then, however, we have observed a steady diversification away from BTC, with stablecoins now occupying the majority of all illicit transaction volume (63% of all illicit transactions). This new reality is part of a broader ecosystem trend in which stablecoins also occupy a sizable percentage of all crypto activity, demonstrated by total growth YoY in stablecoin activity around 77%. In our 2024 Geography of Cryptocurrency report, we covered the wide array of practical use cases for stablecoins in a range of markets, such as storing value, sending remittances, facilitating cross-border payments, and international trade.
Crystal’s 2025 report highlights why Fridays have become the riskiest day in crypto, analyzing hacks, scams, and DeFi fraud. Nucleus Marketplace, a darknet market with zero activity in the last nine years, woke up to move over $77.5 million worth of Bitcoin. It added that many fraud shops are increasingly offering third-party crypto-payment processors like UAPS via API calls, as a way to reduce their own costs, improve operational efficiency and increase security. For those prioritizing variety, EclipseMarket stands out with its extensive catalog of pharmaceuticals, recreational drugs, and rare substances. The platform’s user feedback system allows buyers to make informed decisions, while its integrated dispute resolution mechanism ensures fair outcomes in case of disagreements. “But as scams on more blockchains including Ethereum, Tron, and Solana have grown, so too has the use of DeFi protocols,” the report noted.
Get in touch if there are any features you’d like to suggest to the team, or if you’d like more information about the platform. Although the dark web angle may be particularly eye-catching, Bitcoin moves from decade-old wallets surprisingly often. These ancient whales can come from several backgrounds, like early crypto miners or unlaundered stolen assets. The stablecoin issuers are fighting back, with the Tron-led T3 Financial Crime Unit, a group comprising of Tron, USDT-issuer Tether and TRM Labs freezing over $100 million in illict funds. OKX removed XMR and other privacy-focused tokens including DASH$20.57 and ZCash (ZCH) at the end of 2023. Chainalysis also noted that some markets are openly advertising their wares in Russia, with giant 3D billboards (Kraken Market) and QR codes on subway trains (Mega Darknet Market).
Pairs of users in stable pairs meeting inside a DWM traded for a total of $145 million in 2020, which corresponds to 252% of the 2019 level, and to 593% of the 2018 level, see Fig. The impact of the COVID-19 pandemic has, however, had different phases, punctuated by the number and level of measures introduced around the world. For users in stable pairs who met both inside and outside DWMs, we find that during the first lockdowns in 2020 trading volume fell with respect to January of the same year, suggesting that they were negatively impacted by COVID-19 restrictions. After that, trading volume sharply increased over the whole of 2020, see Figure S8. The number of stable U2U pairs created each day was, however, steady over time during 2020, even though more U2U pairs were created compared to the same period in 2019, see Figure S9. Overall, stable U2U pairs have shown resilience to the systemic stress caused by COVID-19, suggesting, once again, that these trading relationships are fundamentally independent from the underlying DWMs.
