Identifying key players in dark web marketplaces through Bitcoin transaction networks Scientific Reports

Moreover, we do not have information about which users trade with other users on the same DWM. Finally, our coverage of DWMs, albeit extensive, may lack information on other trading forums where users could have met. These distributions are explored for each of the 40 DWMs under consideration in Figure S5 and S6, respectively. 2c which shows that since 2011 U2U transactions have consistently involved greater monthly volume than the volume sent to all DWMs.

Search engines

Its main inventory includes corporate credentials, system logs, RDP access points, and internal network data. These assets are often used as initial entry points for ransomware operations. Marketplaces are hosted on hidden services that conceal server locations and user identities. BidenCash and other exit-scam markets such as Torzon and Kingdom Market collapsed between 2022 and 2024.

• It is a specific Debian-based version of Linux software that leaves no traces of the user activity or the operating system on the computer.
• Tor Browser provides anonymity by routing your traffic through a global volunteer network.
• We do not engage with darknet markets; our mission is exclusively dedicated to providing information for research and educational purposes.
• Despite a 2019 breach that exposed over 26 million credit cards, it continues to operate, indicating sustained trust in its data pipelines.
• It operates on Tor and, by 2025, is commonly reported as hosting tens of thousands of active listings.
• To be classified as a seller, an entity must simultaneously satisfy the six feature threshold criteria, as follows.
• We use data of DWM transactions on the Bitcoin blockchain pre-processed by Chainalysis Inc.

Can you access the dark web using DuckDuckGo?

• Threat reports consistently rank it among the top ten darknet sites Top 10 Dark Web Markets.
• It helps us stay more vigilant, better protect ourselves, and make informed decisions online.
• The reasons for the differential impact of COVID-19 on U2U trading vs. DWM trading are difficult to pin down.
• To remain anonymous about your purchases on the dark web, always use cryptocurrency as your mode of payment.
• Like other marketplaces, ASAP Market also requires you to register for an account.
• The legality depends on your activities and your country’s specific laws regarding darknet use.

Also, previously, the Tor browser was vulnerable to JavaScript attacks as it provided hackers a pathway to track your activities by using the session details. Therefore, for security reasons, disable JavaScript on the Tor browser and enjoy an anonymous browsing experience on the dark net. You can find featured listings on the homepage and browse the products of your choice.

Security & Anonymity Model (as described publicly)

After that quarter, their number remains small, which is represented by the dashed line. In all panels, the dashed vertical line marks the time of operation Bayonet. As of October 2022, the largest volume of drugs purchased at two large marketplaces – BlackSprut and Mega – were for cathinones such as mephedrone and alpha-PVP. These white, synthetic stimulant powders that mimic cocaine and MDMA are highly prevalent in Russia, eastern Europe and the Balkans because they’re cheap and easy to manufacture locally.

Beyond Bug Bounties: How Private Researchers Are Taking Down Ransomware Operations

Unlike legal platforms, they have no stable protections or long-term security guarantees. Payments are usually made with cryptocurrencies to avoid traditional banking systems. Despite these measures, dark web marketplaces are unstable and often shut down due to scams, internal problems, or law-enforcement action. These platforms are organized like common shopping websites, with product listings, prices, and seller profiles.

What Is Vibe Coding? Collins’ Word of the Year Spotlights AI’s Role and Risks in Software

Our work unveils sophisticated patterns of trade emerging in the dark web and highlights the importance of investigating user behaviour beyond the immediate buyer-seller network on a single marketplace. Today, darknets are populated by a vast array of users, ranging from privacy-conscious individuals to cybercriminals, hacktivists, and nation-state actors. These hidden networks provide a platform for illegal activities that include the sale of stolen data, hacking tools, weapons, counterfeit currency, and narcotics. Dark markets, often accessed through specialized marketplaces within darknets, are breeding grounds for underground economies, where users can engage in transactions while evading law enforcement and ethical oversight. The goods on sale range from stolen credit card data and forged documents to illegal drugs, weapons, malware as a service, and hacking tools.

Trade‑offs and Limitations

• Unique threads discussing drainers on dark web forums increased from 55 in 2022 to 129 in 2024, with Telegram channels serving as prominent hubs for these activities.
• One such sophisticated darknet market, Hydra, offered all that and more,” Chainalysis explained.
• Thus, further analyses in this direction have been hindered by the lack of heuristics able to identify these two key classes of actors in transaction networks and their roles in the structure and dynamics of the ecosystem.
• Abacus Market was launched in 2021 and now lists over 40,000 illicit goods, including hacking tools, counterfeit documents, and listings for drugs.
• The shop accepts payment through Bitcoin and Monero, while some vendors accept the coins.

