Identifying key players in dark web marketplaces through Bitcoin transaction networks Scientific Reports

Monero has emerged as a preferred cryptocurrency in many dark web marketplaces due to its robust privacy features. Unlike Bitcoin, which is traceable, Monero uses stealth addresses and ring signatures to obscure transaction details, offering enhanced anonymity for users. The implementation of Ring Confidential Transactions further conceals transaction amounts, making Monero a favored choice for those seeking privacy on the dark web. Abacus Market emerged in September 2021 and has quickly become a formidable player in the darknet market ecosystem.

– Hydra Collapse

Its presence significantly escalates the likelihood of a darknet market attracting law enforcement attention, he said, because fighting the drug is a priority for international law enforcement. Jardine emphasized that illicit cryptocurrency transactions represent only a minor share of total crypto activity. The most recent dark web markets example is the shutdown of the oldest marketplace Hydra Market in 2022 which took a combined effort of the FBI and the German authorities. Perhaps, the figures can tell you what your personal information is worth when it lands on the dark web. The cost can be exorbitant, but for victims, it’s always higher and devastating.

Share this article

My interests lie in unraveling the hidden layers of the internet, including the Deep Web and Dark Web, and understanding their impact on cybersecurity. I am particularly fascinated by the dynamics of malware, Advanced Persistent Threats (APTs), and the challenges posed by hidden online environments. Overall, dark-web marketplaces inherently involve substantial risk, and users must thoroughly understand these threats. Anyone considering engaging with these platforms must carefully evaluate potential consequences, exercise stringent security practices, and remain vigilant to minimize exposure to these significant hazards. Understanding both the lawful and unlawful scenarios helps provide a balanced view of their practical applications in 2025. Ares Market is presented in open sources as a general‑purpose marketplace with a familiar trust stack (escrow, feedback, PGP/MFA) and BTC/XMR settlement—features that align with sector norms rather than set it apart.

Adopt secure ATM habits

It’s the place where you can buy or sell stolen credit card numbers, SSH login credentials, and personally identifiable information (PII). Vendors on Hydra also offered services such as “Hacking for Hire,” “Ransomware as a Service” (“RaaS”), and a myriad of money laundering features. Though the drug transactions were limited to Russia and its geographic neighbors, the cyber and money laundering tools were available to anyone in the world willing to pay. Cryptocurrencies have played a pivotal role in the functioning of darknet markets, providing the anonymity needed for transactions involving illicit goods and services. Bitcoin and Monero are the most commonly used cryptocurrencies on these platforms, with Monero gaining popularity due to its robust privacy features. The use of cryptocurrencies ensures that users can maintain their anonymity while conducting transactions on the dark web.

• Their presence can make you wonder why darknet markets and not just the regular online stores.
• Its continued growth and prominence in the darknet market ecosystem highlight its importance in 2025.
• There’s also a search bar that you can use to search for any particular product or vendor.
• It uses ring signatures and stealth addresses to obscure transaction details.
• Developers introduced advanced techniques, advertising subscriptions ranging from $100 to $20,000.
• Darknet marketplaces are commercial websites accessed by an encrypted browser which operate on the dark web, functioning primarily as black markets for illegal activity or substances.
• Nodes are sellers that are active within the time period, and an edge is placed between two sellers if at least one transaction occurs between them during the period.

Risk-Based IT Compliance: The Case for Business-Driven Cyber Risk Quantification

If you’re into a darknet market with a community pulse and solid uptime, Bohemia Dark Market’s climbing the ranks—give it a spin if you like a vibe that’s less corporate, more crew. Despite consistent results, this study has limitations that may be addressed in future work. First, while the dataset is preprocessed with state-of-the-art methods, there is no ground truth for validation, and this uncertainty propagates to our findings. For instance, we cannot verify if an entity classified as seller is in fact a seller.

Financing and fraud

Silk Road, which emerged in 2011, combined TOR and bitcoin to become the first known darknet market. The market was eventually seized in 2013, and the founder, Ross Ulbricht, was sentenced to two life sentences plus 40 years without the possibility of parole. Ulbricht’s hefty prison sentence did not appear to have the intended deterrent effect. Multiple markets emerged to fill the void and, in doing so, created a thriving ecosystem profiting from stolen personal data. We showed that a small fraction of traders is responsible for a large fraction of the trading volume, and by analysing the networks of buyers and sellers, we found different resilience regimes. Shocks tend to induce serious structural changes in the multiseller network, but impact the multibuyer network much less severely.

What happens if your data is sold on the dark web?

