Identifying key players in dark web marketplaces through Bitcoin transaction networks Scientific Reports

The collapse of Abacus Market highlights the ongoing volatility in the Western darknet ecosystem, where sustained law enforcement pressure has created an environment of constant uncertainty. The platform’s success was reflected in its growing market dominance, rising from 10% market share in 2022 to over 70% in 2024. Welcome to this collection of darknet resources, curated exclusively for educational and informational purposes. This repository serves as a knowledge hub for individuals interested in understanding the structure, functionalities, and applications of the darknet. Please note that all material provided here is aimed at promoting awareness, responsible research, and ethical use of information. Geopolitical tensions will likely fuel the rise of hacktivism and ransomware in the Middle East.

Darknet market revenues rose slightly, but have yet to regain Hydra Marketplace highs

In 2023, Chainalysis discovered that some popular fraud shops rely on payment processors as a way to reduce their own costs, add efficiency to their operations, and perhaps add a layer of security to transactions. Genesis Market extensively used a payment processor called UAPS, so much that the processor’s average inflows fell by 25.7% after Genesis closed last April. Regardless, UAPS remains a key provider of payment infrastructure to top fraud shops.

Drugs

The dark web alert system is designed to urge you to take action before any significant harm is done. Even if you’ve never visited these markets, your personal and financial data might already be there, having been leaked through a data breach. Criminals use this information for money laundering, opening bank accounts, applying for loans, and draining your finances. A thriving category of illicit goods and services sold on dark web markets is that of scans of personal documents. As with our previous reports, we gather data by scanning Dark Web marketplaces, forums, and websites.

Size of listings

• Its emphasis on user anonymity and document forgery makes it a core tool for identity fraud.
• Darknet markets have emerged as a sophisticated ecosystem for trade, offering a wide range of products and services.
• As the world navigated an evolving cybersecurity landscape in 2024, trends in malware, ransomware, and dark web activities highlighted the increasing sophistication of cybercriminal tactics.
• Cybercrime enablement represents flows from ransomware, stolen funds, malware, or fraud shops to darknet markets.
• Bohemia is a modern dark web marketplace with a great user interface that is easy to use and navigate.
• Meanwhile, retail vendors, who operate on a smaller scale, are holding more of their illicit earnings in personal wallets, delaying conversion to fiat to avoid detection.
• Edges are multihomers, i.e., traders that are simultaneously active in both markets (sellers in the multiseller network, and buyers in the multibuyer network).
• The stolen data supply chain begins with producers—hackers who exploit vulnerable systems and steal sensitive information such as credit card numbers, bank account information, and Social Security numbers.
• These marketplaces accounted for over 97% of illicit revenue generated through Bitcoin and TRON transactions.

The unique part is that the platform offers free samples of stolen information, often to attract more customers. In this era, it takes one wrong click and all your sensitive data ends up in the wrong hands. Therefore, you need to take your privacy seriously and start by using strong and unique passwords for every online account you open.

Scams and fraudulent activities on the darknet markets

These digital currencies provide a degree of anonymity, as transactions are recorded on a public ledger but do not directly link users to their real-world identities. To purchase illicit goods or services, users deposit cryptocurrency into an escrow system or directly to the seller, and the cryptocurrency is held until the buyer confirms the satisfaction of the transaction. The Silk Road was a famous dark web marketplace where users could buy and sell goods and services anonymously.

Russia Blacklists Crypto Exchange WhiteBIT Over Ukraine Support

Of course, not all activity on the dark web is criminal, but such marketplaces are where a lot of illegal trade and money laundering happens. By relying on encryption, pseudo-anonymous currencies, and network-level anonymity, they create a false sense of safety, drawing in both buyers and sellers. When it comes to cybercriminal enablement, markets like Kraken Market, the DNM Aggregator, and Exploit.in are go-to services, providing bad actors with tools to carry out ransomware attacks, hacks, and more. Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products. In addition to that activity, markets like these host vendors that advertise their own cashout or swapping services, resulting in tens of millions of dollars in laundered funds.

Stolen data ecosystem

On a smaller scale, Mega Darknet Market placed a few ads with QR codes in public places like Moscow subway trains. While tactics like these may have helped boost revenue for both markets, again, they have yet to match Hydra’s sizable financial success. Pudgy Penguins is emerging as one of the strongest NFT-native brands of this cycle, shifting from speculative “digital luxury goods” into a multi-vertical consumer IP platform. Its strategy is to acquire users through mainstream channels first; toys, retail partnerships and viral media, then onboard them into Web3 through games, NFTs and the PENGU token. “After major exchanges delisted XMR, we observed a significant increase in bitcoin inflows,” Jardine said in an interview with CoinDesk.

Security & Anonymity Model (as described publicly)

Besides, not everyone wants to purchase an illegal item – some want items anonymously. Next, we extracted information about stolen data products from the markets on a weekly basis for eight months, from September 1, 2020, through April 30, 2021. We then used this information to darknet marketplaces 2026 determine the number of vendors selling stolen data products, the number of stolen data products advertised, the number of products sold, and the amount of revenue generated. Silk Road, which emerged in 2011, combined TOR and bitcoin to become the first known darknet market.