To expand their reach, some marketplaces established parallel channels on Telegram. This further complicates monitoring efforts because now you need to search for the related Telegram channels and track activity there and on the marketplace itself. Clearnet “directory” pages and market overviews frequently characterize Ares as using a walletless / direct‑pay approach with escrow, plus support for BTC and XMR (sometimes listing additional coins). Treat these as self‑reported marketing details rather than independently verified features; such pages are useful for understanding how the site portrays itself but can lag reality.

New payment processing services

Dark web websites won’t show up on Google, but they are indexed by dark web search engines such as Torch. Authorities struggle to track transactions in decentralized systems due to scarce data trails. The speed and anonymity of digital exchanges hinder identification, complicating efforts to dismantle illicit networks. According to the TRM Labs 2025 Crypto Crime Report, Russian-language darknet marketplaces brought in more than $1.7 billion in 2024, continuing a year-over-year increase first noted in 2023. Its focus on financial fraud and high-value transactions has attracted a dedicated user base, contributing to its growing reputation and market value. Valued at approximately $15 million, Abacus Market is one of the most lucrative platforms in the dark web ecosystem.

What types of marketplaces can you find on the dark web?

Use Norton VPN to encrypt the data you send and receive and surf more anonymously. Administrator and prolific vendor Gal Vallerius was arrested in August 2017. These aren’t distant problems—they are immediate, and they affect public safety, financial systems, and global cooperation. According to a 2024 report citing unsealed court documents, USDT was widely available in Mexico at a discount, allowing resellers to profit in countries like Colombia. The arrest of Durov heightened fears that Telegram would start cooperating with authorities, forcing vendors to find new places to operate. Nexus opened in late-2023 after the Fall of Bohemia and quickly absorbed many of that community’s well-rated vendors.

Crypto Data

• Technological advancements like AI-driven security, quantum-resistant encryption, and blockchain integration are reshaping the landscape, but simultaneously, global enforcement efforts grow more sophisticated and collaborative.
• Another key innovation is the adoption of AI-driven recommendation systems, which analyze user behavior to suggest products and services tailored to individual preferences.
• It tracks Tor user activity by region, showing trends in access and adoption without collecting personal data.
• On average, the marketplace consists of more than 11,000 items and 1000 vendors.
• This expansion has attracted a broader audience, contributing to the overall vitality of the ecosystem.
• Administrator and prolific vendor Gal Vallerius was arrested in August 2017.

It sells stolen card data — dumps, CVVs, even wholesale batches — and lets users bid on fresh leaks. Despite multiple takedown efforts by law enforcement and security researchers, Brian’s Club has resurfaced repeatedly and continues to add new stolen credit card data. Another key aspect of this evolution is the rise of darknet market lists, which serve as directories for users to identify reliable platforms. These lists are regularly updated to reflect the latest trends, ensuring that traders can access the most secure and innovative markets.

The total trading volume users sent to DWMs was $3.8 billion, volume received from DWMs was $3.7 billion, while the volume exchanged through U2U pairs reached $30 billion. In Figure S3, we illustrate the number of transactions, trading volume, and lifespan of U2U pairs. (a) Total number of users interacting with a DWM against the total number of users forming U2U transactions. (b) Trading volume in dollars sent to a DWM compared with the total trading volume in its surrounding U2U transactions. The dashed line is the bisector and allows to easily compare the two trading volumes. (c) Total monthly trading volume sent to all DWMs and exchanged in all unique U2U pairs.

The Evolution of Darknet Markets: Secure Trade and Technological Advancements

Prices of hacked cryptocurrency accounts still remain overall the highest among all hacked online accounts. This indicates that hacking such accounts still remains extremely profitable. As in the previous 3 years, we conducted research into the supply and prices of various goods and services sold by cybercriminals on the dark web. The chart above shows that ASAP and Mega Darknet markets led the large retail and wholesale segments respectively. Looking closer at ASAP Market inflows, it won some share of revenue across all drug purchase types, receiving 37.1% of social supply, 35.7% of large retail, 16.5% of small retail, and 13.5% of wholesale purchases.

The site’s unique—loads fast, looks sharp, and vendors get treated right, keeping turnover low. I’ve used it; shipping’s discreet—plain packages or DeadDrops—and uptime’s been flawless, rivaling Abacus. It’s not as community-driven as Bohemia, onion links but the polish makes up for it—feels like a pro operation, not a fly-by-night deal. If you’re after a darknet market with variety and a forward-thinking edge, Tor2door Market’s a contender—watch it close in 2025 as that AI kicks in.

