The number of sellers in each category and multisellers as a function of time is shown in Fig. Until the end of 2013, when Silk Road is the dominant market (see Fig. 3), market-only sellers is the dominant category, and there are no multisellers. From the last quarter of 2013, U2U-only sellers become the largest category of sellers and remains as the largest throughout the rest of the observation period. The large number of U2U-only sellers is in accordance with previous results that showed that the trading volume in the U2U network is significantly larger than that of DWMs13 (also see Supplementary Information Figure S8). TRM Labs calculated that in the eight months since Hydra had been shut down, the new cluster of darknet markets had amassed $820 million in crypto currency deposits.

Tweak Tor browser settings

As cryptors, loaders, and stealers become more sophisticated, and underground markets remain resilient, organizations must prioritize robust cybersecurity measures in 2025. The number of malicious tools, or “drainers,” designed to steal cryptocurrency assets like tokens and NFTs saw a substantial rise. Unique threads discussing drainers on dark web forums increased from 55 in 2022 to 129 in 2024, with Telegram channels serving as prominent hubs for these activities. Kaspersky report states, Last year, the underground market for cryptors—tools used by cybercriminals to obfuscate malicious code and evade detection—grew significantly.

Proliferation of AV Evasion Tools (Cryptors)

This could stop the flow of stolen data through the supply chain and disrupt the underground economy that profits from your personal data. Conversely, transaction networks obtained from the blockchain contain the entire transaction data of the DWMs and U2U transactions, allowing a thorough investigation of the ecosystem as a whole. In fact, previous studies on DWM transaction networks have revealed crucial aspects of the ecosystem13,14,15.

Law Firm Investigates Coupang Security Failures Ahead of Class Action Deadline

• From 2013 until 2015, the multiseller network grows in terms of connectivity, showing an increasing number of edges spread across different markets.
• According to a 2024 report citing unsealed court documents, USDT was widely available in Mexico at a discount, allowing resellers to profit in countries like Colombia.
• Unlike the surface web (the normal, open internet we use every day), you can’t search for .onion sit…
• Moreover, we find a change of trend between the seller and the buyer median net income time series which reflects the dominance of markets, as detailed in the next section.
• We find that trading properties of buyers and sellers reflect the dominance of DWMs in the ecosystem.
• I’ve been poking around these places for a while now, from the giants like Abacus to the old-timers like Vice City.
• Therefore, you must run an IP leak test to ensure that the VPN is working completely fine and is not risking your digital security.

These markets mimic traditional e-commerce websites, but instead of second-hand books or vintage jackets, they traffic in illegal goods and criminal services. Looking ahead, the future of darknet markets appears promising, with ongoing innovations in encryption, decentralized technologies, and community-driven governance models. These advancements are expected to further enhance the reliability and accessibility of these platforms, solidifying their position as a cornerstone of the digital underground economy. Despite most darknet markets banning the sale of fentanyl in their terms of service, nearly all mainstream Western-facing markets have vendors that sell fentanyl-laced products. While it received a relatively small share of large retail purchases as shown in the previous chart, Abacus Market is one such example.

Beyond Bug Bounties: How Private Researchers Are Taking Down Ransomware Operations

This has solidified cryptocurrencies as the primary medium of exchange within the darknet ecosystem. The emergence of darknet markets has revolutionized the digital economy, introducing a paradigm where privacy and security are paramount. These platforms have established themselves as vital hubs for individuals seeking to conduct transactions with absolute discretion.

Regional websites

Although it shows fluctuations, including those caused by external shocks, the ecosystem exhibits a positive growth trend in terms of trading volume. Torch is one of the more established dark web search engines, designed to help users navigate the Tor network and discover onion sites. Unlike traditional search engines like Google or DuckDuckGo, Torch indexes hidden websites that operate beyond the reach of the surface web. But users should always be cautious and avoid clicking unfamiliar or untrusted links to steer clear of scams or malware. Decentralized messaging apps let vendors switch platforms easily and maintain privacy. These services provide secure channels, reducing reliance on older networks and lowering exposure to law enforcement tactics.

