Our research shows that, like most legal commodities, stolen data products flow through a supply chain consisting of producers, wholesalers, and consumers. But this supply chain involves the interconnection of multiple criminal organizations operating in illicit underground marketplaces. With law enforcement agencies improving their ability to track Bitcoin (BTC) transactions, darknet market operators and vendors are moving to Monero (XMR) as their cryptocurrency of choice. In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers. The nodes of the S2S network are active sellers (i.e., sellers that are trading at the time) and two sellers are connected by an edge if at least one transaction was made between them during the considered snapshot period.

The Evolution of Darknet Commerce: Privacy, Security, and Innovation

Like other marketplaces, it also requires registration for new users and accepts payments in Monero. Its look, design, options, and interface are exactly the exact copy of its competitor, but everything else, including buyers, vendors, and servers, is different. At its launch, the platform accepted payments through Litecoin, but now it has incorporated support for other payment methods like Monero and Bitcoin. The platform also cares about its users and uses PGP encryption and two-factor authentication to secure their data and communication. Dark web marketplaces are online markets that exist on hidden networks and cannot be accessed through regular browsers.

How to protect your personal data online

That said, the social network’s data collection and tracking practices may seem at odds with many of the principles motivating dark web users. Concerns about how Meta treats user data have led many people to delete their Facebook profiles or at least limit their social media presence. Onion sites, or dark web websites, are sites on the dark web that can typically only be accessed using special software like the Tor browser.

Regional websites

DWMs are accessed through darknet browsers supporting the onion routing protocol (e.g., Tor), which provides anonymous communication connections35. Additionally, transactions are made with cryptocurrencies, mostly Bitcoin, which also provide anonymity to the transaction parties6,36. While the Bitcoin blockchain is publicly available on Bitcoin core37 or other third-party APIs such as Blockchain.com38, a market or a user can generate a new address for each transaction. To track the transactions of markets and users as entities, the data need to be pre-processed in order to map groups of addresses into entities. The darknet market ecosystem has undergone significant changes over the years, evolving from the days of Silk Road to the diverse and sophisticated platforms we see today.

Cryptocurrency Transactions

Fentanyl and fentanyl-laced drugs also arrive in the United States through Latin America based cartels. U.S. customers predominantly purchase drugs from these groups that are known to have used crypto to source fentanyl precursor chemicals from labs based in China. The cartels then use those chemicals to manufacture fentanyl that is later sold in the U.S. U.S.-based drug vendors on Abacus Market advertising a synthetic opioid called China White, which its customers can purchase using Bitcoin or Monero.

Set Up Tor Browser

Patterns in trust systems, operational behavior, and longevity were also considered. These listings often include detailed descriptions, user reviews, and even shipping guarantees. One of the most common types of illicit goods is stolen login credentials, often collected from data breaches. These “credential dumps” allow criminals to access online accounts, steal identities, and commit fraud. Fake online casinos and social networks are common methods for distributing malware. To avoid infection, it’s best to avoid downloading anything from untrusted sources or websites.

• In light of this, we have chosen the parameters conservatively, obtaining estimates for the number of sellers that are in general smaller than the ones produced by other methods.
• The goal is simple — make financial fraud easy and get as much attention as possible.
• The primary currencies used for transactions are Bitcoin and Monero, ensuring both traceability and privacy for users.
• The marketplace requires merchants to pay fees to sell their products, helping ensure a certain level of quality control.
• The list of sanctioned individuals linked to crypto includes the North Korean hacking group Kimsuky, crypto mixer Sinbad.io, Russian national Ekaterina Zhdanova and the Gaza-based MSB Buy Cash.
• Hacked social media accounts are evidence that cybercriminals have a diverse appetite for Dark Web data products.
• Prices of hacked cryptocurrency accounts still remain overall the highest among all hacked online accounts.

