According to Tor Metrics, over 4 million daily users connect to the Tor network. The U.S. leads with more than 1 million relay users, followed by Germany and France. However, these numbers only reflect relay traffic; total users are likely higher when bridges and alternative access methods are included.
The Use Of Crypto In Vendor Shop Drug Sales Surged In 2024
Companies like CrowdStrike, IBM X-Force, DarkOwl, and Recorded Future have indexed hundreds of millions of pages to help businesses detect potential threats. Several media productions, intelligence companies, hackers, snoopers, and whistleblowers use the dark web for their respective tasks. Moreover, some users use this hidden part of the internet to stay away from prying eyes. However, as the name indicates, this shady part refers to hosting illegal and inappropriate activities, including drug selling, hacking, etc. Its focus on financial fraud and high-value transactions has attracted a dedicated user base, contributing to its growing reputation and market value. Valued at approximately $15 million, Abacus Market is one of the most lucrative platforms in the dark web ecosystem.
Market Operations
Correspondingly, the multihoming activity is a mechanism that contributes to the ecosystem’s resilience. Because they are already active in more than one market, the migration cost for the multihomers is usually smaller compared to that for non-multihomer users, especially for sellers, that need to rebuilt their reputation23. That extortion threat, combined with increased tracing and investigative pressure, led many users to flee the platform, dramatically reducing deposits and facilitating law enforcement’s final takedown. Vendors on Incognito paid a registration fee and a 5% commission on every sale. That revenue went to fund the site’s operations, including servers and what the DOJ described as “employee” salaries.
Seller-to-seller Network
Edison allegedly sourced drugs from global suppliers, laundered proceeds via privacy coin Monero (XMR), and shipped narcotics to cities across India. N 2025, dark web websites frequently change domains and are often short-lived. Accessing them may require .onion links and the Tor browser, but caution is advised due to legality and cybersecurity risks. They use pseudonymous wallets, privacy coins (like Monero), mixers, chain-hopping, and non-KYC platforms to obscure transaction trails. It has a bidding feature, with new batches of stolen data being frequently added. The Abacus Market links to the new dark web marketplace sections and took over much of the vacuum left by the AlphaBay takedown.
This figure dropped quickly in early July, to just $13,000 a day across 100 deposits, as user trust was quickly affected by withdrawal delays. Historically, there have been “silent” takedowns that weren’t accompanied by announcements from the authorities, to allow investigations to continue unobstructed and gather more incriminating evidence or identify accomplices. A nine-count indictment was unsealed in the Western District of Tennessee charging six alleged members of a criminal street gang known as Unknown Vice Lords (UVL) – Ghost Mob with…
Bitcoin Fraudulent Transaction Detection Vulnerability
Considering Monero transactions, the researchers estimate that total sales on Abacus were likely closer to at least $300 million. The best month for the darkweb market was this June, when the value of brokered sales peaked at $6.3 million. Local media reported that Edison was “currently the largest darknet vendor of drugs in India,” sourcing narcotics primarily from UK-based vendor “Gunga Din,” believed to be the world’s largest LSD supplier. It maintains a very strict level of user verification and integration with an official Telegram account to provide real-time updates to users. Various cryptocurrencies such as Bitcoin and Monero can be used to make purchases.
World Market Darknet
- Daily deposits dropped by over 90% in the final weeks, despite reassurances from its administrator.
- While the curves for the seller and buyer median net income were negatively correlated before Silk Road’s shutdown, after that moment they became positively correlated.
- According to TRM Labs, there are clear on-chain links between Nemesis and Chinese drug precursor manufacturers, with funds sent directly from vendors to Chinese suppliers—demonstrating the nexus between crypto-fueled drug trafficking and global supply chains.
- The summit resulted in the Chinese Communist Party (CCP) banning a range of fentanyl precursors and shutting down some suppliers, followed by a further ban of several nitazenes and analogs in July 2024.
- This is down considerably from more than one percent just four years prior but is up slightly from last year’s all-time low of 0.04%.