Verify Onion Links

Authorities struggle to track transactions in decentralized systems due to scarce data trails. The speed and anonymity of digital exchanges hinder identification, complicating efforts to dismantle illicit networks. A new report published by blockchain forensic firm TRM Labs in early 2025 outlined a major rise in crypto-fueled drug sales throughout 2024, driven largely by Russian-language darknet marketplaces. Official-torzon.markets claims to be the official gateway to the “Torzon Market,” providing links, PGP verification information, and a Tor Browser guide.

Early warning signals for predicting cryptomarket vendor success using dark net forum networks

The website has a great design and a clean and organized interface that is easy to use. The homepage includes options like browsing products, searching, mixer, and coin exchange. If any user is found not complying with the law, strict and immediate action will be taken against them. It uses PGP encryption to protect sensitive data and messages, and accepts payments via Monera and Bitcoin to keep you anonymous on this marketplace. World Market is another largest dark web shops that deals with various goods and services.

Adopt secure ATM habits

• Darknets and dark markets have propelled the growth of cybercrime by offering a platform for the sale and exchange of malicious tools and services.
• In a DDoS attack, the server is bombarded with artificial traffic, which makes it difficult for the server to process web requests, and it ultimately goes down.
• To keep a closer eye on your personal information, you can use services like NordStellar’s dark web monitoring.

Established in 2022, BidenCash is known for trading personal identifiable information (PII) and engaging in fraud-related activities. The market gained attention for releasing data for free as a form of advertising, a strategy that has attracted numerous users. These features have positioned Torzon Market as a leading marketplace on the dark web. Its innovative approach to vendor feedback and premium services sets it apart from other markets, making it a noteworthy platform in 2025.

Identifying key players in dark web marketplaces through Bitcoin transaction networks

ProPublica is an investigative news site owned by an independent nonprofit that exposes abuses of power and corruption. It hosts an onion site so people in countries with restricted press freedom can access its journalism, which covers everything from hacktivism to government repression. On the dark web, traffic is routed through multiple server nodes that don’t log activity, obscuring the user’s origin and enabling anonymous communication.

These advancements will likely solidify the darknet’s position as a cornerstone of anonymous trade, offering unique opportunities for secure and discreet commerce in the digital age. The darknet has emerged as a robust and innovative ecosystem, enabling secure and anonymous trade on a global scale. By leveraging cutting-edge technologies such as Tor and end-to-end encryption, these platforms provide users with unparalleled privacy, ensuring that sensitive data and identities remain protected. This technological foundation has allowed the darknet to flourish as a space where commerce thrives without the constraints of traditional oversight. Such features have enhanced the overall user experience, fostering a sense of reliability and community trust.

• It is a wallet-based shop, meaning you must first deposit bitcoins into your wallet before purchasing any goods and services.
• Using darknet markets poses significant risks, including exposure to fraudulent services, exit scams, and potential legal consequences.
• Nemesis Market is a relatively new wallet-less shop on the dark web where you don’t need to deposit any amount in your wallet before buying products from here.
• The website has a great design and a clean and organized interface that is easy to use.
• He recommends verifying market employees carefully, and to weed out law enforcement infiltration through barium meal tests.
• One fraud shop that provided services like these, Genesis Market, saw its end last April after a coordinated, international law enforcement effort called Operation Cookie Monster closed it down, and OFAC sanctioned it.
• Silk Road not only aggregated thousands of drug vendors, it created a user-friendly interface that resembled a clear-net shopping website.
• On average, marketplaces had 109 unique vendor aliases and 3,222 product listings related to stolen data products.
• This includes purchases such as malicious software and supporting services which cybercriminals sometimes make using escrow services on crime forums.

This suggests that the multiseller activity is sensitive to external shocks but also that it yields higher profits. The structural change in the multiseller network and the resilience of the multibuyer network. Temporal network of multisellers (top) and multibuyers (bottom) between markets for each year.

Regulatory scrutiny has led major exchanges to delist privacy-focused cryptocurrencies like Monero, pushing users towards decentralized platforms for transactions. Additionally, the growing popularity of decentralized finance (DeFi) may provide new avenues for laundering money through darknet platforms. The increasing sophistication of darknet transactions, facilitated by cryptocurrencies, is likely to further entrench these markets in the digital underworld.

