By far the largest darknet market by volume was Hydra, launched in late 2015 in Russia. Hundreds of WSM buyers and sellers were later identified and prosecuted. On the tech side it used Tor, Bitcoin escrow and forums for buyers/sellers. Like others, WSM sold tons of drugs, fake goods and hacking software. Unlike overt seizures, Dream’s shutdown was an exit by administrators, a pattern sometimes seen when market owners bail out.
Hundreds of kilograms of drugs and millions in Bitcoin were recovered. Dark web marketplaces have come and gone in a long running cat and mouse game. When you buy or sell illegal goods online, you are not hidden from law enforcement, Europol’s director emphasized after a Dream Market bust. Vendors now vet markets for trustworthiness, often requiring invites or deposits. Even Hydra’s 2022 fall led to smaller Russian language markets trying to fill the gap, some suspected ones being Abacus or Drughub.
Exit Scam Unfolding
Investigators obtained records of Sterlingov’s true-name accounts at several cryptocurrency exchanges. Based on Bitcoin Fog’s transaction activity over time, Sterlingov made millions in commissions from Bitcoin Fog transactions. The defendant advertised the site as “for people who have real problems for the law and we provide them the best possible service, and highest possible anonymity.” Those who had “real problems for the law” would mix “your bitcoins in our own pool with other users’ Bitcoins, and get paid back to other accounts from our mixed pool.” “In the deepest corners of the internet, he provided a home for criminals of all stripes, from drug traffickers to identity thieves, to store hundreds of millions of dollars in illicit proceeds.
Ransomware actors and fraudsters are leveraging technological advancements, including cross-chain bridges and artificial intelligence, to bypass detection and scale their operations. The expanding use of cryptocurrencies by terrorist organizations and state-sponsored actors illustrates the dual-edged nature of technological innovations — providing both opportunity and risk. While efforts to curb illegal activities have shown promising results, threat actors continue to innovate — exploiting vulnerabilities within decentralized finance, blockchain infrastructure, and emerging technologies. This exodus is expected to continue as Telegram enforces stricter measures to curtail criminal activities on its network and provide new opportunities for interdiction.
Darknet marketplaces remain central to illicit trade in 2025, with evolving business models, payment systems, and law enforcement responses. More than six years after the demise of Silk Road, the world’s first major drug cryptomarket, the dark web is still home to a thriving trade in illicit drugs. Online drugs marketplace Abacus Market has either been seized by US authorities or is performing an exit scam on its users following questionable bitcoin (BTC) transfers, according to Darkweb Informer.
Arrest Of Telegram Founder Sparks Platform Migrations For Drug Vendors
They benefit from limited domestic enforcement risk and a domestic supply of synthetic drugs and precursors, mostly sourced from China. Their longevity is generally short-lived, with most platforms shuttering or collapsing within two to three years due to law enforcement pressure, market volatility, or internal instability. “Drug dealers who would often only accept cash are now accepting cryptocurrencies, actually creating some advantages for law enforcement,” he said. “We’ve seen an uptick in the number of new darknet markets emerging. The NCIS has issued a warning to navy personnel regarding the risks involved with making illegal purchases on darknet markets. Additionally, while some cryptocurrency transactions can be anonymous, many are traceable.
Top 10 Dark Web Markets
Bitcoin (BTC) is the most widely used cryptocurrency, both on the darknet and elsewhere, but certain DNMs favor monero (XMR) instead. That extortion threat, combined with increased tracing and investigative pressure, led many users to flee the platform, dramatically reducing deposits and facilitating law enforcement’s final takedown. One particularly revealing moment came in February 2024, when Incognito users reported that BTC withdrawals were disabled—likely part of a deliberate “exit scam.” Lin, or others acting on his behalf, threatened to leak vendor identities to law enforcement unless paid.
- In 2024, its share surged to over 70%, following ASAP Market’s voluntary closure in July, 2023 and the law enforcement seizure of Incognito Market in March, 2024.
- It is rumored that Mandelker will help provide Chainalysis with insights on how to properly investigate crypto-related crimes, along with creating partnerships with federal officials.
- Nevertheless, finding the perfect balance between financial secrecy and regulatory needs is a future challenge for digital finance.
- Analogously, we identify and characterise ‘multisellers’ (i.e., multihomers that are sellers) and ‘multibuyers’ (i.e., multihomers that are buyers).
- During the arrest, the FBI seized Ulbricht’s laptop which he was using to connect to the servers and manage the marketplace.
Agentic AI–Driven Threat Intelligence Tailored For Every Function
According to TRM Labs, operating a platform like Nemesis isn’t a one-man job—it requires a distributed network of developers, moderators, escrow agents, and money laundering facilitators. According to TRM’s 2025 Crypto Crime Report, Russian-language DNMs accounted for over 97% of global drug trafficking volume via crypto in 2024. The Russian-language markets—led by platforms such as Blacksprut and Kraken—are far more dominant, technologically advanced, and resilient.
