The median net income is positive for sellers while negative for buyers throughout the whole period of observation. This result is not trivial because, although the classification induces a positive net income for sellers, it is performed on each market and the U2U network separately, while the median net income is computed based on all transactions made by an entity. In fact, when we compute the total net income for each seller, a considerable fraction (16%) has a negative net income because they spend in markets where they are not classified as sellers, or in the U2U network. Moreover, we find a change of trend between the seller and the buyer median net income time series which reflects the dominance of markets, as detailed in the next section. As darknet marketplaces continue to disappear without warning, whether through exit scams or unannounced law enforcement operations, blockchain intelligence firms, such as TRM, remain a key component to help investigators. Such companies’ tools enable investigators to trace administrator wallets and follow illicit flows even after a marketplace goes offline.
These actors rely on anonymity and fragmentation to operate, but even in the anonymized corners of the internet, there are digital footprints. Parsarad is accused of overseeing the platform’s rise into one of the world’s largest darknet marketplaces, amassing more than 150,000 users and 1,100 vendor accounts. Nemesis operated primarily on Tor, offering a menu of contraband that extended from counterfeit documents and hacking tools to narcotics in their most dangerous forms. Parsarad also allegedly provided laundering services for vendors by using mixing protocols and retained a cut of all transactions processed through Nemesis. Historically, Telegram has been a favored platform for selling drugs — due to its security and public perception of non-cooperation with law enforcement, as well as strict access controls for groups and channels. However, Durov’s arrest has heightened fears that Telegram will now provide data on its users to law enforcement.
Cryptocurrency-enabled drug sales also grew by over 19% from 2023 to 2024, reaching nearly USD 2.4 billion in volume. During the same period, the number of newly launched darknet marketplaces declined 42% year over year — indicating that while the ecosystem is consolidating, remaining actors may be becoming more operationally advanced. In early July, 2025, Abacus Market, the largest Bitcoin-enabled Western darknet marketplace (DNM), went offline, rendering all internet-facing infrastructure, including its clearnet mirror, inaccessible. TRM Labs assesses that the marketplace’s operators have likely conducted an exit scam, shutting down operations and disappearing with users’ funds. Cryptocurrencies have revolutionized the global finance environment with financial inclusion, efficiency, and decentralization capabilities.
Dark Web Illegal Activities Stats
Mr. Shaughnessy allegedly transferred his bitcoin proceeds to other cryptocurrency wallets in exchange for regular fiat currency, which was shipped to his home in Dallas. Unbeknownst to Mr. Shaughnessy however, he sent more than $120,000 in bitcoin to wallet addresses controlled by federal agents. Illegal file sharing (29%) and leaked data (28%) dominate dark web content, surpassing drug markets (just 4%). This shift highlights the growing demand for stolen databases, credentials, and pirated software. According to Tor Metrics, over 4 million daily users connect to the Tor network. The U.S. leads with more than 1 million relay users, followed by Germany and France.
Each marketplace is a star-graph where the central node is the marketplace, and the leaf nodes, i.e., the first-neighbors, are the marketplace users. Therefore, all transactions involving the market have the market either as a source or as a destination node. Parsarad’s indictment is not just the story of one marketplace’s demise—it is a signal that even in hostile jurisdictions and decentralized systems, there remains a path to accountability.
Money Flows: Darknet Markets & Illicit Crypto
If you look further down, you’ll find promotional content (6%) and discussion forums (5%), which may not dominate in size but are crucial for advertising services and enabling anonymous exchanges. Did you know you can verify any unconfirmed Bitcoin transaction with our Bitcoin Block Explorer tool? Browse the search results, clicking on each listing to view the product in more detail.
Bitcoin Fraudulent Transaction Detection Vulnerability
Archetyp’s recent takedown followed this pattern and likely influenced Abacus’s trajectory. Established in 2019, Russian Market is a well-known and highly regarded data store on the dark web, specializing in the sale of PII and various forms of stolen data. Despite its name, the marketplace operates primarily in English and serves a global audience. It has gained a reputation for being a reliable source of high-quality data for cybercriminals. It has built a reputation for being a reliable source of stolen credit card data and PII.
Though they don’t reveal many personal details of those 22 individuals, the researchers say that some had publicly revealed their locations, ages, genders, email addresses, or even full names. “You have irrefutable evidence mapping this profile to this hidden service,” says Yazan Boshmaf, another of the study’s authors. Sanctioned nations use cryptocurrencies to evade economic restrictions, conducting cross-border transactions and mining digital assets to generate revenue. The decentralized nature of crypto complicates enforcement, prompting governments to develop advanced tracking strategies. Emerging threats include the use of stablecoins for financial stability and privacy coins for anonymity.
Arrest And Trial Of Ross Ulbricht
To do so, the Qatari researchers first collected dozens of bitcoin addresses used for donations and dealmaking by websites protected by the anonymity software Tor, run by everyone from WikiLeaks to the now-defunct Silk Road. Then they scraped thousands of more widely visible bitcoin addresses from the public accounts of users on Twitter and the popular bitcoin forum Bitcoin Talk. Crypto anonymity tools, such as mixing services (tumblers) and privacy coins, enhance transaction privacy by obscuring the origin of funds.
