Darknet Markets Explained TRM Blog
Categoría: darknet markets
Infostealers and drainers will likely be increasingly promoted as subscription-based services, with traffers aiding in their distribution via scam pages and phishing schemes. Threat actors may also manipulate old or publicly available data to generate hype and damage reputations. Cybercriminals are expected to exploit trusted company-contractor relationships, breaching contractor systems to access corporate data. This tactic, seen in 2024 with incidents involving Ticketmaster and IntelBroker, could lead to an overall rise in data breaches.
- The classification is performed in five steps (see Fig. 1), as detailed next.
- Though many customers are concentrated in Australia, Abacus has vendors and customers around the world, including the United States.
- These schemes leveraged mainstream ad platforms to distribute malware to unsuspecting users.
- Despite these measures, dark web marketplaces are unstable and often shut down due to scams, internal problems, or law-enforcement action.
- Bohemia is a modern dark web marketplace with a great user interface that is easy to use and navigate.
Cryptocurrency
Throughout the whole period of observation, the dominant category of buyers is market-U2U buyers followed by market-only buyers, representing on average 52% and 42% of all buyers, respectively. The U2U-only category is comparatively small, representing only 6% of all buyers on average. The number of market-U2U and market-only buyers also drops as a consequence of operation Bayonet. However, compared to sellers, the drop is notably smaller, and the number of buyers rapidly recovers to previous values. Moreover, the number of multibuyers increases, which suggests a fast response from buyers to external shocks by trying to diversify their sources.
- In repressive regimes, darknets play a vital role in enabling free speech and access to uncensored information.
- In 2019, the FBI started its investigation into Genesis Market and enlisted other government agencies and law enforcement organizations across the world, working towards the market’s closure on April 4, 2023.
- If the address is in one of the cybercrime datasets, the person will receive an email that includes personalized instructions on how to clean up their computer and make it safe again.
- U.S. customers predominantly purchase drugs from these groups that are known to have used crypto to source fentanyl precursor chemicals from labs based in China.
- From 2013 until 2015, the multiseller network grows in terms of connectivity, showing an increasing number of edges spread across different markets.
- Then, after operation Bayonet, the number of sellers in all categories and multisellers significantly drops, as shown in Fig.
Illicit Drugs
Ethically, they must minimize harm, responsibly handle any stolen or sensitive data (often notifying victims or law enforcement), avoid entrapment, and maintain research integrity. An award-winning cybercrime threat intelligence firm, KELA’s mission is to provide 100% real, actionable intelligence on threats emerging from the cybercrime underground, to support the prevention of digital crimes. Nexus Market is widely described as a second‑generation, general‑purpose dark‑web marketplace that gained traction through 2024–2025. Community trackers place its launch in late 2023 and note a focus on stability, moderation, and a familiar “escrow + vendor‑reputation” model typical of modern DNMs. Public sources also indicate support for both Bitcoin and privacy‑centric coins, aligning with broader ecosystem trends.
Security & Privacy Controls (as described in open sources)
Importantly, the algorithm returns reasonable estimates for the number of sellers when compared against a benchmark of nine DWMs where estimates exist. Then, we reveal a concentration of activity around an elite group of participants, where a large fraction of the trading volume is driven by a small number of players. We find that trading properties of buyers and sellers reflect the dominance of DWMs in the ecosystem. In particular, we analyse networks of ‘multihomers’, defined as users that are simultaneously trading in multiple markets. We show that these users play a crucial role in the connectivity of the ecosystem because they act as connectors between markets. Analogously, we identify and characterise ‘multisellers’ (i.e., multihomers that are sellers) and ‘multibuyers’ (i.e., multihomers that are buyers).
Common Illegal Items
- No dark web marketplace is safe to use because they involve illegal activity, financial risk, and potential legal consequences.
- When looking at darknet drug markets serving Russia-based customers, Kraken Market captured 30.9% of market share, with Blacksprut and Mega Darknet markets closely following.
- Therefore, you need to start by changing your passwords, and you need to notify your credit card or bank provider.
- Then, during 2017 and 2018, it shows the structural change due to operation Bayonet, when it shrinks.
- Overall, our study provides a first step towards a better microscopic characterisation of the DWM ecosystem, indicating a direction of investigation that may be of interest to both researchers and law enforcement agencies.
Therefore, the S2S network can be seen as a proxy for a distribution network of illegal products. In panels (b, c), we show the number of all sellers and buyers per quarter, respectively. In panels (d, e), we show the median net income in USD of all sellers and buyers per quarter, respectively. In panels (f, g), we show the PDF of the total money received by each seller and the total money sent by each buyer, respectively. Our team searched the dark web and put together a list of the most active dark web marketplaces in order to assist you in monitoring illegal trade of products, cybercrime activity, and dark web trends in the dark web space.
