By leveraging the decentralized nature of the Tor network, users can engage in transactions without exposing their identities or compromising their privacy. This has been particularly beneficial for vendors and buyers who prioritize discretion in their operations. Some believe STYX is the OG darknet market when it comes to financial crimes.

Strengths & Trade‑offs

The impact of the COVID-19 pandemic has, however, had different phases, punctuated by the number and level of measures introduced around the world. After that, trading volume sharply increased over the whole of 2020, see Figure S8. The number of stable U2U pairs created each day was, however, steady over time during 2020, even though more U2U pairs were created compared to the same period in 2019, see Figure S9. Overall, stable U2U pairs have shown resilience to the systemic stress caused by COVID-19, suggesting, once again, that these trading relationships are fundamentally independent from the underlying DWMs. Surprisingly, although DWMs have gained significant attention from the scientific community and law enforcement agencies, little is known about the key players sustaining their unusual adaptability and responsive dynamics. However, owing to the difficulty of identifying relevant transactions, most studies rely on user surveys17,18 and data scraped from DWM websites19,20,21,22,23,24.

• The result is 40 distinct marketplace ego networks containing user-DWM and U2U transactions, whose typical structure is depicted in Fig.
• Many people also prefer to buy goods and services online, which allows for more opportunities to steal people’s personal data and financial information.
• Experienced users typically prefer marketplaces with robust vendor rating systems, detailed feedback options, and transparent dispute resolution processes.
• Each marketplace is a star-graph where the central node is the marketplace, and the leaf nodes, i.e., the first-neighbors, are the marketplace users.
• Its interface makes it easy to identify clone websites and ensures that users always use the authentic site.
• On New Year’s Eve people in Moscow spotted what looked like an up-and-coming tech startup projecting its logo onto the sides of various buildings.
• Businesses should be aware of the potential for data leaks and invest in data loss prevention measures.
• Previous studies have shown that, although the number of users and transactions is larger in markets, the trading volume in the U2U network is larger than that of markets13.

Early warning signals for predicting cryptomarket vendor success using dark net forum networks

During 2016 and 2017, AphaBay becomes the dominant market (see Fig. 3), polarizing sellers around its own ecosystem, such that the fraction of multisellers decreases to 10% of all sellers until its closure. Then, after operation Bayonet, the number of sellers in all categories and multisellers significantly drops, as shown in Fig. Notably, the number of multisellers suffers the largest drop of \(-99\%\) by the end of the first quarter of 2018. Interestingly, while the other categories of sellers show signs of recovery relative to their previous levels, the number of multisellers remains low after that shock (see Supplementary Information Section S4). The empty point on the multiseller median income line demarcates the quarter with only two multisellers.

Exit scams

While market dynamics may have shifted since, the cited data illustrates how cartels had previously exploited crypto ecosystems. The TRM Labs report also revealed that crypto use in vendor shop drug sales more than doubled in 2024, reaching over $600 million in volume. The findings by TRM Labs align with other investigations into the intersection of cryptocurrency and the drug trade. TRM Labs found that only four Russian-language marketplaces exited the ecosystem in 2024, out of approximately 20 operating during the year.

Russian market

While the Bitcoin blockchain is publicly available on Bitcoin core37 or other third-party APIs such as Blockchain.com38, a market or a user can generate a new address for each transaction. To track the transactions of markets and users as entities, the data need to be pre-processed in order to map groups of addresses into entities. Examples include the sale of high-quality products with low risk for contamination (including lacing and cutting), vendor-tested products, sharing of trip reports, and online discussion of harm reduction practices. Previous analyses of U2U trading relationships around DWMs include only two studies21,22 based on unstructured21 or semi-structured22 interviews of 17 users of Silk Road and 13 sellers on various DWMs, respectively. Here, we dramatically extend previous work by exploring the collective emergence and structure of U2U pairs.

• The darknet market lists for 2025 highlight the evolution of these platforms, emphasizing advanced encryption and user-friendly interfaces.
• The broad category mix positions Vortex as an entry-level market for general illicit trade.
• Days later RuTor was targeted for another round of cyber attacks, this time by Killnet.
• Looking ahead, the focus will likely shift toward decentralized autonomous organizations (DAOs), which could revolutionize governance and decision-making within darknet platforms.
• However, overall the sector has fragmented somewhat from the days when Silk Road, AlphaBay, Wall Street Market and Hydra ruled the roost.
• In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting.
• As for Genesis Market cybercriminals located in the Netherlands, three have already been convicted and received prison sentences considered severe for that jurisdiction.
• Flugsvamp 4.0 (FS4) launched on November 2, 2021 as the successor to Sweden’s domestic‑shipping cryptomarket Flugsvamp 3.0, which its administrators had taken offline on October 30–31, 2021.
• The TRM Labs report also revealed that crypto use in vendor shop drug sales more than doubled in 2024, reaching over $600 million in volume.