Operation RapTor: The Largest Darknet Takedown In History
In the U2U network, an edge connects nodes that are not necessarily users of the same market. Previous studies have shown that, although the number of users and transactions is larger in markets, the trading volume in the U2U network is larger than that of markets13. The horizontal bars represent each market lifetime, i.e., the time when the market becomes active until its closure, and is colored according to the market’s monthly trading volume in USD. In the vertical axis, markets are in the chronological order of their launch date, although for some markets the activity effectively starts after the launch date (e.g., AlphaBay).
- Ponzi schemes usually rely on new investors’ funds to pay earlier ones, collapsing once recruitment slows.
- We use data of DWM transactions on the Bitcoin blockchain pre-processed by Chainalysis Inc.
- Based on our observations from analysis on dark web data using Lunar, we’ve identified the top 7 marketplaces on the dark web in 2025.
- Torzon offers a premium account option for additional benefits and is valued at approximately $15 million, accepting payments in Bitcoin (BTC) and Monero (XMR).
- Germany takes second place with nearly 600k users, and France comes in third with about 175k.
- Apart from the dark web markets that are operating online today, some raided platforms influenced many markets.
As of Q2 2025, there are 37 known active marketplaces, a 28% increase from 2024. To find out which darknet markets are currently popular, and the .onion URL required to visit each one, see Darknetlive.com or dark.fail. Dark.fail lists numerous darknet sites, including forums; scroll down the page until you see the names of darknet markets and look for the green light beside the URL to denote that it’s currently online. The seller will check their account and, when they see the funds, release the bitcoin that’s locked in the escrow wallet.
In Grand Theft Auto Online, players who purchase warehouses and garages for illicit cargo and stolen cars can buy/steal and sell them through trade on the “SecuroServ” syndicate website. After the Biker DLC, players can now purchase buildings for illegal drugs and counterfeit products manufacture, and distribute them through a darknet website called “The Open Road” where law enforcement cannot be notified of the player’s trade. Silk Road was utilised by its users as a black market for all types of (in most countries) illegal activities, like buying and selling drugs, credit card data or even guns and other weapons. It was the first Darknet black market of its kind and was the precursor for many similar sites. While some of these markets were shuttered by law enforcement agencies – some took the easy way out with exit scams. Here are some of the now-defunct dark web markets that were notorious for cybercrime.
The U2U-only category is comparatively small, representing only 6% of all buyers on average. The number of market-U2U and market-only buyers also drops as a consequence of operation Bayonet. However, compared to sellers, the drop is notably smaller, and the number of buyers rapidly recovers to previous values. Moreover, the number of multibuyers increases, which suggests a fast response from buyers to external shocks by trying to diversify their sources.
Products And Services
Bitcoin, created in 2008, has become the most widely accepted virtual currency in the world. The result is a time series of lists of sellers and buyers for each period and for each market and the U2U network. The classification is performed in five steps (see Fig. 1), as detailed next. To reduce the presence of noise in the S2S network, we consider only stable U2U pairs, i.e., pairs that have at least three transactions throughout the whole period of observation13. The trading volume generated by stable pairs is more than five times larger than that of non-stable pairs13. The S2S network is mostly populated by U2U-only sellers, followed by market-only, and market-U2U (see Supplementary Information Section S5).
What’s Behind This Likely Exit Scam?
Click ‘Wallet’ at the top of the page and you’ll see the BTC in your Localcryptos wallet. Click on the wallet and you’ll be taken to a transaction page where you can send your BTC to a different wallet – in this case one pertaining to the darknet market where you will be shopping. Additionally, we analyse the U2U network of transactions, i.e., the transactions between pairs of market first-neighbors where the source and destination nodes are market users without the market as an intermediate.
Crypto security researcher Chainalysis notes that Abacus is one of the biggest dark web platforms serving Western customers and received $43.3 million on-chain last year. Galaxy’s Will Owens says memecoins have become a lasting part of crypto, reshaping culture, trading and infrastructure while fueling activity on Pump.fun. Analytics Insight is an award-winning tech news publication that delivers in-depth insights into the major technology trends that impact the markets. The content produced on this website is for educational purposes only and does not constitute investment advice or recommendation. Always conduct your own research or check with certified experts before investing, and be prepared for potential losses. Opinions expressed herein are those of the authors and not necessarily those of Analytics Insight, or any of its affiliates, officers or directors.
Top 7 Dark Web Marketplaces
In fact, new markets are popping up every 3 to 4 weeks, proving that the cycle of closures and launches is alive and well. Unsurprisingly—given how transparent Bitcoin is—many people using Bitcoin to buy illegal drugs on the darknet have already been caught. Back in April 2019, three suspected drug dealers were arrested for reportedly laundering more than $2.3 million on the darknet, thanks in part to blockchain analysis efforts. There are a few ways to try to hide the money trail, including mixing services—where someone’s Bitcoin is swapped for someone else’s Bitcoin—but even these are not infallible. Many have low volumes, making it easier for observers (such as blockchain analytics companies) to see where the money is moving.
Darknet vendor accounts were identified and attributed to real individuals selling illicit goods on Darknet market sites such as AlphaBay, Dream, WallStreet, Nightmare, Empire, White House, DeepSea, Dark Market and others. Abacus Market’s exit underscores the ongoing instability of Western DNM landscape. Sustained law enforcement pressure has stymied marketplaces’ development, curtailed innovation and increasingly driven users toward independent vendor shops and encrypted communication platforms like Telegram. It has also meant most new Western darknet marketplaces are generally low-effort projects, such as 3DogsMarket, Drugula Market and Squid Market, built using scripts and beset by security flaws, with the sole aim of generating quick profits before disappearing.