Conversely, transaction networks obtained from the blockchain contain the entire transaction data of the DWMs and U2U transactions, allowing a thorough investigation of the ecosystem as a whole. In fact, previous studies on DWM transaction networks have revealed crucial aspects of the ecosystem13,14,15. However, they have so far mainly focused on DWM users, without distinguishing between buyers and sellers, and neglecting the different weight that more active users may have in the system.

Early warning signals for predicting cryptomarket vendor success using dark net forum networks

• This feature is satisfied when \(\ell _i(t) \ge L\), where L is the fixed value of minimum lifetime.
• Specializing in the sale of Personally Identifiable Information (PII), CVV, RDP, Stealer Logs, and various fraud-related items, the Russian Market has carved out a niche for itself since its inception in February 2019.
• Founded in 2014, BriansClub remains one of the oldest and most infamous dark web markets for stolen credit cards, fullz (complete identity kits), and dumps.
• It also masks your IP address, making it difficult for government agencies to monitor or track your activities.
• A public FBI/CISA advisory reports more than 21,000 infostealer-log listings across cybercriminal forums in a single quarter of 2024.
• Similarly, the takedown of Kingdom Market in late 2023 led to the arrest of its administrator and involved over 42,000 product listings.
• The market accepts Bitcoin, Litecoin, and Ethereum as payment methods, catering to a wide range of users.

This tactic, seen in 2024 with incidents involving Ticketmaster and IntelBroker, could lead to an overall rise in data breaches. Premium private cryptors are gaining traction, emphasizing the shift toward exclusive malware solutions. Dutch police discovered the true location in 2016.[4] Law enforcement quickly began monitoring all actions on the site. Administrators soon moved the site to another unknown host, but law enforcement got another break in April 2017, which allowed them to identify the new hosting company, in Lithuania. The Dutch National Police successfully located and seized the server infrastructure hosting Archetyp Market at a data center in the Netherlands, effectively terminating the platform’s operations.

Cyber Threat Actors Ramp Up Attacks on Industrial Environments

Founded in 2014, BriansClub remains one of the oldest and most infamous dark web markets for stolen credit cards, fullz (complete identity kits), and dumps. DarkFox Market is the largest dark web shop selling various products and attracting more vendors and users. It is a wallet-based shop, meaning you must first deposit bitcoins into your wallet before purchasing any goods and services. The marketplace is much more organized, which makes it easy to use and navigate.

Contents

As these marketplaces keep changing, it is critical to stay on top of the main platforms on the dark web worth monitoring. Monitoring dark web markets is crucial, no matter if you are a business or an individual, as you can then proactively identify and mitigate potential breaches and cyber threats. No dark web marketplace is safe to use because they involve illegal activity, financial risk, and potential legal consequences.

• Dark markets, as well as various other services within darknets, are hosted as ‘hidden services’.
• Learn how to automate financial risk reports using AI and news data with this guide for product managers, featuring tools from Webz.io and OpenAI.
• As of September 2025, public trackers mark it closed, underscoring the sector’s churn amid phishing/DDoS and sustained law‑enforcement pressure.
• During the second half of 2022, law enforcement cracked down on a large number of darknet markets, temporarily disrupting the supply of such illicit goods.
• Drugs lead the pack—weed, pills, some synthetics—but digital goods like hacked logins are gaining, tying into Telegram’s side gig boom.
• Its emphasis on user anonymity and document forgery makes it a core tool for identity fraud.

Also, previously, the Tor browser was vulnerable to JavaScript attacks as it provided hackers a pathway to track your activities by using the session details. Therefore, for security reasons, disable JavaScript on the Tor browser and enjoy an anonymous browsing experience on the dark net. Despite using a VPN, there’s always a risk of the VPN leaking your IP address through DNS or WebRTC leaks or misconfigurations when on a dark web forum or marketplace. Therefore, you must run an IP leak test to ensure that the VPN is working completely fine and is not risking your digital security. The website has a sleek design and interactive user interface, making it the most preferred choice in terms of user experience. You can pay through Monera and Bitcoin using the escrow system or the traditional market account after making a purchase on this shop.

• Trackers note that, like several modern markets, Catharsis claims to prohibit highly harmful or reputationally damaging categories (e.g., explicit abuse material, certain forms of violence-related content).
• If a seller encourages you to opt for other well-known and commonly used payment methods, then the person is likely to be a scammer, and you must not make any deal with them.
• Archetyp Market emerged as one of the darknet’s most prominent criminal trading platforms, facilitating the sale of various narcotics, including amphetamine, cannabis, fentanyl, heroin, and cocaine.
• To reduce the presence of noise in the S2S network, we consider only stable U2U pairs, i.e., pairs that have at least three transactions throughout the whole period of observation13.
• Unique threads discussing drainers on dark web forums increased from 55 in 2022 to 129 in 2024, with Telegram channels serving as prominent hubs for these activities.
• This is a strong indicator that Google does not currently see the website as malicious.
• By following these suggestions, you can deter unwanted intruders from accessing your accounts at home or work.
• The ability to seamlessly communicate with vendors via secure messaging systems also greatly improves overall user experience.