Enhancing Darknet Trade with Tor Integration and User-Friendly Design

Services for breaching personal accounts and systems are also commonly advertised, reflecting the evolving landscape of hacking tools and fraud services on the darknet. The availability of such services underscores the ongoing threat posed by cybercriminals operating on these platforms. The dark web is a hub for cybercrime services, with a wide array of hacking tools and fraud services available for purchase. Dark web markets frequently offer services for hacking financial institutions, carding, and counterfeiting, drawing in users looking for various cybercrime capabilities.

Content

For instance, we cannot verify if an entity classified as seller is in fact a seller. Similarly, there is no unique choice for the classification parameters or ground truth for fitting darknet markets them. In light of this, we have chosen the parameters conservatively, obtaining estimates for the number of sellers that are in general smaller than the ones produced by other methods.

biggest dark web marketplaces

During 2016 and 2017, AphaBay becomes the dominant market (see Fig. 3), polarizing sellers around its own ecosystem, such that the fraction of multisellers decreases to 10% of all sellers until its closure. Then, after operation Bayonet, the number of sellers in all categories and multisellers significantly drops, as shown in Fig. Notably, the number of multisellers suffers the largest drop of \(-99\%\) by the end of the first quarter of 2018.

Emergence and structure of decentralised trade networks around dark web marketplaces

Unfortunately, many dark web websites are devoted to the illegal trade of leaked personal information. If you’ve ever experienced an uptick in phishing attacks and spam after a data leak or breach, it may be because your personal information has been posted to the dark web. The surge stems from weak local enforcement, widespread use of streamlined crypto payments, and a digital space valuing privacy. These factors allow vendors to avoid typical oversight while operating covertly online. Additionally, the adoption of escrow systems and multi-signature wallets has further bolstered trust and efficiency in darknet transactions.

Businesses operating in such regions may need to adapt to the technical challenges and risks posed by using darknets for legitimate purposes. Manual monitoring of the dark web is inefficient and risky due to the sheer volume of data involved. This early detection allows organizations to identify and respond to threats quickly, reducing the chances of unauthorized access, financial loss, or damage to brand reputation. Founded in 2020, Cypher Market has carved out a niche on the dark web by focusing on cybercrime products.

However, emerging cryptocurrencies with even stronger privacy features are gaining traction, further solidifying the financial infrastructure of these markets. Another key innovation is the adoption of AI-driven recommendation systems, which analyze user behavior to suggest products and services tailored to individual preferences. This not only improves the shopping experience but also fosters a sense of community within the darknet ecosystem. One of the most notable developments is the integration of cryptocurrencies as the primary medium of exchange.

What are onion sites and dark web websites?

Law enforcement agencies monitor it for criminal activities, but legitimate users rely on it for privacy protection. It offers access to hacked bank accounts, credit card data, and cryptocurrency laundering tools. Transactions can be made using Bitcoin or Monero, and the platform keeps users in the loop through an official Telegram channel. It also requires users to verify their identity carefully to build trust with buyers focused on fraud. The growing ecosystem of darknet markets reflects a thriving digital economy, where innovation and adaptability are key to sustaining user trust.

How Mid-Market Businesses Can Leverage Microsoft Security for Proactive Defenses

Over the years, these platforms have transformed into sophisticated ecosystems that cater to a wide range of products and services, with a particular emphasis on secure online trade. The integration of cryptocurrencies such as Bitcoin and Monero has played a pivotal role in ensuring anonymity and facilitating seamless transactions, making these markets more accessible and reliable for users worldwide. Dark web marketplaces have been a significant outlet for illicit trade, serving millions of users worldwide for over a decade. First, we propose an algorithm that categorizes users either as buyers or sellers, and show that a large fraction of the trading volume is concentrated in a small group of elite market participants.

• These digital currencies provide a degree of anonymity, as transactions are recorded on a public ledger but do not directly link users to their real-world identities.
• Onion sites, or dark web websites, are sites on the dark web that can typically only be accessed using special software like the Tor browser.
• Accessing any darknet marketplace is dangerous because it is known to be a hub for illegal trade.
• Learn how darknet markets function and the challenges they present to cybersecurity, shedding light on the hidden side of the internet.
• Official-torzon.markets claims to be the official gateway to the “Torzon Market,” providing links, PGP verification information, and a Tor Browser guide.
• Self‑described landing pages also advertise additional coins and platform hardening features, but these claims are not independently verified.
• For each entity, we keep track of the cumulative values of the six features for each transaction performed by the entity over time.
• This encryption makes attribution and tracking more difficult for authorities and cybersecurity professionals.

