Like AlphaBay, Hansa Market was used to facilitate the sale of illegal drugs, toxic chemicals, malware, counterfeit identification documents, and illegal services. The administrators of Hansa Market, along with its thousands of vendors and users, also attempted to mask their identities to avoid prosecution through the use of Tor and digital currency. Further information on the operation against the Hansa Market can be obtained from Dutch authorities. TRM Labs analysis shows that nearly half of the marketplaces launched in 2024 accepted only Monero — a sharp increase from just over one-third in 2023. This signals a growing preference among darknet operators for obfuscation and anti-surveillance tools.
Its purpose is to make the code undetectable by signature-based scanners, thus enhancing its stealthiness. Earlier today, a New York man was resentenced to three years in prison for his creation and operation of BreachForums, a marketplace for cybercriminals to buy, sell, and trade hacked or… Previous DNM admins who either voluntarily exited, such as ASAP Market, Agora Market, and WhiteHouseMarket, or conducted exit scams, such as Evolution Market, while at the top of the ecosystem have yet to be apprehended by law enforcement.
Evolution And Market Dynamics Of Bitcoin Mixers And Cleaning Services
The reason is that the operational structure of DWMs inherently hides the seller–buyer link, as all transactions are made through the marketplace. Buyers send money to the marketplace, which in turn sends the money to the seller. Thus, further analyses in this direction have been hindered by the lack of heuristics able to identify these two key classes of actors in transaction networks and their roles in the structure and dynamics of the ecosystem. In 2024, the popularity of black traffic schemes on underground markets remained constant. Black traffic dealers have maintained their operations by promoting malicious landing pages through deceptive ads.
- These critical changes may not be perceived from macroscopic measures of the ecosystem as a whole.
- However, trading behaviour in DWM closely resembles what is observed on regulated online platforms despite their significant differences in operational and legal nature14.
- The market emphasizes anonymity and security, conducting transactions exclusively through cryptocurrencies like Bitcoin and Monero.
- Banner, 31, of Boynton Beach, Florida, is scheduled to be sentenced on June 8 after pleading guilty to one count of conspiracy to possess with intent to distribute fentanyl, methamphetamine, and heroin.
- When a marketplace is shut down, vendors can typically migrate to other platforms.
Dark Web Statistics By Demographics, Marketplace, Revenue And Facts (
Despite most darknet markets banning the sale of fentanyl in their terms of service, nearly all mainstream Western-facing markets have vendors that sell fentanyl-laced products. While it received a relatively small share of large retail purchases as shown in the previous chart, Abacus Market is one such example. Though many customers are concentrated in Australia, Abacus has vendors and customers around the world, including the United States.
- Previous DNM admins who either voluntarily exited, such as ASAP Market, Agora Market, and WhiteHouseMarket, or conducted exit scams, such as Evolution Market, while at the top of the ecosystem have yet to be apprehended by law enforcement.
- Cybercrime enablement represents flows from ransomware, stolen funds, malware, or fraud shops to darknet markets.
- Meanwhile, ecosystem actors can play a pivotal role in identifying scam networks’ on-chain footprints, with law enforcement working across jurisdictions to recover stolen funds.
- Retained some of those new users, many soon migrated to BlackSprut and Mega.
Overview Of Crypto-Cybercrime Trends In 2023
The dark Web is the World Wide Web, which requires authorization and configurations of specific software to access. When you access a website on the clearnet, your information travels directly from your computer to the website’s server. On the dark web, Tor encrypts your data and bounces it through multiple servers around the world before reaching the destination website.
It is expected new marketplaces will emerge in 2023 (like the recently launched Kraken) to expand influence. The key 10 marketplaces outlined in this report will continue to keep fighting for market monopolization. As outlined in the report, geopolitics and drug trafficking have become inextricably linked, that’s why the volume of shadow economy in the Dark Web will remain to grow and accelerated by ongoing tensions.
Emergence And Structure Of Decentralised Trade Networks Around Dark Web Marketplaces
In particular, these studies are based on user reviews which carry many inaccuracies, for instance, with respect to the time and value of the transaction19, that further compound error in other measures. Moreover, data scraped from the DWMs cannot assess the U2U transactions which account for the largest fraction of the total trading volume of the ecosystem13. On the more optimistic side, the revenue from darknet markets has not surpassed the peak levels recorded during Hydra’s operation just yet. Chainalysis anticipates ongoing efforts by law enforcement to investigate and dismantle these platforms, especially those who are involved in selling fentanyl products. This resurgence of niche marketplaces is not unprecedented, but mirrors patterns seen after the closures of other big darknet markets like Silk Road and AlphaBay.