But no matter how polished or professional these sites seem, the risk of getting scammed — or tracked — is always high. During the second half of 2022, law enforcement cracked down on a large number of darknet markets, temporarily disrupting the supply of such illicit goods. Western drug flows in particular come from US-domiciled exchanges and trace flows from those to darknet markets. The entity “DNM Aggregator” that appears within each category refers to a service we’ve identified as being in control of multiple, disparate darknet markets.

Predictive threat intelligence can help you stay ahead of emerging threats by forecasting what’s yet to come. In repressive regimes, darknets play a vital role in enabling free speech and access to uncensored information. Tools like Tor are used to bypass government-imposed firewalls and surveillance, ensuring open communication. The significance here is the preservation of civil liberties and the right to information. Businesses operating in such regions may need to adapt to the technical challenges and risks posed by using darknets for legitimate purposes. We deliver contextualized, actionable intelligence through our dedicated platform or API integration, ensuring that you can respond effectively to darknet threats.

What are onion sites and dark web websites?

DarkMatter Market is portrayed in open‑source threat‑intel as a privacy‑first marketplace that went live in September 2022. Trackers emphasize its Monero‑only policy and a walletless payment design intended to minimize on‑site custodial balances. As of 2023, Searchlight Cyber estimated roughly 6,000 listings and ~300 vendors, and attributes admin handles such as “quasar1,” “BlackMask,” and “zamman.” Treat those figures as directional; hidden‑service data shifts quickly. The best marketplaces in 2026 cater to diverse needs, offering a broad spectrum of products ranging from privacy-enhancing software, digital documents, and cryptocurrency exchanges to more sensitive or controversial goods. Marketplaces that maintain strict moderation policies—banning excessively harmful or exploitative products—also gain popularity among more ethically minded users.

Range of Available Products

Administrators and sellers on dark web marketplaces had a better 2023 than the previous year, pulling in an estimated $1.7bn in cryptocurrency-based revenues, according to new Chainalysis data. ASAP Market offers 25,000+ listings and $4 million monthly across BTC, XMR, LTC, and USDT, with a 7% share. Its 14,000+ users and 1,000+ vendors leverage multi-crypto flexibility for seamless darknet trading.

How Do Dark Web Marketplaces Typically Operate?

Axis Intelligence provides dark web surveillance solutions that help businesses identify leaked credentials, fraud attempts, and malware risks before they escalate. This article reveals the top 10 dark web markets dominating in 2025, their unique characteristics, and the critical implications for enterprise cybersecurity. Using TAILS is yet another security measure that protects your online identity on the dark web.

Overall, dark-web marketplaces in 2026 are more sophisticated, secure, and resilient than ever before, evolving rapidly in response to both technological advancements and intensified scrutiny from global law enforcement agencies. Although some of these markets prohibit certain extreme content such as violence or exploitation, most operate with very few rules beyond ensuring the security and anonymity of their users. Given the explosive growth of these markets, organizations must prioritize proactive threat monitoring.

While the darknet market ecosystem showed signs of recovery in 2023, it has yet to return to the revenues it experienced before the Hydra Marketplace closure in 2022, given the financial success of that operation. It’s noteworthy that, despite some unusual marketing efforts, no other darknet market has since assumed Hydra’s mantle of being the one-stop-shop for illicit products and services. Though the sanctioning and closure of fraud shop Genesis Market occurred last year, there were no other sanction events for the darknet market ecosystem, or major market takedowns. We’ll continue monitoring darknet market trends in 2024, and are curious to see what new tactics markets and fraud shops may employ to find more customers.

It offers numerous categories of products, most of which feature illegal products. Just like Alpha Bay, Drugs and Chemicals is one of the most popular product categories in the Empire Market. Nearly half of the marketplaces launched in 2024 accepted only Monero, representing a sharp increase from just over one-third in 2023, signaling a growing preference for enhanced privacy and anti-surveillance capabilities. Between June 1 and June 27, 2025, average daily deposits to Abacus totaled USD 230,000 across 1,400 transactions, but this plummeted to just USD 13,000 across 100 deposits from June 28 to July 10, 2025. Welcome to this collection of darknet resources, curated exclusively for educational and informational purposes.

