The period of dominance by Silk Road is unique, because the ecosystem structure is effectively composed of and dominated by a single market, expressed by a market share equal to one, as shown in Fig. After the shutdown of Silk Road, in the last quarter of 2013, the ecosystem evolves to a structure where several markets coexist. This structural change is reflected in the median net income of sellers and buyers, as shown in Fig. While the curves for the seller and buyer median net income were negatively correlated before Silk Road’s shutdown, after that moment they became positively correlated. Specifically, sellers show a trend of increase and buyers a trend of decrease in their median net income before the shutdown.
Metaplanet Acquires 5,288 BTC, Lifts Total Holdings To 30,823 BTC
TRM Labs is the only blockchain intelligence provider with a specialist category unique to individual drug vendors — and this year, we saw incoming volumes sent to illicit vendor shops more than double. Even as major darknet platforms fall, TRM Labs data shows that the ecosystem remains highly adaptive. Following the 2022 shutdown of Hydra Market, TRM identified new Russian-language darknet markets emerging that by 2024 accounted for more than 97% of global darknet drug revenues.
Multiseller Network
Operation DisrupTor actions have resulted in the arrest of 179 Darknet drug traffickers and fraudulent criminals who engaged in tens of thousands of sales of illicit goods and services across the United States and Europe. Only four Russian-language DNMs left the approximately 20-strong ecosystem in 2024. The departure of market leaders such as Solaris Market — which ceased operations in autumn 2024 — is a rare occurrence. Cases like Nemesis Market and Monopoly Market indicate that law enforcement agencies now prefer to take down DNMs without announcing it publicly — and potentially alerting vendors under investigation. This allows them to compile intelligence and make arrests at optimal moments. In the interim, many in the DNM community will assume the marketplace performed an exit scam and continue their activity on other platforms.
On-chain data from BitInfoCharts shows that the daily number of monero transactions has halved from this time last year. Researchers at Qatar University and the country’s Hamad Bin Khalifa University earlier this week published findings that show just how easy it may be to dredge up evidence of years-old bitcoin transactions when spenders didn’t carefully launder their payments. In well over 100 cases, they could connect someone’s bitcoin payment on a dark web site to that person’s public account. In more than 20 instances, they say, they could easily link those public accounts to transactions specifically on the Silk Road, finding even some purchasers’ specific names and locations. Cryptocurrency fraud has seen a significant rise in recent years, with various schemes exploiting the digital nature of cryptocurrencies. This section explores Ponzi and pyramid schemes, ICO scams, rug pulls, and phishing attacks, as well as cryptojacking, fake wallets, and fraudulent exchanges.
Darknet Markets Explained
In sentencing the offenders Lovell J (with Peek and Blue JJ agreeing) determined that bitcoins and the darknet were an essential part of the offenders’ sophisticated and “untraditional” business model. The Court accepted the Crown’s submission that the use of these technologies was intended to disguise their criminal conduct in order to avoid detection by the authorities. Behind the big revenue numbers are thousands of individual vendors, each running operations that range from small side hustles to large-scale enterprises. The earnings data highlights just how uneven, yet lucrative, this underground economy can be. The views and opinions expressed in this article are solely those of the authors and do not reflect the views of Bitcoin Insider. The information provided in this article does not constitute financial, investment, or trading advice.
- On the other hand, the dark web is a small subnet of the deep web that requires special software like Tor to access (it’s where most of the anonymous communication and illicit platforms exist).
- The trading volume generated by stable pairs is more than five times larger than that of non-stable pairs13.
- Historically, the largest users of Bitcoin Fog were darknet markets such as Agora, Silk Road, Silk Road 2.0, Evolution, and AlphaBay.
- Regulators, banks, and blockchain developers must work together to counter evolving laundering tactics while maintaining the integrity of digital finance.
- Cryptocurrencies have become integral to the dark web economy, enabling illicit transactions and fueling cybercrime activities.
Use Of Bitcoin In Darknet Markets: Examining Facilitative Factors On Bitcoin-Related Crimes
However, trading behaviour in DWM closely resembles what is observed on regulated online platforms despite their significant differences in operational and legal nature14. Nevertheless, due to their unregulated nature, DWMs exhibit behaviours not observed in regulated marketplaces. They offer anonymity to their users by using and developing specialized tools. DWMs are accessed through darknet browsers supporting the onion routing protocol (e.g., Tor), which provides anonymous communication connections35.
How Marketplaces Vet Buyers And Sellers
IRS-CI’s analysis determined Bitcoin Fog received approximately 486,861.69 BTC, valued at about $54,897,316 at the time of the transactions, directly from darknet markets. Bitcoin Fog sent approximately 164,931.13 BTC (about $23,690,956 at the time of the transactions) directly to darknet markets. In sum, the anonymizer sent or received more than $78 million in transactions involving known darknet markets, counting only direct transactions. By contrast, Western darknet markets faced severe headwinds in 2024—high-profile exit scams, shutdowns, and arrests destabilized the ecosystem. Markets like Bohemia, Incognito, and GoFish vanished under suspicious circumstances.
