For topic modelling, the number of topics must be specified in advance, where this number was chosen based on the Cv coherence value (Röder et al., 2015). After running the model with 2 to 100 topics assumed, the model showed the highest Cv coherence score (0.57) in the case of 4 topics. A list of the coherence scores for the different number of topics set for each topic model is presented in Fig. Although the tokens of the corpus were not evenly distributed among the topics obtained in the model with the highest Cv value, the subjects of the topics were identifiable. Thus, taking into account both this qualitative assessment and the coherence score, we analysed the model with 4 topics.
In Wake Of DOJ Indictment Of Iranian Operator Of Darknet Market Nemesis, TRM Shares New Data On DNMs
Many sites specialize in selling illegal goods that are not readily available on the public internet. Yet perhaps the greatest danger affects the individuals who deliver the goods, often vulnerable young people who face violent reprisals from their bosses. Due to their large numbers and low status in the illicit drug economy, these couriers also make up a disproportionate number of arrests and imprisonments relative to senior operatives.
Pharmacies In Mexico Are Shut As Authorities Crack Down On Fentanyl-tainted Pills
However, the widespread use of the Russian template internationally allows authorities to anticipate many of the features of dead drop activity and leverage the expertise of blockchain intelligence companies with experience tracking Russian-language DNMs. Increased social awareness of the dead drop phenomenon and close cooperation between law enforcement and their private sector partners can help counter this rising threat. TRM research found that vendors using dead drops in Hungary, the Czech Republic, and Greece prefer Telegram, Session, and other end-to-end encrypted messenger services to DNMs. One Greece-based vendor tracked by TRM uses Telegram bots to arrange dead drops across Thessaloniki, relying on online geocoding services to provide customers with unique reference points for dead drops and posting the successful pickup in their channel.
- As a criminal market, it is deeply intertwined with a wide range of criminal activities, including cyber-dependent and financial crimes.
- Markets like Bohemia, Incognito, and GoFish vanished under suspicious circumstances.
- In a fourth example, a San Fernando Valley man, Brian McDonald, 23, was sentenced to more than 20 years in federal prison in the Central District of California for using darknet marketplaces to sell hundreds of thousands of dollars’ worth of fentanyl-laced pills and cocaine to buyers nationwide.
- Others are looking for stolen data, hacking services, or even banned books and political content.
- According to TRM’s 2025 Crypto Crime Report, Russian-language DNMs accounted for over 97% of global drug trafficking volume via crypto in 2024.
Drugs And The Darknet
Evidence suggests that warning darknet market users about a potential scam can reduce vendor and customer activity in the given market (Howell et al., 2022). While users may migrate to another market in response, in some cases (for example, a market selling mixed substances), this displacement may be beneficial from a public health perspective. Detecting fentanyl traffickers, and uncovering and dismantling hidden fentanyl networks should be a priority in the strategic planning of darknet market interventions (Maras et al., 2023). While the above-mentioned examples of interventions effectively reduced the volume of the darknet drug trade, the policy recommendations presented above were designed to be implemented among potential customers. Since some users purchase on the darknet because they do not want to risk a personal meeting with dealers, darknet markets extend the range of potential users (Pergolizzi et al., 2017).
Detroit Man Sentenced To Over Ten Years For Drug Trafficking And Crypto-Related Money Laundering
In 2019, there were approximately 8,400 active sites on the dark web, selling thousands of products and services daily. Given the explosive growth of these markets, organizations must prioritize proactive threat monitoring. Axis Intelligence provides dark web surveillance solutions that help businesses identify leaked credentials, fraud attempts, and malware risks before they escalate. Since 2020, 2easy has sold massive stealer logs with sensitive data like passwords, bank cards, and initial access credentials. It supports operations in multiple languages and operates on both clearnet and Tor. This article reveals the top 10 dark web markets dominating in 2025, their unique characteristics, and the critical implications for enterprise cybersecurity.
The multi-agency investigation, primarily conducted by the RCMP’s serious and organized crime unit in Milton, Ont., started when German authorities took down a dark web marketplace and contacted the RCMP to make them aware of several Canadian-based users. As the routines and restrictions of the working day receded for millions on lockdown, buying drugs online has never been so popular, research shows. What’s more, as Covid-19 restrictions lift, these markets – which deliver drugs to millions of people worldwide every day – are emerging from a tough few years with their immune systems boosted, thanks to a combination of technical innovation, collaboration between competitors and sheer good fortune. Most users of the cryptomarkets are not novices and already have established experience in face-to-face markets. Individuals may be attracted by predictable supplies, choices and perceptions of reduced risk.
Access Our Coverage Of TRON, Solana And 23 Other Blockchains
Some events such as COVID-19 pandemic-related lockdowns seem to have drawn large numbers of new PWUD into the darknet 41. Many new entrants may just as quickly leave when they find the cryptomarkets do not suit their needs. Successful users of cryptomarkets often need to learn and socialise themselves into the system to make it work to good effect. The technical challenges and cultural barriers to entry may make them self-limiting to an extent 42. Cryptomarkets may provide new data sources which can inform our understanding of drug markets.
