Dark markets continually adapt and evolve to stay ahead of law enforcement and security measures. This ongoing cat-and-mouse game poses a significant technical challenge in combating the activities within darknets. Administrators and sellers on dark web marketplaces had a better 2023 than the previous year, pulling in an estimated $1.7bn in cryptocurrency-based revenues, according to new Chainalysis data. Ultimately, the RAKS bust, far from being a negative blow, bolsters the long-term prospects for legitimate crypto adoption. By demonstrating that authorities can effectively police the digital frontier, such operations build confidence that cryptocurrencies can operate within a legal and ethical framework.
In 2025, darknet markets continue to provide a secure and efficient platform for the trade of pharmaceuticals and recreational substances. Among the most prominent markets, AlphaBay Reloaded and WhiteHouse Market 2.0 stand out for their robust infrastructure and user-friendly interfaces. Recognizing the role of darknet markets in trafficking stolen data, we conducted the largest systematic examination of stolen data markets that we are aware of to better understand the size and scope of this illicit online ecosystem. To do this, we first identified 30 darknet markets advertising stolen data products. Despite most darknet markets banning the sale of fentanyl in their terms of service, nearly all mainstream Western-facing markets have vendors that sell fentanyl-laced products.
In repressive regimes, darknets play a vital role in enabling free speech and access to uncensored information. Tools like Tor are used to bypass government-imposed firewalls and surveillance, ensuring open communication. The significance here is the preservation of civil liberties and the right to information. Businesses operating in such regions may need to adapt to the technical challenges and risks posed by using darknets for legitimate purposes. Platforms like SecureDrop enable individuals to submit documents and communicate securely with journalists, thereby exposing corruption and wrongdoings while preserving their anonymity.
Topic 3: Product Quality
- The demand for pharmaceuticals on darknet markets remains high, with a focus on prescription medications, nootropics, and performance-enhancing drugs.
- Dark markets include features similar to those found in legitimate e-commerce platforms, such as product listings, user reviews, ratings, and customer support.
- The first category includes classic marketplaces, which serve as one-stop shops for a wide range of illegal goods.
- Tools like Tor are used to bypass government-imposed firewalls and surveillance, ensuring open communication.
- In 2019, there were approximately 8,400 active sites on the dark web, selling thousands of products and services daily.
- Its emphasis on user anonymity and document forgery makes it a core tool for identity fraud.
Notifying individuals that they have been observed engaging in darknet market activities could deter them and other users from future use of the platform by showcasing the intelligence-gathering power of law enforcement. An example of this was also Operation Bayonet, where the Dutch agency, after takedown of AlphaBay and Hansa, posted user account details of some accounts they were tracking. The reliable operation of darknet markets over a decade has been based on a number of interrelated factors.
FT Recommends
It has built a reputation for being a reliable source of stolen credit card data and PII. Renowned for its extensive inventory of financial data and sophisticated operating methods, Brian’s Club is a key player in the underground economy of financial cybercrime. In 2023, the total amount of money received by darknet markets and fraud shops increased compared to the previous year.
Chainalysis also noted that there is a rise in the use of artificial intelligence in the fraud and scams space. It added that it expects this share to rise over time, although historically these rates have consistently remained below 1 per cent. Unlike BTC, which relies on a transparent public ledger, Monero offers built-in privacy features such as ring signatures, stealth addresses, and confidential transactions, making it nearly impossible to trace sender and receiver identities. “But as scams on more blockchains including Ethereum, Tron, and Solana have grown, so too has the use of DeFi protocols,” the report noted. In terms of vendor behavior, the change is largely dominated by wholesale vendors. Meanwhile, retail vendors, who operate on a smaller scale, are holding more of their illicit earnings in personal wallets, delaying conversion to fiat to avoid detection.
What Makes A Dark Web Market Different From Regular Online Stores?
Today’s cybercriminals spread their activities across multiple platforms, making them harder to track and shut down. We’re back with another video in our Webz Insider video series on everything web data. Established in 2022, WizardShop is one of the biggest data stores on the dark web, focusing mainly on carding and financial data. In addition to this, an exit scam may be less attractive once an operator has accumulated significant wealth – especially if there is the risk of retribution from their customers. One possible reason for this shift is that reputation has become an increasingly valuable commodity on the dark web. In an environment where trust is in short supply, a pseudonymous actor’s track record is important if they want to operate on the dark web in the future.
Agentic AI-Powered, Intelligence-Driven Unified Cybersecurity Platform
It’s the place where you can buy or sell stolen credit card numbers, SSH login credentials, and personally identifiable information (PII). Transactions within dark markets predominantly involve cryptocurrencies like Bitcoin, Monero, or Ethereum. These digital currencies provide a degree of anonymity, as transactions are recorded on a public ledger but do not directly link users to their real-world identities.
