By analysing the temporal evolution of stable pairs, we unveil that DWMs acted as meeting points for 37,192 users (out of around 16 million), whose trading volume is estimated to be $417 million. Importantly, these newly formed stable pairs persist over time and transact for several months even after the closure of the DWM that spurred their formation. Finally, we observe that COVID-19 only had a temporary impact on the evolution of stable U2U pairs, which continued to increase their trading volume throughout 2020. Drughub’s 600+ vendors specialize almost exclusively in pharmaceuticals, with 90% of its 15,000+ listings dedicated to prescription drugs, recreational substances, and rare compounds.
We count a total of 11 million transactions around all DWMs, that goes down to 9.9 million when multiple counting is avoided. Similarly, the simple sum of the single trading volumes surrounding all DWMs amounts to $33 billion, while the overall trading volume in all unique U2U pairs is $30 billion. Among the 40 large DWMs under consideration, 17 participate in at least one transaction in either 2020 or 2021, while the remaining 23 closed before 2020. Notably, our dataset includes Silk Road (the first modern DWM)1, Alphabay (once the leading DWM)44, and Hydra (currently the largest DWM in Russia)12. Other general statistics about our dataset can be found in the Section S3.
Bitcoin Miner IREN’s AI Push Gains Momentum, Price Target Hiked 60% To $37: Canaccord
The victims, who are common users, businesses, and even banks, who end up paying the price. It became the blueprint for other dark web marketplaces that tried to take its place. Imagine trusting a site where you’ve been buying or selling for months, and everything seems legit. Some marketplace operators first build trust by running a legitimate platform. While hiring a hacker might sound like something out of a movie, it’s a very real threat.
Torrez Market Vendors
For each entity, we keep track of the cumulative values of the six features for each transaction performed by the entity over time. To be classified as a seller, an entity must simultaneously satisfy the six feature threshold criteria, as follows. From 2012 to 2016, the largest component of S2S network continuously grows in number of nodes and connections, as shown in Fig. Then, during 2017 and 2018, it shows the structural change due to operation Bayonet, when it shrinks. However, unlike the multiseller network, the S2S network recovers during 2019 and 2020, but slower than the multibuyer network recovery. Therefore, the S2S network appears to be more resilient than the multiseller network but less than the multibuyer network.
Much like with drug sales, a similar pattern of task differentiation emerged among darknet markets providing cybercriminal services. In the chart below, we see that the DNM Aggregator emerged as the clear leader among fraud shops enabling cybercrime, and Exploit.in and Kraken Market almost equally sold tools used to facilitate ransomware attacks. As for cybercriminal administration, the category includes inflows from ransomware affiliate wallets. This includes purchases such as malicious software and supporting services which cybercriminals sometimes make using escrow services on crime forums. Here, we set out to find the main actors in the DWM ecosystem and assess their systemic impact on a dataset of 40 million Bitcoin transactions involving the 31 major markets in the period 2011–2021. Importantly, the algorithm returns reasonable estimates for the number of sellers when compared against a benchmark of nine DWMs where estimates exist.
Cryptocurrencies: The Financial Lifeline Of The Dark Web
The platform’s design is sharp and modern, tailored to improve trading with tools like category filters, live seller stats, and a penalty setup that benches sellers below 90% ratings. This strict screening keeps scams under 1%, earning Archetyp props for reliability. Its 28,000+ listings don’t match giants like Alphabay, but its quality focus delivers a polished experience—top sellers like “ElitePharma” and “CodeMaster” hit 99% ratings, offering rare finds you won’t see elsewhere. That premium angle means prices run 10–15% above high-volume markets, but users say the goods are worth it. Abacus leans hard on its payment protection system, hitting a 98% success rate—one of the best we’ve tracked—keeping deals smooth between its 15,000+ users and 1,200+ sellers with few hiccups.
How To Spot A Scam Vendor?
Their presence can make you wonder why darknet markets and not just the regular online stores. Darknet markets were one of two categories of crypto crime that saw revenues rise in 2023. In total, darknet markets and fraud shops received $1.7 billion last year, a rebound from 2022 — the year that saw the sizable Hydra Marketplace close. The ensuing war for darknet market dominance that began in 2022 continued into 2023, but no other market has since matched Hydra’s financial success. Torrez fuels 30,000+ listings and $6M monthly trades via BTC and XMR, securing a 9% share. With 16,000+ users and 1,500+ vendors, it’s a bustling hub for dark pool commerce.