Fraud shops use payment processor to boost efficiency

Law enforcement regularly shuts down these markets, but new ones continuously emerge. By 2025, these platforms are expected to further refine their operations, offering enhanced privacy and efficiency for users engaged in secure online trade. The integration of blockchain technology and decentralized marketplaces has already begun to reshape the landscape, ensuring that transactions remain anonymous and resistant to external interference. These platforms have created a thriving digital economy, with vendors and buyers engaging in transactions that are both efficient and secure.

Best Remote Administration Tools (RAT Tools) – 2026

The concept of darknets emerged as a response to concerns about digital privacy and government surveillance. One of the most well-known technologies enabling darknets is the Tor network, which was developed by the U.S. Tor, short for “The Onion Router,” routes internet traffic through a global network of volunteer-operated servers to anonymize a user’s online activity. This technology initially had noble intentions, aiming to protect activists, whistleblowers, and individuals in repressive regimes. However, it soon became a double-edged sword as malicious actors began to exploit its capabilities for illicit purposes. As a user or cybersecurity professional, approaching these marketplaces demands utmost caution, thorough knowledge of operational security, and constant awareness of legal boundaries.

Likewise, law enforcement agencies each day continue to fine-tune their strategies to get past these networks. Nevertheless, most of the items in the darknet markets are illegal or heavily regulated. In fact, according to a study that was done in 2020, over 57% of the websites found on the Tor network contained illegal content. Our research details a thriving underground economy and illicit supply chain enabled by darknet markets. As long as data is routinely stolen, there are likely to be marketplaces for the stolen information. The report also revealed that despite a likely record year for overall crypto crime revenue, inflows to darknet markets and fraud shops declined in 2024.

The 10 Biggest Dark Web Markets in 2025 – Updated List & Security Insights

Its interface makes it easy to identify clone websites and ensures that users always use the authentic site. During our tests for the research, we were able to register with a bogus email and a random username. All that one can expect from a deep web marketplace when it comes to anonymity and security. For a local machine configuration, he recommends a computer purchased for cash running Linux, using a local Tor transparent proxy.

This multi-role classification, to be implemented in future work, can help gain a more nuanced understanding of the ecosystem and the structure of the dark web supply chains. Until 2012, there is only one active market, namely Silk Road market, and hence no multihomer activity. From 2013 until 2015, the multiseller network grows in terms of connectivity, showing an increasing number of edges spread across different markets. During 2016 and 2017, the edges are polarized by AlphaBay, the dominant market (see Fig. 3). Then, between 2017 and 2018, there is a drastic structural change in the multiseller network structure due to operation Bayonet, after which the connections almost vanished.

• Customer reviews found on the Abacus site indicate that some of its American vendors sell drug products laced with fentanyl.
• All content in this repository is published solely for educational use and is intended to promote ethical research and knowledge.
• Participation in dark web marketplaces can lead to serious criminal charges, even if involvement seems limited.
• And beware—while many explore out of curiosity or for research purposes, it’s important to remember that engaging with these platforms, even as an observer, can lead to serious legal and ethical consequences.

Self‑described landing pages also advertise additional coins and platform hardening features, but these claims are not independently verified. Ideal marketplaces support anonymous browsing through networks like Tor and I2P, utilize privacy-focused cryptocurrencies such as Monero, and implement measures to prevent tracking and transaction tracing. Platforms that provide clear guidelines for maintaining operational security (OpSec) and offer built-in tools for data obfuscation are especially favored. Launched after the takedown of AlphaBay in 2021, Abacus Market has rapidly risen to prominence.

• Furthermore, inexperienced users unfamiliar with secure cryptocurrency practices are particularly susceptible to these threats, risking the loss of their entire funds.
• While not an onion site, Tor Metrics can provide a fascinating peek “under the hood” of the dark web.
• The results further support the recent efforts of law enforcement agencies to focus on individual sellers43,44,45, as well as, more recently, also buyers46,47.
• These aren’t distant problems—they are immediate, and they affect public safety, financial systems, and global cooperation.
• Dark web markets work much like regular e-commerce websites but with extra layers of anonymity and encryption.
• Some of these sites have turned to influencers to boost their publicity campaigns.
• Constant uncertainty, fear of scams, and enforcement pressure create sustained stress.

To access this marketplace, you must register, but before that, you must verify yourself as a human by passing a CAPTCHA test. Analysts rely on publicly available sources such as cybersecurity reports, court documents, and research publications. This helps build a picture of marketplace activity without interacting with the platforms themselves. Participation in dark web marketplaces can lead to serious criminal charges, even if involvement seems limited. Law enforcement investigations often span years and rely on digital traces collected over time.