Ethical and Legal Boundaries in Monitoring Darknet Marketplaces

• However in December last year a Ukrainian-born hacker broke into the Solaris market’s crypto-wallets and donated $25,000 to a charity for Ukrainian refugees.
• Dark.fail tweeted on Friday that Empire was targeted with a DDoS (distributed denial of service) attack.
• The trading volume generated by stable pairs is more than five times larger than that of non-stable pairs13.
• New darknet sites and markets continuously emerge to replace those that get shut down.
• The most affected are multisellers, with a drop of 78% in the median income, followed by market-U2U and market-only sellers, with a drop of 59% and 47%, respectively.
• With 25,000+ users and 3,000+ vendors, it’s the gold standard for escrow security and scale.
• Significant technological innovations and trends have reshaped dark-web marketplaces over recent years.

For instance, stolen data can result in unauthorized payments, the draining of accounts, or even registered loans. Who doesn’t like privacy, especially when dealing with the buying and selling of illegal products and services? Therefore, given the nature of anonymity and privacy of the dark web, several stores keep on emerging in the dark despite a continuous crackdown on several others.

• The number of actors in the ecosystem is affected by several factors, especially market closures.
• If you’re into a darknet market that feels cutting-edge and keeps your coins safe, ASAP Darknet Market’s a gem—just don’t expect a massive catalog yet; it’s more about precision than sprawl.
• Below, I’m breaking down each market with everything I’ve picked up—listings, quirks, the works.
• Darknet markets have always commanded great interest in the crypto community, first sparked by the infamous Silk Road, which plagued Bitcoin’s reputation during its formative years.
• All sponsored and commercial content, including press releases, is clearly labeled and reviewed for accuracy, disclosure and compliance.
• While the curves for the seller and buyer median net income were negatively correlated before Silk Road’s shutdown, after that moment they became positively correlated.
• Every potential participant’s credentials must be vigorously vetted before they can join.
• Even if you’ve never visited these markets, your personal and financial data might already be there, having been leaked through a data breach.

Trading Tips

Even users who access these platforms without intent to buy illegal items risk suspicion or investigation. Dark web markets have exploded in scale and reach in 2025, becoming the most dangerous hubs for trading drugs, stolen data, and hacking tools. These anonymous marketplaces—operating mainly on the Tor network—are now a primary threat vector for businesses and cybersecurity professionals. One of the key factors contributing to the growth of darknet markets is their ability to adapt to changing technological landscapes.

Darknet Market Archetyp Takedown by Authorities in Joint Action ‘Operation Deep Sentinel’

• Furthermore, after a shock, the activity of buyers is resumed almost immediately, while the activity of sellers recovers more slowly.
• However, the platform lacks an advanced search option and a wallet-free payment option.
• But in fact it was a guerrilla marketing stunt promoting OMG, a darknet marketplace selling heroin, mephedrone, marijuana, and everything else in between.
• But according to Ingo Fiedler, co-founder of Blockchain Research Lab, this trend is primarily the result of increasing law enforcement focus on the darknet market industry.
• Buyers often rely on reviews to choose vendors, even though no real identity checks or legal protections exist.
• These sites use “.onion” domains, which are made up of random letters and numbers up to 56 characters long.
• Here are some methods to thwart unauthorized access to your data repositories.
• Dark web marketplaces expose users to multiple layers of risk that extend beyond financial loss and affect legal standing, personal safety, and long-term consequences.

To access this marketplace, you must register, but before that, you must verify yourself as a human by passing a CAPTCHA test. Analysts rely on publicly available sources such as cybersecurity reports, court documents, and research publications. This helps build a picture of marketplace activity without interacting with the platforms themselves. Participation in dark web marketplaces can lead to serious criminal charges, even if involvement seems limited. Law enforcement investigations often span years and rely on digital traces collected over time.