In 2025, darknet marketplaces primarily accept Monero (XMR) and Bitcoin (BTC). Privacy-focused operators are shifting to Monero due to its default anonymity, compared to Bitcoin’s transparent ledger Darknet markets see BTC inflow drop to $2B. The best way to protect yourself from the dangers of darknet markets is to simply avoid them altogether.

The Rise of Darknet Markets: A Secure and Innovative Trading Ecosystem

These search engines neither track your search queries nor record any information, improving digital privacy and keeping your data private. Registration was mandatory to access the Silk Road (like most darknet platforms). In 2013, the FBI shut down the Silk Road, but it was later relaunched in 2014 with the new name of Silk Road 2.0, but the German authorities shut it down in the same year. Other than the Silk Road 2.0, similar marketplaces also emerged, but they all went down sooner or later.

Future Trends and Predictions for Dark-Web Marketplaces Beyond 2025

It is home to all sorts of disturbing content, given that the markets share content related to non-consensual recordings and child exploitation. Perhaps, hiring a hacker can feel impossible, but it’s a genuine threat that you need to be aware of. In fact, several businesses can use that service to get rid of competitors, or individuals can use it to gain access to personal information about someone. Interestingly, the hackers don’t hide, but most of them even openly advertise what they offer on the darknet forums. Therefore, you can hire them to perform a task for you, from planting malware to hacking email accounts and even breaking into various social media accounts. The darknet is basically an overlay network that exists within the internet and can only be accessed with specific configurations, software, and usually uses certain customized communication protocols.

Email Database Dumps

The dark net’s layered encryption and routing protocols offer stronger anonymity, making onion sites appealing to whistleblowers, political dissidents, privacy advocates — and, inevitably, cybercriminals. Freshtools was established in 2019 and offers various stolen credentials, accounts, and host protocols like RDP. It is considered a go-to site for malware purchasing, providing keyloggers, trojans, and other Malware as a Service products.

Public monitoring describes DarkMatter as primarily drug‑centric, with additional categories reported for fraud, counterfeit documents, and malware/digital tools—a mix consistent with mainstream DNMs. The project’s marketing leans heavily on “security/education” messaging, aligning with its privacy‑coin‑only stance. Specific moderation rules are not authoritatively documented on clearnet sources and can change over time. The best marketplaces in 2026 cater to diverse needs, offering a broad spectrum of products ranging from privacy-enhancing software, digital documents, and cryptocurrency exchanges to more sensitive or controversial goods. Marketplaces that maintain strict moderation policies—banning excessively harmful or exploitative products—also gain popularity among more ethically minded users.

One of the most notable developments is the integration of cryptocurrencies as the primary medium of exchange. Bitcoin, Monero, and other privacy-focused coins have become indispensable for users seeking to conduct transactions without leaving a trace. The decentralized nature of these currencies ensures that financial activities remain untraceable, fostering trust among participants.

Bohemia popped up post-Hydra takedown and brings a fresh vibe—drugs (weed, pills, some coke) and digital goodies like hacked logins, no exact listing count, but it’s growing fast. They take BTC and Monero, and the site’s got a sharp, modern look—vendor profiles are loaded with ratings and reviews, easy to skim. What’s dope is their forums—real talk, not just noise—building trust like Telegram’s side hustle vibe. For 2025, they’re hyping a peer-to-peer escrow twist—could cut out middlemen and shake up how deals flow, which I’m stoked to see play out. It’s not as massive as Abacus, but quality’s on point—vendors deliver, and the community’s buzzing on Dread about it.

That prevents small dealers from participating in the market and a natural tendency towards fewer but larger dealers on those markets,” Fiedler told Decrypt. These numbers show that darknet customers are making fewer purchases in total, but these purchases are, on average, for larger amounts. All sponsored and commercial content, including press releases, is clearly labeled and reviewed for accuracy, disclosure and compliance. All news, reviews, and analysis are produced with full journalistic independence and integrity.

Though Mega Darknet Market typically serves a Russian customer base, the drug revenue shown in the chart above likely came from customers based in Europe. Mega clearly dominated the realm of wholesale drug purchases, capturing 51.9% of that segment. Unlike the surface web (the normal, open internet we use every day), you can’t search for .onion sit… When your data is found on the dark web, it means that you’ve been compromised. Therefore, you need to start by changing your passwords, and you need to notify your credit card or bank provider. The most important thing is to ensure that you never click on links that you’re not sure of their source.