Crypto Compliance

After a major external shock in 2017, the S2S network shrinks but, unlike the multiseller network, recovers, and grows again (though slower than the multibuyer network). This suggests that the multiseller activity is sensitive to external shocks but also that it yields higher profits. The structural change in the multiseller network and the resilience of the multibuyer network. Temporal network of multisellers (top) and multibuyers (bottom) between markets for each year. Edges are multihomers, i.e., traders that are simultaneously active in both markets (sellers in the multiseller network, and buyers in the multibuyer network).

Government of Canada reporting confirms that traffickers use both the surface web and dark web to sell drugs delivered by mail or courier. The same reports highlight gaps in the national ability to measure the full scale of this activity. Journalists use the dark web to communicate with sources anonymously, and whistleblowers rely on it to share sensitive information without fear of retaliation.

• Then, we investigate both market star-graphs and user-to-user networks, and highlight the importance of a new class of users, namely ‘multihomers’, who operate on multiple marketplaces concurrently.
• Such decentralization, along with the reuse of leaked malware source codes, will allow new, low-skilled actors to enter the ransomware ecosystem.
• From 2013 until 2015, the multiseller network grows in terms of connectivity, showing an increasing number of edges spread across different markets.
• In fact, WeTheNorth is more of a private club than an open market – something its operators want.
• Others collapse after arrests, server seizures, or exposure caused by poor operational security.
• Its intuitive interface and advanced search features make it easy to find local and global products.

Marketplaces recorded 632,207 sales across these markets, which generated $140,337,999 in total revenue. On average, marketplaces had 26,342 sales and generated $5,847,417 in revenue. The stolen data supply chain begins with producers—hackers who exploit vulnerable systems and steal sensitive information such as credit card numbers, bank account information, and Social Security numbers. Next, the stolen data is advertised by wholesalers and distributors who sell the data. Finally, the data is purchased by consumers who use it to commit various forms of fraud, including fraudulent credit card transactions, identity theft, and phishing attacks. It is common to hear news reports about large data breaches, but what happens once your personal data is stolen?

We’re back with another video in our Webz Insider video series on everything web data. Learn how to automate financial risk reports using AI and news data with this guide for product managers, featuring tools from Webz.io and OpenAI. Established in 2022, WizardShop is one of the biggest data stores on the dark web, focusing mainly on carding and financial data. In repressive regimes, darknets play a vital role in enabling free speech and access to uncensored information. Tools like Tor are used to bypass government-imposed firewalls and surveillance, ensuring open communication. The significance here is the preservation of civil liberties and the right to information.

Public sources also indicate support for both Bitcoin and privacy‑centric coins, aligning with broader ecosystem trends. And beware—while many explore out of curiosity or for research purposes, it’s important to remember that engaging with these platforms, even as an observer, can lead to serious legal and ethical consequences. To remain anonymous about your purchases on the dark web, always use cryptocurrency as your mode of payment. If a seller encourages you to opt for other well-known and commonly used payment methods, then the person is likely to be a scammer, and you must not make any deal with them. Having JavaScript enabled on the dark web can cause havoc because it can reveal your IP address to your website.

You can legally browse darknet sites for legitimate purposes like research or privacy protection. However, engaging in illegal activities on the darknet is against the law and can result in serious criminal charges. If you access illegal content or participate in criminal transactions, you face legal consequences. The legality depends on your activities and your country’s specific laws regarding darknet use.

According to a 2024 report citing unsealed court documents, USDT was widely available in Mexico at a discount, allowing resellers to profit in countries like Colombia. The arrest of Durov heightened fears that Telegram would start cooperating with authorities, forcing vendors to find new places to operate. Nexus opened in late-2023 after the Fall of Bohemia and quickly absorbed many of that community’s well-rated vendors. It runs on a rewritten version of the old Versus codebase, so the UI feels familiar but adds per-order “vendor bond staking” meant to reduce exit temptations. Discover how SentinelOne AI SIEM can transform your SOC into an autonomous powerhouse. Contact us today for a personalized demo and see the future of security in action.

According to the TRM Labs 2025 Crypto Crime Report, Russian-language darknet marketplaces brought in more than $1.7 billion in 2024, continuing a year-over-year increase first noted in 2023. Valued at approximately $15 million, Abacus Market is one of the most lucrative platforms in the dark web ecosystem. Darknets are not limited to criminal activities; nation-state actors use these hidden platforms for espionage, disseminating propaganda, and recruiting agents. Governments and businesses must invest in advanced threat intelligence, cyber defense, and counter-espionage measures.

The period of dominance by Silk Road is unique, because the ecosystem structure is effectively composed of and dominated by a single market, expressed by a market share equal to one, as shown in Fig. After the shutdown of Silk Road, in the last quarter of 2013, the ecosystem evolves to a structure where several markets coexist. This structural change is reflected in the median net income of sellers and buyers, as shown in Fig. While the curves for the seller and buyer median net income were negatively correlated before Silk Road’s shutdown, after that moment they became positively correlated.