FIGR_HELOC

The darknet is a mysterious and often misunderstood part of the internet, attracting both intrigue and concern. Darknet markets, in particular, have gained attention for their role in facilitating the exchange of illicit goods and services. Despite their controversial nature, these marketplaces continue to evolve, offering a glimpse into the darker side of online commerce. As cyber threat intelligence professionals monitor these markets, they gain insights into emerging threats and malicious activities that can impact organizations and individuals.

Payment Escrow

Although dark-web marketplaces utilize technologies like Tor and I2P to enhance anonymity, these methods are not foolproof. Law enforcement agencies continuously improve their ability to trace transactions and monitor marketplace activity. Simple mistakes—such as inadequate operational security practices, sharing identifiable details, or using compromised devices—can quickly compromise anonymity and expose users’ real-world identities. Analyst write‑ups point to a wide spectrum of vendor‑run listings, with drugs typically dominant and fraud/digital‑goods categories active. These summaries echo the familiar “escrow + vendor reputation” model—reviews and sales history as primary trust signals. Because hidden services evolve quickly, product counts and mix should be read as indicative, not definitive.

What Risks Are Associated With Dark Web Marketplaces?

Beware of sharing your financial details on the dark web, as this can result in identity theft and your bank account being compromised. It’s another dark net marketplace that grabbed a lot of attention was the Hydra market. It accepted payments through Bitcoin and the Escrow system and ensured that users’ identities remain anonymous during their purchases. Cypher marketplace has been on the list of the best dark web shops for a while and deals with the business of a variety of products and services.

Alphabay

The stolen data supply chain begins with producers—hackers who exploit vulnerable systems and steal sensitive information such as credit card numbers, bank account information, and Social Security numbers. Next, the stolen data is advertised by wholesalers and distributors who sell the data. Finally, the data is purchased by consumers who use it to commit various forms of fraud, including fraudulent credit card transactions, identity theft, and phishing attacks. It is common to hear news reports about large data breaches, but what happens once your personal data is stolen?

Airlock Digital Announces Independent TEI Study Quantifying Measurable ROI & Security Impact

In 2024, DeFi played an increasing role in storing, transferring, and obfuscating illicit crypto proceeds. Fifth, we consider the lifetime of each entity i at time t, defined as the time interval between the first and the last transaction performed by the entity until time t, denoted by \(\ell _i(t)\). This feature is satisfied when \(\ell _i(t) \ge L\), where L is the fixed value of minimum lifetime. Some, such as Julia Finess, have become popular and also made a name for themselves on TikTok.

Drughub Market

We developed Lunar to monitor the deep and dark web, including dark web marketplace sites. Dark markets include features similar to those found in legitimate e-commerce platforms, such as product listings, user reviews, ratings, and customer support. These features help create a sense of ‘trust’ among users, even in the criminal ecosystem. Treat category rosters and counts from tracker pages as indicative, not definitive.

Adopt secure ATM habits

This underlines the economic importance of U2U transactions in the Bitcoin ecosystem relative to DWMs. Essential advice for navigating darknet marketplaces safely and effectively in 2025. However, the success of law enforcement is just one possible explanation for this decline. This theory is supported by the fact the number of active darknet markets themselves are also on the decline. Darknet market vendors have suffered—as legitimate vendors have—through a strained postage and shipping network on account of COVID-19.

• Cybercriminals use these platforms to traffic in stolen data, execute targeted ransomware attacks, and collaborate on advanced hacking techniques.
• While no information is stolen during a DDoS attack, it can be used for extortion or to conceal other hacking activities.
• This includes purchases such as malicious software and supporting services which cybercriminals sometimes make using escrow services on crime forums.
• Buyers send money to the marketplace, which in turn sends the money to the seller.
• Other markets like Aurora, DeepMart, and WhiteHouse were also on track to reach the revenue of a midsize company if given a full year to earn.
• Many listings involve stolen personal information, including credit card data, Social Security details, and full identity profiles.
• Yet, like the Hydra of Greek legend, whose heads multiply when they are severed, a new generation of darknet markets popped up to challenge for control of a market worth at least $1.37 billion, according to unofficial estimates.
• Features such as advanced search filters, customer reviews, and escrow systems have become standard, ensuring transparency and trust between buyers and sellers.

We deliver contextualized, actionable intelligence through our dedicated platform or API integration, ensuring that you can respond effectively to darknet threats. Notably, Abacus explicitly forbids highly dangerous goods, including weapons, explosives, and exploitative material, which has helped maintain a relatively favorable reputation among its user base. While this topic may seem distant for most people, understanding how these spaces operate is crucial.

The use of escrow systems and reputation-based feedback mechanisms has fostered trust among users, ensuring a smooth trading experience. As a result, darknet markets have become a hub for innovation, with new features and services being introduced regularly to meet the evolving needs of the community. Dark markets are online platforms on the darknet where illegal goods and services are traded.