Cypher Marketplace

In conclusion, the darknet ecosystem continues to evolve, driven by technological advancements and the growing demand for secure online trade. As these markets become more sophisticated, they offer users a reliable and efficient platform for conducting transactions, solidifying their position as a cornerstone of the digital economy. Some believe STYX is the OG darknet market when it comes to financial crimes.

Digital Monthly

These records allow criminals to clone physical cards or commit card-not-present attacks. Once users suspect a platform is compromised or dishonest, activity drops quickly and the marketplace either migrates, rebrands, or disappears entirely. Transactions rely on cryptocurrencies to avoid traditional financial systems. Funds are held temporarily by the platform until a transaction is completed or disputed. Prices of hacked cryptocurrency accounts still remain overall the highest among all hacked online accounts. This indicates that hacking such accounts still remains extremely profitable.

Popular dark web marketplaces

We find that trading properties of buyers and sellers reflect the dominance of DWMs in the ecosystem. In particular, we analyse networks of ‘multihomers’, defined as users that are simultaneously trading in multiple markets. We show that these users play a crucial role in the connectivity of the ecosystem because they act as connectors between markets. Analogously, we identify and characterise ‘multisellers’ (i.e., multihomers that are sellers) and ‘multibuyers’ (i.e., multihomers that are buyers). Furthermore, we analyse the seller-to-seller (S2S) network, i.e., the network composed only of transactions among sellers, which can be regarded as a supply chain network of illicit goods and services. We highlight that these networks exhibit different resilience regimes in the presence of external shocks, the ecosystem’s resilience being mostly guaranteed by the network of buyers rather than sellers.

FIGR_HELOC

The S2S network is mostly populated by U2U-only sellers, followed by market-only, and market-U2U (see Supplementary Information Section S5). In panels (b, c), we show the number of all sellers and buyers per quarter, respectively. In panels (d, e), we show the median net income in USD of all sellers and buyers per quarter, respectively. In panels (f, g), we show the PDF of the total money received by each seller and the total money sent by each buyer, respectively.

The 10 Biggest Dark Web Markets in 2025 – Updated List & Security Insights

In the wake of recent headlines announcing actions against Hydra Marketplace by the U.S. and German governments, darknet markets have made an ironic entrance into the spotlight. The market’s extensive product range and robust security measures have made it a popular choice among users. Abacus Market’s rise to prominence underscores the dynamic and competitive nature of dark web markets, where new entrants continually vie for dominance. But according to Ingo Fiedler, co-founder of Blockchain Research Lab, this trend is primarily the result of increasing law enforcement focus on the darknet market industry. Darknet market vendors have suffered—as legitimate vendors have—through a strained postage and shipping network on account of COVID-19.

📚 Contents

The Torrez market is one of the biggest dark net marketplaces, also called a community-driven marketplace. It contains a good selection of product listings that range over 35,000 items. It uses PGP encryption, two-factor authentication, and OPTP authentication to ensure users’ security.

This browser enables access to websites with .onion domain extensions, which are specific to the Tor network. These addresses cannot be resolved by conventional DNS servers, contributing to the hidden nature of darknets. The concept of darknets emerged as a response to concerns about digital privacy and government surveillance.

• Infostealers and drainers will likely be increasingly promoted as subscription-based services, with traffers aiding in their distribution via scam pages and phishing schemes.
• Its impressive anti-DDoS protection feature and easy-to-use interface make this marketplace stand out among the others.
• The last version of the market operated until February of 2023, and a month after that closure, a former AlphaBay vendor pled guilty to distributing fentanyl that caused fatal overdoses in Oregon.
• Nevertheless, as for Empire Market itself; Hackread.com will keep an eye on the situation and update the article accordingly even if it is an exit scam.
• While tactics like these may have helped boost revenue for both markets, again, they have yet to match Hydra’s sizable financial success.