Power Your Insights With Data You Can Trust
Jardine emphasized that illicit cryptocurrency transactions represent only a minor share of total crypto activity. The cryptocurrency space remains vulnerable to scams that exploit investor trust and security weaknesses. Fraudulent ICOs, rug pulls, and phishing attacks deceive users through false promotions and impersonation tactics. These threats highlight the need for stronger security measures, regulatory oversight, and increasing user awareness. The prevention of these threats demands more robust regulation, better KYC/AML mechanisms, and increased blockchain analysis. Regulators, banks, and blockchain developers must work together to counter evolving laundering tactics while maintaining the integrity of digital finance.
Since its inception, Abacus Market has gradually increased its market share in the Western DNM ecosystem. In 2022, it ranked as the fourth largest Bitcoin-supporting Western DNM with 10% of market share, rising to 17% in 2023. In 2024, its share surged to over 70%, following ASAP Market’s voluntary closure in July, 2023 and the law enforcement seizure of Incognito Market in March, 2024.
It has also meant most new Western darknet marketplaces are generally low-effort projects, such as 3DogsMarket, Drugula Market and Squid Market, built using scripts and beset by security flaws, with the sole aim of generating quick profits before disappearing. DEXs facilitate anonymous crypto-to-crypto swaps without identity verification, leveraging cross-chain bridges and privacy tools to obfuscate transactions. Some P2P enable off-ramping via cash and prepaid vouchers, bypassing AML compliance under claims of mere facilitation. Regulatory countermeasures, including blockchain analytics and the FATF’s Travel Rule, aim to trace illicit flows. However, enforcement inconsistencies highlight the ongoing struggle between financial privacy and regulatory oversight in combating cryptocurrency-enabled money laundering. The analysis can also reveal additional addresses controlled by the same individual or entity.
The summit resulted in the Chinese Communist Party (CCP) banning a range of fentanyl precursors and shutting down some suppliers, followed by a further ban of several nitazenes and analogs in July 2024. As a result, drug precursor manufacturers have begun to shift to new analogs and substances, while adopting alternative methods to cryptocurrency to obscure their financial footprints. Given the explosive growth of these markets, organizations must prioritize proactive threat monitoring. Axis Intelligence provides dark web surveillance solutions that help businesses identify leaked credentials, fraud attempts, and malware risks before they escalate. Faced with the decision between profit seeking and self preservation, Abacus’s admins likely chose the latter in light of Archetyp’s seizure and the surge in new users that elevated Abacus’s profile. Furthermore, after four years of operating and generating substantial profits, the admins likely lost motivation to continue and chose to exit the ecosystem to preserve their freedom and financial gains.
Although other coins are used, such as Monero recently, Bitcoin is still the mostly used in the ecosystem, being supported by more than 93% of markets7,9. The pre-processing relies on established state-of-the-art heuristics to cluster addresses into entities, such as cospending, intelligence-base, and behavioral clustering39,40,41,42. The resulting data set includes for each transaction the source and destination entities, the time, and the value of the transaction.
We developed Lunar to monitor the deep and dark web, including dark web marketplace sites. Law enforcement has shown that it’s willing to dig into the blockchain to assemble evidence of past criminal transactions. In the case of convicted Silk Road founder Ross Ulbricht, for instance, a FBI contractor demonstrated to a jury that $13.4 million in bitcoin had at one point moved from the Silk Road’s servers to Ulbricht’s laptop. One German Silk Road customer was fined 3,000 euros by German authorities after they busted a marijuana dealer who’d kept records of his past sales, years after they had occurred. Despite these advancements, criminals continuously adapt, utilizing privacy coins and decentralized networks to evade detection.
Over the last year, the online illicit drug trade has continued to decentralize away from darknet markets and towards encrypted chat and social media platforms. This trend, already prevalent in Western communities, has been increasingly seen in the Russian-language ecosystem as well. However, when a DNM collapses — especially a large and reputable market — its users typically migrate to the nearest available platform. For example, ASAP Market’s closure likely prompted its vendors and buyers to migrate to Abacus, as evidenced by a 20% increase in Abacus’s volume compared with the month before ASAP Market shut down. Furthermore, following Archetyp’s law enforcement seizure in June, 2025, many of its users flooded Abacus Market, leading to the latter’s largest ever monthly sales volume of USD 6.3 million in June 2025. These markets host hundreds, or in some cases thousands, of people who sell drugs, commonly referred to as “vendors”.