Drugs

Scammed funds are also increasingly moving through decentralized protocols. We use data of DWM transactions on the Bitcoin blockchain pre-processed by Chainalysis Inc. Although other coins are used, such as Monero recently, Bitcoin is still the mostly used in the ecosystem, being supported by more than 93% of markets7,9. The pre-processing relies on established state-of-the-art heuristics to cluster addresses into entities, such as cospending, intelligence-base, and behavioral clustering39,40,41,42. The resulting data set includes for each transaction the source and destination entities, the time, and the value of the transaction. Over the last year, “Alex,” the drug dealer from Moscow, said a new genre of content has been growing on Russian Telegram profiles.

Over the years, these platforms have transformed into sophisticated ecosystems that cater to a wide range of products and services, with a particular emphasis on secure online trade. The integration of cryptocurrencies such as Bitcoin and Monero has played a pivotal role in ensuring anonymity and facilitating seamless transactions, making these markets more accessible and reliable for users worldwide. Dark web marketplaces (DWMs) are online platforms that facilitate illicit trade among millions of users generating billions of dollars in annual revenue.

CISA releases Secure Connectivity Principles Checklist for Operational Technology Networks Connectivity

The last version of the market operated until February of 2023, and a month after that closure, a former AlphaBay vendor pled guilty to distributing fentanyl that caused fatal overdoses in Oregon. The sad reality is the fact that law enforcement agencies can’t track and prosecute perpetrators or even take down such content given the anonymous nature of the dark web. As much as authorities work hard to shut down various sites, it shows what the dark web is capable of doing if left unchecked. Who doesn’t like privacy, especially when dealing with the buying and selling of illegal products and services?

The number of sellers in each category and multisellers as a function of time is shown in Fig. Until the end of 2013, when Silk Road is the dominant market (see Fig. 3), market-only sellers is the dominant category, and there are no multisellers. From the last quarter of 2013, U2U-only sellers become the largest category of sellers and remains as the largest throughout the rest of the observation period. The large number of U2U-only sellers is in accordance with previous results that showed that the trading volume in the U2U network is significantly larger than that of DWMs13 (also see Supplementary Information Figure S8). It has built a reputation for being a reliable source of stolen credit card data and PII.

Even browsing these sites can put you at risk of malware infections or attract unwanted attention from law enforcement. BidenCash became known for regularly leaking huge amounts of stolen credit card data and personal information — often for free. The goal is simple — make financial fraud easy and get as much attention as possible. Some now offer customer support, escrow systems to prevent fraud, and even user-friendly interfaces that make illegal trade feel strangely routine.

WTN Market positions itself as a localized, bilingual marketplace with familiar DNM trust mechanisms (escrow, ratings, forum) and a UI tailored to Canadian users. Those choices do not negate core ecosystem risks—availability volatility, phishing/DDoS, and persistent enforcement pressure—so public details can change quickly. BlackOps Market is described in community sources as a privacy-first, general-purpose dark-web marketplace that emerged in late 2024 and continued gaining visibility into 2025.

Additionally, we analyse the U2U network of transactions, i.e., the transactions between pairs of market first-neighbors where the source and destination nodes are market users without the market as an intermediate. In the U2U network, an edge connects nodes that are not necessarily users of the same market. Previous studies have shown that, although the number of users and transactions is larger in markets, the trading volume in the U2U network is larger than that of markets13.

Unfortunately, the increasing availability of personal information on the Dark Web results in lower costs—and consequently, a higher likelihood—that your accounts will be compromised. There is no shortage of methods to get hacked, but there are just as many ways to defend against it. By following these suggestions, you can deter unwanted intruders from accessing your accounts at home or work. The DDoS attacks listed below are characterized by their target, number of access requests, quality, speed, and duration.

In 2023, Chainalysis discovered that some popular fraud shops rely on payment processors as a way to reduce their own costs, add efficiency to their operations, and perhaps add a layer of security to transactions. Genesis Market extensively used a payment processor called UAPS, so much that the processor’s average inflows fell by 25.7% after Genesis closed last April. Regardless, UAPS remains a key provider of payment infrastructure to top fraud shops. Customer reviews found on the Abacus site indicate that some of its American vendors sell drug products laced with fentanyl. The most recent example is the shutdown of the oldest marketplace Hydra Market in 2022 which took a combined effort of the FBI and the German authorities. Unfortunately, that as well didn’t stop other darknet markets from rising.

It’s not established yet how the drugs were brought to occupied Ukraine but the dealing network likely has some connection with Russian soldiers or non-combat staff. Some of these sites have turned to influencers to boost their publicity campaigns. Earlier this month a Kraken employee told Russian news website Lenta.ru that the market had a dedicated darknet markets active PR department. The collapse of Abacus Market highlights the ongoing volatility in the Western darknet ecosystem, where sustained law enforcement pressure has created an environment of constant uncertainty. The platform’s success was reflected in its growing market dominance, rising from 10% market share in 2022 to over 70% in 2024.