Bridging the Divide: Actionable Strategies to Secure Your SaaS Environments
Correspondingly, the multihoming activity is a mechanism that contributes to the ecosystem’s resilience. Because they are already active in more than one market, the migration cost for the multihomers is usually smaller compared to that for non-multihomer users, especially for sellers, that need to rebuilt their reputation23. Our classification shows that the number of sellers is significantly smaller than the number of buyers, as shown in Figs. The number of actors in the ecosystem is affected by several factors, especially market closures. Notably, the number of buyers and sellers significantly drops after the operation Bayonet in the last quarter of 2017, which shut down AlphaBay and Hansa markets, causing a major shock in the ecosystem34.
Illicit and Risky Use-Cases
Defined as illegal, unregulated commercial websites, these dark markets constantly adapt to law enforcement pressures, evolving in complexity and sophistication. Conversely, transaction networks obtained from the blockchain contain the entire transaction data of the DWMs and U2U transactions, allowing a thorough investigation of the ecosystem as a whole. In fact, previous studies on DWM transaction networks have revealed crucial aspects of the ecosystem13,14,15. However, they have so far mainly focused on DWM users, without distinguishing between buyers and sellers, and neglecting the different weight that more active users may have in the system. The reason is that the operational structure of DWMs inherently hides the seller–buyer link, as all transactions are made through the marketplace.
How to protect your personal data online
On average, marketplaces had 109 unique vendor aliases and 3,222 product listings related to stolen data products. Marketplaces recorded 632,207 sales across these markets, which generated $140,337,999 in total revenue. On average, marketplaces had 26,342 sales and generated $5,847,417 in revenue. It is common to hear news reports about large data breaches, but what happens once your personal data is stolen? Our research shows that, like most legal commodities, stolen data products flow through a supply chain consisting of producers, wholesalers, and consumers.
How Cybersecurity Analysts Evaluate Dark Web Marketplaces?
- Last month, blockchain analytics firm Chainalysis uncovered direct financial ties between Mexican drug cartels and Chinese suppliers of fentanyl precursors through crypto transactions.
- Therefore, key actors in the ecosystem of DWMs may play important roles in broader criminal networks.
- The International Narcotics Control Board (INCB) reports that the internet, including darknet platforms, continues to increase access to illegal drugs.
- The report said Solaris, a platform which has since been hijacked by Kraken, had sent KillNet $50,000.
- Individuals began using the darknet to pseudonymously sell illegal content without face-to-face interaction.
These search engines neither track your search queries nor record any information, improving digital privacy and keeping your data private. Mega Market is a new yet popular shop on the dark web that reached a skyrocketing reputation after the closure of the Hydra market. It allows you to buy and sell a wide range of products and services with a good user experience.
How to gain safe access to the Dark Web marketplaces
The report reveals that 2023 also saw a rise in the prominence of approval phishing scams. Crypto inflows to sanctioned entities and jurisdictions comprised 61.5% of all illicit transaction volume, representing $14.9 billion in transaction volume in 2023. “But as scams on more blockchains including Ethereum, Tron, and Solana have grown, so too has the use of DeFi protocols,” the report noted. In another recent incident, a hacker stole a massive trove of databases from a breach notification site DataViper and ended up selling it online. Nevertheless, as for Empire Market itself; Hackread.com will keep an eye on the situation and update the article accordingly even if it is an exit scam.
Discover everything about what is a darknet market, how it works, security threats related to it, and learn how to protect your data online. It added that many fraud shops are increasingly offering third-party crypto-payment processors like UAPS via API calls, as a way to reduce their own costs, improve operational efficiency and increase security. A timeline of darknet marketplace evolution, from Silk Road to 2025’s top players.
Darknet markets have always commanded great interest in the crypto community, first sparked by the infamous Silk Road, which plagued Bitcoin’s reputation during its formative years. Silk Road might seem like a distant memory by now, but darknet markets have persisted. And while the number of markets appears to be on the decline, those that remain are making more money than ever before. According to the report, in 2023, crypto-linked OFAC sanctions shifted toward groups and individual actors and away from major darknet markets like Garantex and Hydra, as well as mixers like Tornado Cash. The increased use of DeFi comes amid tight regulations on centralized exchanges. With stricter Know Your Customer (KYC) and Anti-Money Laundering (AML) measures, illicit actors are facing greater challenges when attempting to cash out.
- With Abacus’s departure, remaining platforms such as DrugHub, TorZon Market, and MGM Grand face increased pressure to absorb displaced users while navigating the same risks that led to their predecessor’s downfall.
- As part of the investigation, the Dutch National Police took the lead on cybercrime prevention, and Van Well shared his insight on the sophistication of the fraud shop’s operation.
- Hansa was an online darknet market which operated on a hidden service of the Tor network.
- Buyers simultaneously active on multiple markets also play the role of connectors in the ecosystem.
- It’s noteworthy that, despite some unusual marketing efforts, no other darknet market has since assumed Hydra’s mantle of being the one-stop-shop for illicit products and services.
- The findings by TRM Labs align with other investigations into the intersection of cryptocurrency and the drug trade.