In 2023, the dark web attracted an average of 2.7 million daily users, with Germany now leading as the country with the highest number of Tor users, surpassing the United States for the first time in years. The biggest takedowns in terms of volume – Silk Road, AlphaBay and Wall Street – have been police-led, but in 2018, the EMCDDA published a study which found that, of the more than 100 markets, just 10 percent closed as a consequence of overt police action. DF claims they are safe from investigation as the site’s business model differs from that of DeepDotWeb, which took affiliate sales fees in return for keeping lists of URLs updated. The arrest of Telegram’s founder, Pavel Durov, in August 2024 triggered a notable shift in the operational dynamics of the platform’s drug vendors. This article reveals the top 10 dark web markets dominating in 2025, their unique characteristics, and the critical implications for enterprise cybersecurity.
- In NSW, the case of R (Cth) v Mead 2017 NSWDC 1 concerned the use of bitcoin to disguise proceeds of crime.
- This article reveals the top 10 dark web markets dominating in 2025, their unique characteristics, and the critical implications for enterprise cybersecurity.
- Their longevity is generally short-lived, with most platforms shuttering or collapsing within two to three years due to law enforcement pressure, market volatility, or internal instability.
- Community consensus and users close to the Abacus team ruled out an FBI operation as a likely reason, leaning more towards an exit scam explanation for the sudden takedown of the platform.
- For instance, there may be sellers that make a small amount of transactions, or spend more than receive, which we would classify as buyers.
NFTs, DeFi, And The Next Wave Of Crypto Crimes
While Monero obscures transaction details, Bitcoin’s traceable blockchain provided law enforcement with critical leads, particularly at the point of off-ramp—when vendors converted crypto into fiat or moved assets through centralized exchanges. Department of Justice announced the results of Operation RapTor—an unprecedented international crackdown on darknet narcotics trafficking. Following the Wall Street Market takedown in May 2019, U.S. and international law enforcement agencies obtained intelligence to identify Darknet drug traffickers, resulting in a series of complementary, but separate, law enforcement investigations. Operation DisrupTor actions have resulted in the arrest of 179 Darknet drug traffickers and fraudulent criminals who engaged in tens of thousands of sales of illicit goods and services across the United States and Europe.
For each entity, we keep track of the cumulative values of the six features for each transaction performed by the entity over time. To be classified as a seller, an entity must simultaneously satisfy the six feature threshold criteria, as follows. From 2012 to 2016, the largest component of S2S network continuously grows in number of nodes and connections, as shown in Fig.
“The biggest source of disruption to markets is currently coming from the ongoing distributed denial of service DDOS attacks that have knocked markets and forums offline intermittently over the last few months,” he says. Incoming crypto volumes to Chinese drug precursor manufacturers have seen a significant decline, from USD 27.6 million in 2023 to USD 17.0 million in 2024. This drop may be driven in part by stronger actions from the Chinese government following the Biden-Xi summit of November 2023.
What Happened To Abacus Market?
Such companies’ tools enable investigators to trace administrator wallets and follow illicit flows even after a marketplace goes offline. TRM will continue to closely monitor the evolving DNM landscape, including emerging platforms, vendor migration patterns, and on-chain activity, to support efforts to disrupt illicit actors and safeguard the broader crypto ecosystem. According to the government’s evidence, Sterlingov operated Bitcoin Fog from October 2011 to April 2021. Bitcoin Fog was a cryptocurrency “mixer,” or “tumbler,” and had gained notoriety as a money laundering service for criminals seeking to hide their illicit proceeds from law enforcement. Over the course of its decade-long operation, which stopped only when Sterlingov was arrested and detained, Bitcoin Fog moved well over 1.2 million Bitcoin (BTC) – valued at approximately nearly $400 million at the time of the transactions. The bulk of that cryptocurrency came from darknet marketplaces and was tied to illegal narcotics, computer fraud and abuse activities, and identity theft.
In contrast to Russian-language DNMs, Western darknet marketplaces continued to struggle throughout 2024 as a result of sustained law enforcement action, coupled with several high profile exit scams. In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers. The nodes of the S2S network are active sellers (i.e., sellers that are trading at the time) and two sellers are connected by an edge if at least one transaction was made between them during the considered snapshot period. Although the S2S network is composed only of U2U transactions, all categories of sellers (i.e, market-only, U2U-only, and market-U2U) are present in the S2S network. For instance, market-only sellers are entities classified as sellers only in markets, but that may promote U2U transactions with other sellers, hence being part of the S2S network. Therefore, the S2S network can be seen as a proxy for a distribution network of illegal products.