Industries Most Vulnerable To Dark Web Attacks
2022 saw a decline in revenue from the previous year for darknet markets and fraud shops. Total darknet market revenue for 2022 ended at $1.5 billion, down from $3.1 billion in 2021. AlphaBay operated as a hidden service on the “Tor” network, and utilized cryptocurrencies including Bitcoin, Monero and Ethereum in order to hide the locations of its underlying servers and the identities of its administrators, moderators, and users. Based on law enforcement’s investigation of AlphaBay, authorities believe the site was also used to launder hundreds of millions of dollars deriving from illegal transactions on the website.
In the post-OMG dominance period, OMG retained a number of those former Hydra counterparties, but lost a significant share of their illicit activity to the other two markets across all categories. While darknet markets have largely recovered after Hydra’s closure and fraud shops have not, single vendor shops showed a different pattern. Single vendor shops are standalone shops set up by individual drug vendors who have typically gathered a large customer base on a larger, traditional darknet market. Setting up a single vendor shop allows those vendors to save on fees that would ordinarily go to the administrators of a traditional darknet market.
Why Are All The Darknet Markets Down
As of 2025, daily traffic surpassed 3 million, with approximately 60 percent of domains hosting illicit content. Roughly 500,000 users regularly frequent darknet marketplaces, where over 37 percent of purchases likely result in further crimes. Fraud shops are a unique segment of darknet markets that sell stolen data such as compromised credit card information and other forms of personally identifying information (PII) that can be used for fraudulent activity. This decline was triggered in part by the closure of prominent fraud shops like Bypass Shop, which was shut down in March. Brian Dumps, the biggest overall fraud shop for the year, also appears to have suffered a disruption as its revenue fell almost to zero in October, though it’s unclear exactly why.
Decline In Scam Revenues With An Emergence Of New Schemes
Today, no single player is dominant like these marketplaces were before their takedown, with administrators preferring to specialize in particular types of goods and services. This particular market is modeled on the late Alphabay Market that was seized and shut down in the middle of 2017. So far, the replacement has been successful, making this one of the most popular and used marketplaces to date. If you’re planning on selling anything on Dream Market, it’s easy to create an account, and Dream Market will take 4% of all your earnings as a commission fee. The site is nicely laid out, there are a few categories to explore, and it’s quite a quaint experience. Attorney’s Office for the Eastern District of California filed a civil forfeiture complaint against Alexandre Cazes and his wife’s assets located throughout the world, including in Thailand, Cyprus, Lichtenstein, and Antigua & Barbuda.
Although other coins are used, such as Monero recently, Bitcoin is still the mostly used in the ecosystem, being supported by more than 93% of markets7,9. The pre-processing relies on established state-of-the-art heuristics to cluster addresses into entities, such as cospending, intelligence-base, and behavioral clustering39,40,41,42. The resulting data set includes for each transaction the source and destination entities, the time, and the value of the transaction. The largest component of the S2S network of U2U transactions between sellers for each year with the respective number of nodes (N). The nodes are sellers that are active in that year, and an edge is placed between two sellers if at least one transaction occurs between them during that year. The network is mostly populated by U2U-only sellers, followed by market-only sellers.
2024 was a significant year in the global high-profile fight against cybercrime. We at Kaspersky also actively contributed to law enforcement efforts to combat cybercrime. We also assisted the joint INTERPOL and AFRIPOL operation combating cybercrime across Africa.
Cyble Partner Network (CPN) Join Us
In particular, we analyse networks of ‘multihomers’, defined as users that are simultaneously trading in multiple markets. We show that these users play a crucial role in the connectivity of the ecosystem because they act as connectors between markets. Analogously, we identify and characterise ‘multisellers’ (i.e., multihomers that are sellers) and ‘multibuyers’ (i.e., multihomers that are buyers). Furthermore, we analyse the seller-to-seller (S2S) network, i.e., the network composed only of transactions among sellers, which can be regarded as a supply chain network of illicit goods and services.