We find that the dominance of markets is reflected in trading properties of buyers and sellers. Then, we investigate both market star-graphs and user-to-user networks, and highlight the importance of a new class of users, namely ‘multihomers’, who operate on multiple marketplaces concurrently. Specifically, we show how the networks of multihomers and seller-to-seller interactions can shed light on the resilience of the dark market ecosystem against external shocks. Our findings suggest that understanding the behavior of key players in dark web marketplaces is critical to effectively disrupting illegal activities.
Nevertheless, by analysing the income of each multiseller, we observe that the median income still reflects their high income, as shown in Fig. Individually, they are able to yield significant high incomes compared to other types of sellers. As Hydra did, many of these markets have continued the tradition of including drug harm reduction information for drug buyers, such as providing drug testing and medical advice. “The RuTor forum has launched a series of webinars on medical topics, including first aid and overdose scenarios,” said Aleksey Lakhov, of St. Petersburg-based drug project Drugmap.ru. But Russians fleeing the country since the war have still been able to buy drugs on the dark web.
Escrow Dominance
Darknets are not limited to criminal activities; nation-state actors use these hidden platforms for espionage, disseminating propaganda, and recruiting agents. Governments and businesses must invest in advanced threat intelligence, cyber defense, and counter-espionage measures. Dark markets continually adapt and evolve to stay ahead of law enforcement and security measures. This ongoing cat-and-mouse game poses a significant technical challenge in combating the activities within darknets. Dark markets include features similar to those found in legitimate e-commerce platforms, such as product listings, user reviews, ratings, and customer support.
Longevity, code reuse and past exit-scam history are factored in, but we weigh present behaviour more heavily. Finally, we ran a small sample order on each to time escrow release and support response. All numbers are rounded; darknet telemetry is noisy and markets change weekly. Established in 2019, Russian Market is a well-known and highly regarded data store on the dark web, specializing in the sale of PII and various forms of stolen data. Despite its name, the marketplace operates primarily in English and serves a global audience.
The most important thing is to ensure that you never click on links that you’re not sure of their source. Also, it should be common knowledge not to share personal information online. Alphabay rose to prominence with 400,000+ users and $600M yearly trades, ending in a 2017 bust. Latest updates from the darknet trading world as of February 2025—key shifts and developments. Over the years, dozens of large DNMs have been established and eventually shut down by law enforcement, including AlphaBay, Dream Market, Wall Street, and, most recently, Hydra. DNMs are located on the “darknet,” which is unreachable on standard internet browsers like Chrome, Firefox, or Safari because the darknet is unindexed.
Users and cybersecurity professionals alike must stay informed and prepared to navigate this rapidly changing digital frontier. Dark-web marketplaces often attract attention due to their association with illicit activities; however, these platforms also serve legitimate purposes that darknet markets legit align closely with principles of online privacy and freedom of information. Understanding both the lawful and unlawful scenarios helps provide a balanced view of their practical applications in 2025. Treat category rosters and counts from tracker pages as indicative, not definitive.
It is a useful tool for people who value their privacy and want to protect their communications with default end-to-end encryption, zero-access architecture, and minimal personal information requirements. The dark web is shrouded in mystery, but not every onion website is dangerous. But before we start, install Norton VPN to help protect your digital identity and stay safer online. Cartels reportedly used USDT to fund operations, sometimes profiting from price gaps across different crypto markets. The ongoing move toward decentralized platforms suggests the crypto drug ecosystem will remain fluid, creating new enforcement challenges.
Once users suspect a platform is compromised or dishonest, activity drops quickly and the marketplace either migrates, rebrands, or disappears entirely. Funds are held temporarily by the platform until a transaction is completed or disputed. Miklos founded Privacy Affairs in 2018 to provide cybersecurity and data privacy education to regular audiences by translating tech-heavy and «geeky» topics into easy-to-understand guides and tutorials. This not only helps protect your identity but also contributes to your overall cybersecurity in the digital age. Hacked social media accounts are evidence that cybercriminals have a diverse appetite for Dark Web data products.
Therefore, you can hire them to perform a task for you, from planting malware to hacking email accounts and even breaking into various social media accounts. The dark web is only accessible through specific software like Tor (The Onion Router). Also, while this huge portion of the internet has a reputation as home to nefarious activities like hacking and drug trafficking, it also harbors legitimate activities like journalists and whistleblowers. 85% of top markets now use escrow security, up from 60% in 2023—see Alphabay. The first major darknet market pioneered BTC trading, processing $1.2 billion before its 2013 shutdown.
In March 2015, the marketplace fell victim to an exit scam, with its administrators absconding with approximately $12 million in bitcoins. Unlike many other platforms, Evolution allowed for the wholesale trading of stolen credit card information, further diversifying the types of illicit goods available. The period between late 2013 and 2014 saw a flurry of activity, with the launch of successors like Silk Road 2.0 and Agora, alongside the takedown of various other markets. In contrast to the other types of sellers, the median income of U2U-only sellers increases after operation Bayonet. Moreover, we observe a trend of increase in their median income relative to the value before operation Bayonet—an increase of almost six times by the end of the period of observation (see Supplementary Information S4).