• TRM Labs calculated that in the eight months since Hydra had been shut down, the new cluster of darknet markets had amassed $820 million in crypto currency deposits.
• The DDoS attacks listed below are characterized by their target, number of access requests, quality, speed, and duration.
• The chart above shows that ASAP and Mega Darknet markets led the large retail and wholesale segments respectively.
• It uses ring signatures and stealth addresses to obscure transaction details.
• Have streamlined the trading process, enhancing user satisfaction and market efficiency.
• This solution scans dark web forums to alert you if your data is being listed, traded, or otherwise exposed.

The anonymity and encryption provided in dark markets create a haven for cybercriminals and nation-state actors to buy and sell dangerous assets while evading detection. Our results also support recent recommendations of paying attention to individual sellers rather than entire DWMs40. Law enforcement agencies, however, have only recently started targeting individual sellers. The first operation took place in 2018 and successfully led to the arrest of 35 sellers41, while the largest operation to date occurred in 2020 and led to 179 arrests in six different countries42.

At the time, it had over 600,000 users, 17,000 listings, and approximately €250 million in transactions. Authorities seized €7.8 million and arrested operators in Germany, Spain, Sweden, Romania, the Netherlands, and the US Europol leads takedown of Archetyp. These listings often include detailed descriptions, user reviews, and even shipping guarantees. One of the most common types of illicit goods is stolen login credentials, often collected from data breaches. These “credential dumps” allow criminals to access online accounts, steal identities, and commit fraud.

The report did, however, present some more positive figures, including a year-over-year decline in revenue from crypto-based scams. Although scams remain one of the biggest drivers of crypto-based crime, with $4.6 billion in revenue for 2023, the figure was down from the previous year’s $5.9 billion. As Hydra did, many of these markets have continued the tradition of including drug harm reduction information for drug buyers, such as providing drug testing and medical advice. “The RuTor forum has launched a series of webinars on medical topics, including first aid and overdose scenarios,” said Aleksey Lakhov, of St. Petersburg-based drug project Drugmap.ru. But Russians fleeing the country since the war have still been able to buy drugs on the dark web.

Our price index grew with the addition of nine payment processing services. New websites and forums were created nearly overnight and very quickly filled the gap left by the sites taken down by authorities. This, however, did little to reduce the supply of illicit goods and services on the dark web. Looking ahead, the focus will likely shift toward decentralized autonomous organizations (DAOs), which could revolutionize governance and decision-making within darknet platforms. By eliminating centralized control, these systems promise greater resilience and adaptability, ensuring the continued growth and evolution of the darknet economy. Have streamlined the trading process, enhancing user satisfaction and market efficiency.

Dutch police discovered the true location in 2016.[4] Law enforcement quickly began monitoring all actions on the site. Administrators soon moved the site to another unknown host, but law enforcement got another break in April 2017, which allowed them to identify the new hosting company, in Lithuania. The Dutch National Police successfully located and seized the server infrastructure hosting Archetyp Market at a data center in the Netherlands, effectively terminating the platform’s operations. Norton VPN fortifies your internet connection with ultra-secure AES-256 encryption, masks your IP, and never logs your activity. And, with an automatic kill switch that guards against unexpected exposure if the connection drops, you can enjoy powerful privacy protection as you navigate even the darker corners of the web.

Some of the biggest markets have disappeared within just a few weeks in the latter half of 2022. Ever since Silk Road went down, several dark web marketplaces have kept coming and several of them shut down again. To stop the marketplaces is not a walk in the park as it takes immense effort from authorities like the FBI and international law enforcement. The darknet markets keep on popping even when the authorities keep getting hard on them. While there are several darknet markets, each features unique characteristics tailored to various user needs. Perhaps, the figures can tell you what your personal information is worth when it lands on the dark web.

The marketplace sold a variety of content, including drugs, stolen data, and counterfeit consumer goods, all using cryptocurrency. The market also had accompanying forums, hosted on a different URL, where buyers, vendors, and other members of the community could interact. Abacus Market appeared on the scene in 2021 and quickly became one of the heavyweights among English-speaking markets on the dark web. The categories are well organized, ranging from drugs and fraud to digital products, guides, and malware.What really sets it apart is its focus on security and usability. It supports PGP encryption, two-factor authentication (2FA), alerts against fake sites (antiphishing), and a verification system for sellers.