These campaigns helped them gain users and redirect traffic after attacks such as DDoS.With an easy-to-use interface, a vast amount of data, and constant updates, BidenCash has become a favorite among cybercriminals involved in identity theft and financial fraud. You won’t find drugs here, but you will find tons of credentials, RDP access, CVVs, and records stolen using malware.The platform works with data collected by well-known malware such as Lumma, RedLine, Raccoon, Vidar, and Aurora. Although some of these markets prohibit certain extreme content such as violence or exploitation, most operate with very few rules beyond ensuring the security and anonymity of their users.
Abacus’s Rise To The Top Of The Western DNM Ecosystem
Cryptocurrencies have revolutionized the global finance environment with financial inclusion, efficiency, and decentralization capabilities. Sterlingov was arrested April 27, 2021, at Los Angeles International Airport and has remained detained since that time. It is also a crime to operate a money transmitting businesses without obtaining an appropriate money transmitting license in the state in which the service operates, or with FinCEN. It is also a crime to conduct or attempt to conduct a financial transaction involving property represented to be the proceeds of specified unlawful activity, with the intent to conceal the nature, location, source, ownership, or control of such property. As the jury found, Sterlingov’s mixing and tumbling activity was an illegal money transmitting and money laundering service under federal law.
‘Capital Of Crypto’
The use of cryptocurrency in vendor shop drug sales saw a significant surge over the past year. Despite the many challenges faced by darknet marketplaces over the course of 2024, these platforms have nevertheless seen a slight increase of income compared to 2023, generating more than USD 1.7 billion. 2024 saw 42% fewer new darknet marketplaces (DNMs) launched year over year, with the proportion of Monero-only DNMs launched increasing from little more than a third in 2023 to nearly half in 2024. Cryptocurrency-enabled online sales of illicit drugs saw a year-on-year growth of over 19% between 2023 and 2024, nearing USD 2.4 billion. Blockchain forensics and artificial intelligence have advanced crypto crime detection by trawling humongous databases in order to flag suspicious transactions.
In fact, when we compute the total net income for each seller, a considerable fraction (16%) has a negative net income because they spend in markets where they are not classified as sellers, or in the U2U network. Furthermore, we analyse the seller-to-seller (S2S) network, i.e., the network composed only of transactions among sellers, which can be regarded as a supply chain network of illicit goods and services. In particular, we analyse networks of ‘multihomers’, defined as users that are simultaneously trading in multiple markets. Here, we set out to find the main actors in the DWM ecosystem and assess their systemic impact on a dataset of 40 million Bitcoin transactions involving the 31 major markets in the period 2011–2021. Conversely, transaction networks obtained from the blockchain contain the entire transaction data of the DWMs and U2U transactions, allowing a thorough investigation of the ecosystem as a whole. Many DWMs were closed, either by law enforcement operations or by exit scams, leaving their users with significant losses1.
The decentralized nature of crypto complicates enforcement, prompting governments to develop advanced tracking strategies. Sanctioned nations use cryptocurrencies to evade economic restrictions, conducting cross-border transactions and mining digital assets to generate revenue. Despite raising millions, terrorist groups face challenges as governments enhance blockchain surveillance and impose stricter compliance measures, limiting large-scale crypto financing. In response, governments are enhancing blockchain surveillance and enforcing stricter regulations to combat crypto-enabled cybercrime. Despite advancements in blockchain analytics and regulatory measures, privacy-focused technologies continue to pose challenges for oversight and Anti-Money Laundering (AML) enforcement. Cryptocurrencies have become integral to the dark web economy, enabling illicit transactions and fueling cybercrime activities.
Is It Illegal To Access The Dark Web?
The classification method is robust with respect to the values assigned to the classification parameters, and returns reasonable estimates compared against a benchmark of nine markets (see Supplementary Information Section S1). Our method identifies sellers, whereas buyers are entities which are not classified as sellers. To characterize the structure and dynamics of the ecosystem of DWMs, we start by classifying all traders either as buyers or sellers. Analogously, we identify and characterise ‘multisellers’ (i.e., multihomers that are sellers) and ‘multibuyers’ (i.e., multihomers that are buyers).
In addition to his term of imprisonment, Sterlingov was sentenced to pay a forfeiture money judgment in the amount of $395,563,025.39, and forfeiture of seized cryptocurrencies and monetary assets valued at approximately $1.76 million. A cryptocurrency mixer is a service that mixes potentially illegally derived cryptocurrency with others to obscure the trail back to the cryptocurrency’s original source. Paul DiLello, another victim of a cryptocurrency investment scam who lost more than $150,000, told ICIJ his experience has changed him for the worse.