Daily Debrief Newsletter

The integration of cryptocurrencies has played a pivotal role in this transformation, enabling seamless and anonymous transactions that are resistant to traditional financial oversight. One of the key developments in recent years has been the emergence of user-friendly interfaces and Tor-based marketplaces. These platforms have streamlined navigation, making it easier for users to access products, communicate with vendors, and complete transactions. For instance, markets like AlphaBay and Hansa have set benchmarks in terms of design and functionality, offering features such as escrow services, vendor ratings, and dispute resolution mechanisms. As the digital economy of darknet markets continues to thrive, the focus on secure online trade remains paramount. Platforms such as AlphaBay, Empire Market, and White House Market have set industry standards by prioritizing user safety and operational efficiency.

Securing M365 Data and Identity Systems Against Modern Adversaries

Bitcoin was initially used to process payments, offering pseudonymity rather than full anonymity. Learn how darknet markets function and the challenges they present to cybersecurity, shedding light on the hidden side of the internet. H25.io is a premium directory in the Tor network, offering access to a diverse and meticulously curated list of onion sites. Our mission is to simplify navigation in the complex and evolving world of the darknet.

Crime forums and markets specializing in cybercrime enablement

Darknet markets were one of two categories of crypto crime that saw revenues rise in 2023. In total, darknet markets and fraud shops received $1.7 billion last year, a rebound from 2022 — the year that saw the sizable Hydra Marketplace close. The ensuing war for darknet market dominance that began in 2022 continued into 2023, but no other market has since matched Hydra’s financial success. Vice City Market runs 18,000+ listings and $2.5 million monthly trades on BTC and XMR, with a 5% share.

Darknet Markets Explained: Navigating the Hidden Web

All the payments were made through cryptocurrency, further enhancing marketplace anonymity. The users on this site could review and rate the products that promote reliable and fraudster vendors. Brian’s Club has been around since 2014 and remains one of the most well-known credit card shops on the dark web. It sells stolen card data — dumps, CVVs, even wholesale batches — and lets users bid on fresh leaks. Despite multiple takedown efforts by law enforcement and security researchers, Brian’s Club has resurfaced repeatedly and continues to add new stolen credit card data.

It’s not as community-driven as Bohemia, but the polish makes up for it—feels like a pro operation, not a fly-by-night deal. If you’re after a darknet market with variety and a forward-thinking edge, Tor2door Market’s a contender—watch it close in 2025 as that AI kicks in. To study the performance of sellers, we analyse the quarterly median income, i.e., the quarterly median of the money received by each seller, for each category and multisellers, as shown in Fig. We find that multisellers have the largest median income throughout the period of observation—except in the last quarter of 2017 and 2018, when they have the second largest median income.

Drughub Market

In the chart below, we see that the DNM Aggregator emerged as the clear leader among fraud shops enabling cybercrime, and Exploit.in and Kraken Market almost equally sold tools used to facilitate ransomware attacks. As for cybercriminal administration, the category includes inflows from ransomware affiliate wallets. This includes purchases such as malicious software and supporting services which cybercriminals sometimes make using escrow services on crime forums. However, trading behaviour in DWM closely resembles what is observed on regulated online platforms despite their significant differences in operational and legal nature14. Nevertheless, due to their unregulated nature, DWMs exhibit behaviours not observed in regulated marketplaces.

The collapse of Abacus Market highlights the ongoing volatility in the Western darknet ecosystem, where sustained law enforcement pressure has created an environment of constant uncertainty. The platform’s success was reflected in its growing market dominance, rising from 10% market share in 2022 to over 70% in 2024. Welcome to this collection of darknet resources, curated exclusively for educational and informational purposes. This repository serves as a knowledge hub for individuals interested in understanding the structure, functionalities, and applications of the darknet. Please note that all material provided here is aimed at promoting awareness, responsible research, and ethical use of information. Geopolitical tensions will likely fuel the rise of hacktivism and ransomware in the Middle East.