Russian Market
Previous analyses of U2U trading relationships around DWMs include only two studies21,22 based on unstructured21 or semi-structured22 interviews of 17 users of Silk Road and 13 sellers on various DWMs, respectively. Here, we dramatically extend previous work by exploring the collective emergence and structure of U2U pairs. First, we observe that the U2U network, formed by all transactions between pairs of users, has a larger trading volume than DWMs themselves. We then identify stable U2U trading relationships, which represent a subset of persistent pairs in our dataset31,32 forming the backbone of the U2U network. We find that 137,667 (i.e., 1.7% out of 7.85 million total) pairs are stable, generating a total trading volume of $1.5 billion (i.e., 5% out of $30 billion total volume). We reveal that stable U2U pairs play a crucial role for marketplaces by spending significantly more time and generating far greater transaction volume with DWMs than other users.
Escrow Surge
- The content published on this website is not aimed to give any kind of financial, investment, trading, or any other form of advice.
- Top vendors like “PharmaKing” and “MediSource” offer exclusive medications, driving Drughub’s 10% drug trade share, though its smaller pool limits variety outside pharma.
- Financial innovation, including DeFi and CBDCs, must balance security and privacy.
- Freshtools was established in 2019 and offers various stolen credentials, accounts, and host protocols like RDP.
While all categories see spikes in July around the same time as a Bitcoin price surge, darknet markets exhibit a much less dramatic spike than the others. Looking across the entire year, darknet markets’ transaction activity remains within a much narrower volume range, suggesting that customer behavior is less influenced by changes to Bitcoin’s price. While darknet markets’ total share of incoming cryptocurrency activity remains extremely low at 0.08%, recent increased volume speaks to the resilience of darknet markets in the face of heightened law enforcement scrutiny. However, if we’re being honest, the majority of activity on darknet markets involves illegal or heavily regulated items.
In this darkest corner of the internet, that gun becomes an illegal weapon. “Over the years some markets … developed a robust catalog of illicit services like money laundering, fiat offramping, and products that enable cyber-criminal activities like ransomware and malware attacks. One such sophisticated darknet market, Hydra, offered all that and more,” Chainalysis explained. Mega Darknet Market is the dominant drug supply source for drug vendors on other darknet sites, holding a 63.4% share of that market. When looking at darknet drug markets serving Russia-based customers, Kraken Market captured 30.9% of market share, with Blacksprut and Mega Darknet markets closely following.
Abacus Vs Alphabay
- China-based precursor manufacturers mark the beginning of the synthetic drug supply chain.
- It brings together a team of moderators and technicians who have moved on from its famous predecessor, maintaining high standards of service and guaranteeing safe anonymity for users…
- Vendors on Hydra also offered services such as “Hacking for Hire,” “Ransomware as a Service” (“RaaS”), and a myriad of money laundering features.
- Together, these ten markets handle over $50 million in monthly trades, showing their clout in the hidden economy.
- Archetyp uses AES-256 encryption with PGP, mandatory since a 2022 phishing scare, securing its 12,000+ users.
Operation RapTor’s scale reflects a new era of international coordination. U.S. agencies like the FBI, DEA, IRS-CI, and HSI worked alongside Europol, the U.K.’s NCA, and law enforcement from over a dozen countries. Incognito, like other modern darknet platforms, operated entirely on cryptocurrency—primarily Bitcoin and Monero. Buyers and sellers used wallets controlled either directly or through third-party mixers and exchanges. Sellers like “BohemianRx” and “DataVault” hold 96% ratings, delivering steady drugs and digital goods with 92% shipping reliability. Bohemia’s 22,000+ listings look modest next to Alphabay’s 60,000, but its stability keeps the experience consistent, with scams below 3%.
According to a July 14 report by TRM Labs, the site, its backup portal, and all related servers have been taken down. Investigators noted that the operators likely shut everything down and left with user funds. In another significant operation, the FBI and Department of Justice dismantled the Qakbot malware network, active since 2008. Abacus had recently grown in dominance after Europol’s June takedown of Archetyp Market, handling $6.3 million in monthly sales and controlling over 70% of Bitcoin-enabled Western darknet trade.
Cryptocurrency is commonly used on darknet markets due to its perceived anonymity and its ease and efficiency for transferring funds across international borders. In particular, our dataset does not include any attributes related to either users or their Bitcoin transactions, such as, whether the transaction represents an actual purchase or not. Moreover, we do not have information about which users trade with other users on the same DWM. Finally, our coverage of DWMs, albeit extensive, may lack information on other trading forums where users could have met. These distributions are explored for each of the 40 DWMs under consideration in Figure S5 and S6, respectively.