It is common to hear news reports about large data breaches, but what happens once your personal data is stolen? Our research shows that, like most legal commodities, stolen data products flow through a supply chain consisting of producers, wholesalers, and consumers. But this supply chain involves the interconnection of multiple criminal organizations operating in illicit underground marketplaces. Understanding how the dark web works can help you protect your digital life (including assets). Read on to explore major dark web statistics, popular dark web marketplaces, the number of users, and much more.
- Launched in September 2022, Torzon Market operates on the Tor network and features over 11,600 illegal products, including drugs and hacking tools.
- Moreover, it’s not only the entertainment industry that gets hit; some sell cracked versions of the most expensive software, and others offer pirated eBooks and academic material at cheap prices.
- However, it has a sneak peek, easy guide steps, and/or a quick list providing quick in-page navigations and easily-found answers if desired.
- WizardShop has solidified its status as one of the best data stores in the dark web by providing an impressive quantity of quality data as well as providing a trustworthy, easy to use interface allowing criminals easy and secure buying and selling.
- This has fueled paranoia among darknet market users, with many suspecting law enforcement involvement in every market closure.
Evolution Of The Darknet Ecosystem
In order to gain control of victims’ computers, the malware Genesis Market employed used a legacy Bitcoin address to determine the command-and-control (C2) server, from which cybercriminals initiated remote access to infected devices. Though Mega Darknet Market typically serves a Russian customer base, the drug revenue shown in the chart above likely came from customers based in Europe. Mega clearly dominated the realm of wholesale drug purchases, capturing 51.9% of that segment. The chart above shows that ASAP and Mega Darknet markets led the large retail and wholesale segments respectively. Looking closer at ASAP Market inflows, it won some share of revenue across all drug purchase types, receiving 37.1% of social supply, 35.7% of large retail, 16.5% of small retail, and 13.5% of wholesale purchases. The chart above shows that, while values haven’t risen back to 2021 levels, darknet market revenue has slightly rebounded since Hydra’s closure in 2022.
Discover More About Threat Intelligence
Social ties and repeated exchanges between vendors and customers were named as the key elements of trust building between the actors (Munksgaard, 2023; Norbutas et al., 2020). Sales are concentrated on a small number of sellers, whose close relationships with their customers help them move to a new market when law enforcement intervenes (Décary-Hétu & Giommoni, 2017). Finally, the transaction would not be completed without the timely and stealthy delivery of the products (Aldridge & Askew, 2017; Bancroft & Reid, 2016; Espinosa, 2019). Today, darknets are populated by a vast array of users, ranging from privacy-conscious individuals to cybercriminals, hacktivists, and nation-state actors. These hidden networks provide a platform for illegal activities that include the sale of stolen data, hacking tools, weapons, counterfeit currency, and narcotics.
Why Are These Markets Shunning Exit Scams?
Finally, the data is purchased by consumers who use it to commit various forms of fraud, including fraudulent credit card transactions, identity theft, and phishing attacks. For compliance teams, this case highlights the importance of continuous monitoring, real-time intelligence, and robust risk mitigation strategies. As the illicit crypto ecosystem continues to evolve, compliance professionals, regulators, and law enforcement must work together to ensure that exchanges like Garantex cannot re-emerge under new names. It, however, becomes illegal when you use it for unlawful activities such as buying drugs, weapons, stolen data, or engaging in cybercrime. Many people, including journalists and researchers, access the dark web legally for work-related purposes.
Strategic AI In Cyber Defense: How To Stay Ahead Without Increasing Risk
A man has appeared in court following the seizure of €6.5m (£5.6m) worth of cryptocurrency in County Dublin. This article is for informational purposes only and does not constitute financial or investment advice. Christian Jordan Howell is assistant professor in cybercrime, University of South Florida, and David Maimon is professor of criminal justice and criminology, Georgia State University. For comparison, most midsize companies operating in the US earn between $10 million and $1 billion annually. Both Agartha and Cartel earned enough revenue within the 35-week period we tracked them to be characterized as midsize companies, earning $91.6 million and $32.3 million, respectively. Other markets like Aurora, DeepMart, and WhiteHouse were also on track to reach the revenue of a midsize company if given a full year to earn.
The exchange has continued to facilitate hundreds of millions of dollars in illicit transactions for criminal actors, sanctioned entities, and individuals. Earlier in the day, Garantex announced via one of its primary Telegram channels that it would be temporarily seizing operations after Tether blocked approximately USD 28 million in USDT from the service. The exchange also shared 89 cryptocurrency addresses that they claimed were frozen by Tether. The subsequent takedown move marks one of the most significant international crackdowns on illicit cryptocurrency operations to date. In successful cases, law enforcement can combine this intelligence with other investigative techniques to seize the online infrastructure and residual virtual currency, like in the case of the Silk Road seizure.