ASAP is a tech nerd’s playground—accepting BTC, LTC, ZCash, and Monero, it’s got options for days. Their DeadDrop system’s a standout—vendors stash your goods IRL, no mailing hassles—and wallet-less payments mean no one’s bolting with your cash, a relief after I got burned once by a shady escrow dodge. Listings aren’t public, but it’s steady—think drugs (weed, pills, some synthetics), a few digital extras like cracked accounts. They’ve got 2FA and encryption that’s tighter than a drum, which I’ve tested against crash-prone sites and found solid.

Print & Digital

On average, marketplaces had 109 unique vendor aliases and 3,222 product listings related to stolen data products. Marketplaces recorded 632,207 sales across these markets, which generated $140,337,999 in total revenue. On average, marketplaces had 26,342 sales and generated $5,847,417 in revenue.

Users in stable pairs meeting both inside and outside DWMs have been growing over the last two years, since the shutdown of AlphaBay9, the largest DWM at the time. In 2020, a total of 6778 pairs of users in stable pairs met inside a DWM, corresponding to 192% of the 2019 level and to 255% of the 2018 level, see Fig. Pairs of users in stable pairs meeting inside a DWM traded for a total of $145 million in 2020, which corresponds to 252% of the 2019 level, and to 593% of the 2018 level, see Fig. The impact of the COVID-19 pandemic has, however, had different phases, punctuated by the number and level of measures introduced around the world. After that, trading volume sharply increased over the whole of 2020, see Figure S8. The number of stable U2U pairs created each day was, however, steady over time during 2020, even though more U2U pairs were created compared to the same period in 2019, see Figure S9.

• Essentially, these payment processors provide a white label service for darknet markets and fraud shops, and a seamless checkout experience for those services’ customers.
• 2c which shows that since 2011 U2U transactions have consistently involved greater monthly volume than the volume sent to all DWMs.
• The results of that investigation were published in a report called Technical analysis of the Genesis Market.
• Its interface is easy to navigate, and it has a reliable escrow system, as well as allowing payments with Bitcoin and Monero.
• This solution scans dark web forums to alert you if your data is being listed, traded, or otherwise exposed.
• The trade in fake luxury items and identification documents continues to thrive, driven by the demand for high-quality knockoffs and fraudulent credentials.
• (a) Schematic representation of an ego network surrounding a dark web marketplace (“DWM”, in red).

Security issues

Notably, our dataset includes Silk Road (the first modern DWM)1, Alphabay (once the leading DWM)44, and Hydra (currently the largest DWM in Russia)12. ASAP Market offers 25,000+ listings and $4 million monthly across BTC, XMR, LTC, and USDT, with a 7% share. Its 14,000+ users and 1,000+ vendors leverage multi-crypto flexibility for seamless darknet dark web markets trading. Drughub Market specializes in pharmaceuticals, offering 15,000+ listings and $2 million monthly via BTC. With 8,000+ users and 600+ vendors, it commands a 10% share of darknet drug trades—a rising star since 2023. Archetyp Market delivers 28,000+ listings and $3.5 million in monthly trades using BTC and XMR, securing a 6% market share.

Recently, two interview-based studies have suggested that DWMs may also promote the emergence of direct user-to-user (U2U) trading relationships. Here, we carefully investigate and quantify the scale of U2U trading around DWMs by analysing 31 million Bitcoin transactions among users of 40 DWMs between June 2011 and Jan 2021. We find that half of the DWM users trade through U2U pairs generating a total trading volume greater than DWMs themselves. We then show that hundreds of thousands of DWM users form stable trading pairs that are persistent over time.

This shift will likely drive forum operators to introduce features like automated escrow services and enhanced anonymity to attract users. Hansa was an online darknet market which operated on a hidden service of the Tor network. Archetyp Market functioned as a Tor-based hidden service, accessible only through specialized darknet browsers that utilize onion routing protocols to anonymize user traffic and location data. Facebook’s onion mirror allows people to access it in countries that block the platform, allowing people to connect across digital borders.