Russian Language Marketplaces Remain Drivers of Crypto Drug Sales: TRM Labs Report

The nodes of the S2S network are active sellers (i.e., sellers that are trading at the time) and two sellers are connected by an edge if at least one transaction was made between them during the considered snapshot period. Although the S2S network is composed only of U2U transactions, all categories of sellers (i.e, market-only, U2U-only, and market-U2U) are present in the S2S network. For instance, market-only sellers are entities classified as sellers only in markets, but that may promote U2U transactions with other sellers, hence being part of the S2S network. Therefore, the S2S network can be seen as a proxy for a distribution network of illegal products. In panels (b, c), we show the number of all sellers and buyers per quarter, respectively.

Popular dark web marketplaces

With 12,000+ users and 900+ vendors, it boasts a 95% vendor rating—ideal for quality-focused dark pool trading. With law enforcement agencies improving their ability to track Bitcoin (BTC) transactions, darknet market operators and vendors are moving to Monero (XMR) as their cryptocurrency of choice. To analyse the connectivity of the whole ecosystem, i.e., how markets are connected with each other, we consider sellers and buyers that are simultaneously active on multiple platforms.

Government of Canada reporting confirms that traffickers use both the surface web and dark web to sell drugs delivered by mail or courier. The same reports highlight gaps in the national ability to measure the full scale of this activity. Journalists use the dark web to communicate with sources anonymously, and whistleblowers rely on it to share sensitive information without fear of retaliation.

Cryptocurrency Transactions

Dark-web marketplaces attract sophisticated cybercriminals adept at launching phishing scams, malware attacks, or ransomware threats. Buyers and sellers frequently face risks from malicious actors posing as legitimate vendors or customers, potentially leading to financial loss or exposure of sensitive personal information. Significant technological innovations and trends have reshaped dark-web marketplaces over recent years. In 2026, many platforms have adopted decentralized architectures, reducing single points of failure that previously made them vulnerable to law enforcement takedowns. To prevent users from DDoS attacks, it provides personal marketplace domains to high-volume buyers and sellers. Moreover, this darknet shop provides detailed statistics about each user profile on the platform, giving users a better idea of the vendors for the buyers and vice versa.

KEY TAKEAWAYS If you’re in a hurry, here’s a quick list of darknet search engines of 2026 list… Always use a fake name and a temporary email address when you buy something from dark net shops. You can even use a secure email provider or a burner email address whenever you visit the dark web. If you want to buy something, deposit cryptocurrency in your wallet, and you will be charged directly. He recommends verifying market employees carefully, and to weed out law enforcement infiltration through barium meal tests.

Drughub Market specializes in pharmaceuticals, offering 15,000+ listings and $2 million monthly via BTC. With 8,000+ users and 600+ vendors, it commands a 10% share of darknet drug trades—a rising star since 2023. Archetyp Market delivers 28,000+ listings and $3.5 million in monthly trades using BTC and XMR, securing a 6% market share.

However, many sites on the dark web host illegal content or activities, and engaging with those can lead to serious legal consequences. In some countries, like Russia or China, dark web access itself may be blocked or penalized. Facebook’s onion mirror allows people to access it in countries that block the platform, allowing people to connect across digital borders. That said, the social network’s data collection and tracking practices may seem at odds with many of the principles motivating dark web users.

Due to its extensive inventory and reputation for reliability, Brian’s Club has maintained a significant presence on the dark web. Quality and validity of the data it provides justify its higher cost over other marketplaces. The platform’s popularity continues to grow, attracting both new and returning customers. Flugsvamp 4.0 (FS4) launched on November 2, 2021 as the successor to Sweden’s domestic‑shipping cryptomarket Flugsvamp 3.0, which its administrators had taken offline on October 30–31, 2021. WTN Market positions itself as a localized, bilingual marketplace with familiar DNM trust mechanisms (escrow, ratings, forum) and a UI tailored to Canadian users.

I’ve been poking around these places for a while now, from the giants like Abacus to the old-timers like Vice City. This isn’t just a quick list; it’s the full scoop on what they offer, how they keep things tight, and why they’re worth your time—or not. Whether you’re new to the dark web or a vet who’s seen it all, you’ll find something here to chew on. Below, I’m breaking down each market with everything I’ve picked up—listings, quirks, the works. The result is a time series of lists of sellers and buyers for each period and for each market and the U2U network.