Just visiting these sites can attract attention from law enforcement, especially if you interact with known vendors or download suspicious content. Malicious vendors often infect buyers with spyware, ransomware, or infostealer malware hidden in downloadable files. Some listings are nothing more than scams designed to trick people into sending cryptocurrency without delivering anything in return. Darknet marketplaces may look like regular online stores, but using or even browsing them comes with serious risks. From identity theft to law enforcement surveillance, the dangers are real — and often underestimated. As law enforcement agencies’ tactics improve, some markets respond by introducing more security features, like mandatory encryption or invite-only access.

The platform’s popularity continues to grow, attracting both new and returning customers. STYX Market focuses specifically on financial fraud, making it a go-to destination for cybercriminals engaged in this activity. To expand their reach, some marketplaces established parallel channels on Telegram.

Next, we extracted information about stolen data products from the markets on a weekly basis for eight months, from September 1, 2020, through April 30, 2021. We then used this information to determine the number of vendors selling stolen data products, the number of stolen data products advertised, the number of products sold, and the amount of revenue generated. The crypto industry continues to suffer from cybercrimes, with darknet markets being one of the two categories showing an increase in revenue in 2023, according to the latest report from blockchain analysis firm Chainalysis. In response, darknet market vendors are increasingly shifting their financial activity toward decentralized platforms. Alright, let’s get into the meat of it—the darknet markets that are ruling 2025. I’ve been poking around these places for a while now, from the giants like Abacus to the old-timers like Vice City.

These marketplaces accounted for over 97% of illicit revenue generated through Bitcoin and TRON transactions. Freshtools was established in 2019 and offers various stolen credentials, accounts, and host protocols like RDP. It is considered a go-to site for malware purchasing, providing keyloggers, trojans, and other Malware as a Service products. Due to its extensive inventory and reputation for reliability, Brian’s Club has maintained a significant presence on the dark web. Quality and validity of the data it provides justify its higher cost over other marketplaces.

Silk Road quickly grew into the largest darknet market, handling hundreds of millions in transactions. But in 2013, law enforcement traced Bitcoin activity, monitored DPR’s forum posts, and exploited server vulnerabilities to identify Ross Ulbricht. In exploring the top 11 dark-web marketplaces in 2026, we’ve examined their core operations, diverse use-cases, inherent risks, and evolving trends.

Like other marketplaces, ASAP Market also requires you to register for an account. But since its relaunch, the developers are focusing more on operational security and ensuring that users can have a good experience on this site. Below are the best marketplaces on the dark net that we hand-picked after going through multiple shops and doing extensive research. In the first arc of the anime series Lupin the 3rd Part V, Lupin III steals digital currency from the “Marco Polo” darknet market. Whilst a great many products are sold, drugs dominate the numbers of listings, with the drugs including cannabis, MDMA, modafinil,[107][108][109] LSD, cocaine, and designer drugs.

WeTheNorth is a region-restricted marketplace that focuses on Canadian and North American buyers and vendors. By limiting sales to domestic channels, the platform reduces customs risks and cross-border enforcement pressure. These records allow criminals to clone physical cards or commit card-not-present attacks. Darknet markets operate within this hidden space, often hosting illegal activity, while the deep web primarily consists of everyday private or password-protected content. These listings often include detailed descriptions, user reviews, and even shipping guarantees.

Given the darknet’s infrastructure, which is hidden behind onion routing, the darknet attracts sites whose proprietors want to remain anonymous. Expect future trends in darknet markets to be shaped by advancements in encryption, the rise of decentralized platforms, and increased use of cryptocurrencies, enhancing anonymity and security for users. As we move forward, technological advancements and regulatory measures will continue to shape the future of darknet markets. Users and law enforcement agencies alike must stay vigilant, navigating the ever-changing landscape of the dark web. The pursuit of privacy and security will remain at the forefront, driving the evolution of these clandestine platforms.

Throughout the history of the darknet market ecosystem, at different turns one marketplace has typically played the dominant role. The last several years’ examples include Silk Road, AlphaBay, Wall Street Market, and Hydra, most recently. Historically, as law enforcement closed each dominant marketplace, a new leader emerged. We can see this pattern on the chart below, which shows the level of market share controlled by the dominant market of each epoch. The recovery pattern is fairly consistent until the Hydra Marketplace closure, after which no dominant darknet market emerged.

Marketplaces like Cypher specialize in selling fraudulent documents and stolen credit card data, while platforms like BidenCash draw in potential buyers by releasing stolen data for free. This strategy not only advertises their services but also fuels further criminal activities by providing the raw materials for identity theft and financial fraud. Here, we set out to find the main actors in the DWM ecosystem and assess their systemic impact on a dataset of 40 million Bitcoin transactions involving the 31 major markets in the period 2011–2021.