Russian Market
Fill out the form to speak with our team about investigative professional services. DNMs using dead drops already make up 95% of total global DNM revenue, according to TRM research. For example, in Russia, freelance thugs known as “sportsmen” track down and brutalize delivery workers, or “kladmen,” who are accused of stealing. In one such channel, there are over 800 videos showing people being beaten, raped, dismembered, set on fire, and even crucified as retribution for their actions. In furtherance of Operation RapTOR and in their first action as a JCODE member agency, the Office of Foreign Assets Control (OFAC) additionally sanctioned Behrouz Parsarad, an Iranian national, for his role as the founder and operator of Nemesis Market following seizure of the market. Cybersecurity and technology analyst Ritesh Kotak, who also started in policing, says the network taken down by the RCMP-led investigation is likely just the tip of the iceberg when it comes to illicit activity on the dark web.
Crimes Of The Times: Inside Man: A Jailer Turns Informant
The results of the internal consistency tests presented above suggest that reducing the number of situations could be a solution that would result in little data loss, especially if comparing the illegal situations is not among the aims of the given research. The power and integrity of OFAC sanctions derive not only from OFAC’s ability to designate and add persons to the SDN List, but also from its willingness to remove persons from the SDN List consistent with the law. The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior. For information concerning the process for seeking removal from an OFAC list, including the SDN List, please refer to OFAC’s Frequently Asked Question 897 here.
Access This Article
But even experienced drug vendors make mistakes that can be spotted and exploited by law enforcement armed with the right tools. For example, the chart below shows transactions involving an online drugs vendor traced to the ROK, who receives customer funds from mainstream cryptocurrency exchanges. As in Russia, dead drops are carried out by young people who are often made to provide their real ID documents as security to the vendors. Vendors in the ROK also require prospective customers to photograph themselves holding drug paraphernalia. Those who steal drugs or break other rules are named and shamed in public Telegram channels, which could open them up to the kinds of violent reprisals that occur in Russia.
Silk Road, AlphaBay, WallStreet and Monopoly Market are all familiar names in the digital graveyard of the dark web. Before these dark web marketplaces were shutdown, they sold a range of illegal products, from drugs to firearms. Archetyp launched in May 2020 and quickly grew to become one of the most popular dark web markets with an estimated total transaction volume of €250 million (A$446 million). It had more than 600,000 users worldwide and 17,000 listings consisting mainly of illicit drugs including MDMA, cocaine and methamphetamine. Still, the disruption of Hydra dealt a “huge blow“ to the ecosystem, according to multiple sources on the Dark Web. Many users extended escrow to allow for late deliveries, and one crew went so far as to refund users – to the last satoshi the smallest unit of a bitcoin – when packs did not arrive.
Unlike Bitcoin, which records every payment on a public ledger, Monero conceals all transaction details by default which makes them nearly impossible to trace. The Royal Canadian Mounted Police (RCMP) says it has successfully dismantled one of the largest known Canadian dark web drug trafficking operations. Others, particularly those based in Russia, focus solely on info stealer hacking tools and brokering stolen data. The Russia-only market Hydra is also expanding, creating a new global drug bazaar called Eternos, which is launching in September. Hydra admins announced that the new market would feature IronRat, an artificial intelligence software agent for automated dispute resolution, making the sites even more user-friendly.
After all, darknet markets are remarkably self-regulating systems, based on anarchist principles. In terms of size, cryptomarkets are currently smaller than other modes of digital drug distribution such as through social media and messaging apps and should be seen as a specialist subset of that genre. Despite growing crackdowns from law enforcement agencies, the dark web remains a hotbed of criminal activity, offering everything from drugs to stolen data. Dark web markets have exploded in scale and reach in 2025, becoming the most dangerous hubs for trading drugs, stolen data, and hacking tools. These anonymous marketplaces—operating mainly on the Tor network—are now a primary threat vector for businesses and cybersecurity professionals.
Parsarad’s indictment is not just the story of one marketplace’s demise—it is a signal that even in hostile jurisdictions and decentralized systems, there remains a path to accountability. It also underscores the critical role of blockchain intelligence in mapping threat networks, tracing illicit funds across borders, and giving investigators the tools they need to protect communities from the growing threat of synthetic opioids. THE HAGUE — Authorities in the U.S. and Europe arrested nearly 300 people, confiscated more than $53 million and seized a dark-web marketplace as part of an international crackdown on drug trafficking that officials say was the largest operation of its kind. Opponents of strict dark web policing sometimes argue that such operations drive criminal activity to even more hidden or encrypted platforms, making detection harder. They may also raise privacy and surveillance concerns, warning that aggressive cyber policies risk collateral impacts on online freedom and legitimate users of anonymity technologies. Archetyp Market facilitated a reported minimum of 250 million euros (about $290 million) in drug transactions over five years, with over 600,000 users, 3,200 vendors, and 17,000 listings.
This year’s law enforcement operation was accompanied by a public awareness campaign called Operation ProtecTor aimed to promote public safety and spread awareness of resources for those struggling with substance abuse and who go through extreme lengths to obtain opioids. JCODE has worked with every FBI field office in the country to facilitate outreach to households that have purchased individual amounts of opioids from the darknet. The interagency efforts are aimed to both identify those who use anonymizing technologies to purchase illicit narcotics and direct them to available resources. District Judge David O. Carter called this case “the most sophisticated fentanyl distribution ring that this court has seen.”