The dark web alert system is designed to urge you to take action before any significant harm is done. Even if you’ve never visited these markets, your personal and financial data might already be there, having been leaked through a data breach. Criminals use this information for money laundering, opening bank accounts, applying for loans, and draining your finances. A thriving category of illicit goods and services sold on dark web markets is that of scans of personal documents. As with our previous reports, we gather data by scanning Dark Web marketplaces, forums, and websites.

The hidden part of the internet is the larger portion that features over 95% of the entire internet. This is the part of the internet known as the dark web, and it’s accessible via mainstream search engines such as Google. Discover everything about what is a darknet market, how it works, security threats related to it, and learn how to protect your data online. It added that many fraud shops are increasingly offering dark web markets third-party crypto-payment processors like UAPS via API calls, as a way to reduce their own costs, improve operational efficiency and increase security. A timeline of darknet marketplace evolution, from Silk Road to 2025’s top players. But according to Ingo Fiedler, co-founder of Blockchain Research Lab, this trend is primarily the result of increasing law enforcement focus on the darknet market industry.

To avoid infection, it’s best to avoid downloading anything from untrusted sources or websites. Many people also prefer to buy goods and services online, which allows for more opportunities to steal people’s personal data and financial information. Using his credentials, cybercriminals committed a variety of online fraud activity over the course of six months. In 2019, the FBI started its investigation into Genesis Market and enlisted other government agencies and law enforcement organizations across the world, working towards the market’s closure on April 4, 2023.

After shut down, the site displayed a seizure notice and directed users to their hidden service[9] to find more information about the operation. Not all onion sites are dangerous, but many host illegal, harmful, or deceptive content. The dark net’s layered encryption and routing protocols offer stronger anonymity, making onion sites appealing to whistleblowers, political dissidents, privacy advocates — and, inevitably, cybercriminals.

We highlight that these networks exhibit different resilience regimes in the presence of external shocks, the ecosystem’s resilience being mostly guaranteed by the network of buyers rather than sellers. In recent years, some darknet markets and fraud shops have been integrating crypto payment processors on their websites via APIs, possibly as a way to improve operational efficiency and increase security. Essentially, these payment processors provide a white label service for darknet markets and fraud shops, and a seamless checkout experience for those services’ customers. UAPS, shown in the chart above, is one such example of a payment processor that many fraud shops, including the OFAC-designated Genesis Market, used in 2023. The value received by UAPS in this chart includes payments sent to multiple fraud shops using the service as a payment processor. Alphabay Market leads with 60,000+ listings and $20 million in monthly trades via BTC and XMR, dominating 20% of darknet marketplaces.

These features help create a sense of ‘trust’ among users, even in the criminal ecosystem. To access darknets, users typically need to download and configure the Tor Browser; a modified version of Mozilla Firefox that routes all traffic through the Tor network. This browser enables access to websites with .onion domain extensions, which are specific to the Tor network. These addresses cannot be resolved by conventional DNS servers, contributing to the hidden nature of darknets. Driven by a passion for continuous learning, I strive to explore the complexities of digital anonymity, the ethical and security implications of hidden networks, and the tools necessary to navigate these spaces responsibly. My work bridges the gap between technology and cybersecurity education, helping to inform and empower others in the ever-evolving cyber landscape.

Overall, our study provides a first step towards a better microscopic characterisation of the DWM ecosystem, indicating a direction of investigation that may be of interest to both researchers and law enforcement agencies. The results further support the recent efforts of law enforcement agencies to focus on individual sellers43,44,45, as well as, more recently, also buyers46,47. Since the beginning of DWMs’ activity, there has been a shift in the law enforcement approach from focusing on market admins towards sellers and buyers9,13. For instance, a recent London Metropolitan Police (MET) investigation examined the transactions of a seller profile on a DWM10.

Law enforcement regularly shuts down these markets, but new ones continuously emerge. By 2025, these platforms are expected to further refine their operations, offering enhanced privacy and efficiency for users engaged in secure online trade. The integration of blockchain technology and decentralized marketplaces has already begun to reshape the landscape, ensuring that transactions remain anonymous and resistant to external interference. These platforms have created a thriving digital economy, with vendors and buyers engaging in transactions that are both efficient and secure.