The expanding use of cryptocurrencies by terrorist organizations and state-sponsored actors illustrates the dual-edged nature of technological innovations — providing both opportunity and risk. A key theme throughout the year has been the resilience and adaptability of illicit networks. This shift stems from the demonstrated efficacy of blockchain analysis in tracing illicit transactions and aiding investigations. As a result, drug precursor manufacturers have begun to shift to new analogs and substances, while adopting alternative methods to cryptocurrency to obscure their financial footprints. The summit resulted in the Chinese Communist Party (CCP) banning a range of fentanyl precursors and shutting down some suppliers, followed by a further ban of several nitazenes and analogs in July 2024. Incoming crypto volumes to Chinese drug precursor manufacturers have seen a significant decline, from USD 27.6 million in 2023 to USD 17.0 million in 2024.
Publications
But even experienced drug vendors make mistakes that can be spotted and exploited by law enforcement armed with the right tools. Over the past two years, dead drop dealing over Telegram has become a key method of distributing illicit drugs sold online in the ROK. The same efficiency that enabled DNM vendors operating over Tor and Telegram to displace street dealers as the main source of illegal drugs in Russia is now driving dead drop proliferation internationally. Everything is well-organized and easy to find, which benefits newcomers to this environment.With a growing user base and an expanding inventory, Vortex is positioning itself as an “all-in-one” marketplace on the darknet. Some of the best-known names include Abacus Market, Russian Market, and BriansClub, all with thousands of illegal items available.Despite closures by authorities or the typical “exit scams” (when a marketplace disappears with all the money), these sites continue to pop up.
FreshTools has been around since 2019 and has earned its place as one of the most well-known underground markets, even though it doesn’t follow the traditional dark web rules. The truth is that, despite the incident, the site is still active and constantly renewing its inventory.Thanks to its track record, loyal user base, and continuous flow of updated data, BriansClub remains a key player in the current landscape of dark web fraud. Despite some occasional service issues, Russian Market remains a favorite among cybercriminals seeking fresh access and financial data. All of this has made it one of the most reliable markets still active in 2025. It supports PGP encryption, two-factor authentication (2FA), alerts against fake sites (antiphishing), and a verification system for sellers.
- But in 2019, media reported the cartel was managing their business from remote locales in Latin America and some of their key actors have been arrested by law enforcement.
- The Justice Department established the FBI-led JCODE team to lead and coordinate government efforts to detect, disrupt, and dismantle major criminal enterprises reliant on the darknet for trafficking opioids and other illicit narcotics, along with identifying and dismantling their supply chains.
- Though the sanctioning and closure of fraud shop Genesis Market occurred last year, there were no other sanction events for the darknet market ecosystem, or major market takedowns.
- The only way such markets can be defeated in the longer term is to replace them through legal regulation.”
Market Value And Popularity
Classic darknet markets sell diverse illegal goods; data stores focus on leaked or stolen data like credentials, databases, and ID records. Despite growing crackdowns from law enforcement agencies, the dark web remains a hotbed of criminal activity, offering everything from drugs to stolen data. These markets host hundreds, or in some cases thousands, of people who sell drugs, commonly referred to as “vendors”.
Lyphe Launches V Range: Affordable, Reliable, And Future-Ready Medical Cannabis
The entity “DNM Aggregator” that appears within each category refers to a service we’ve identified as being in control of multiple, disparate darknet markets. Western drug flows in particular come from US-domiciled exchanges and trace flows from those to darknet markets. By contrast, it appears today’s darknet markets largely serve specific niches and have individually organized themselves into unique criminal functions, which we determined when examining the origin points for darknet market inflows last year. Throughout the history of the darknet market ecosystem, at different turns one marketplace has typically played the dominant role. Essentially, these payment processors provide a white label service for darknet markets and fraud shops, and a seamless checkout experience for those services’ customers. But experts warn that any increased enforcement on Telegram will simply cause dealers to go elsewhere, disrupting a market that has largely established itself as a safer source of drugs.
Feds Dismantled The Dark-Web Drug Trade—but It’s Already Rebuilding
Attorney’s Office for the Central District of California secured a 17-year sentence for Adan Ruiz, of Orange County, and a 15-year sentence for Omar Navia, of Los Angeles, for supplying fentanyl-laced pills to a drug trafficking ring that sold these drugs to more than 1,000 customers nationwide via the darknet. These leads allow U.S. and international law enforcement agencies to identify darknet drug vendors and buyers, resulting in a series of coordinated, but separate, law enforcement investigations, reflected in the statistics announced today. Abacus Market offers an extensive array of illegal goods and services across various categories, making it one of the most versatile marketplaces on the dark web.
Drugs And The Darknet: Perspectives For Enforcement, Research And Policy
Though many customers are concentrated in Australia, Abacus has vendors and customers around the world, including the United States. Mega clearly dominated the realm of wholesale drug purchases, capturing 51.9% of that segment. Though Mega Darknet Market typically serves a Russian customer base, the drug revenue shown in the chart above likely came from customers based in Europe. Looking closer at ASAP Market inflows, it won some share of revenue across all drug purchase types, receiving 37.1% of social supply, 35.7% of large retail, 16.5% of small retail, and 13.5% of wholesale purchases.
- Like RuTor, BlackSprut also offers cash-out services, including Bitcoin-to-Ruble and C2C transactions.
- Major drug markets in the Dark Web are now worth around $315 million annually according to the United Nations Office on Drugs and Crime (UNODC).
- Correlation matrix of Hydra marketplace…
- The actors also use magnetic cases to hide packages not easily detectable without having exact coordinates.
Dark Web’s Longest-standing Drug Market Seized In Multinational Effort
A rogue staffer who had blackmailed the site’s users also leaked the site’s backend credentials, which may have aided in law enforcement’s investigation. After the late 2013 takedown of the Silk Road, the first real dark-web drug market, more than a dozen replacements rose up to fill the demand for anonymous online narcotics sales. “You’re seeing the evolution of a coordinated law enforcement effort,” the director of Europol’s European Cybercrime Centre said. Taken together, those operations represent the most far-reaching collection of law enforcement actions against the dark web’s economy in at least two years.
Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products. Darknet market role specialization provides one possible explanation as to why the ecosystem has yet to see a dominant player. We can see this pattern on the chart below, which shows the level of market share controlled by the dominant market of each epoch. “If one supply avenue is closed by enforcement, another is soon found to replace it,” says Steve Rolles, senior policy analyst at the Transform Drug Policy Foundation, a UK-based NGO. In a Vice documentary on drug sales on social media, it took the host just five minutes to connect with a dealer in London. For as many people who believe this is something of a utopian development, you can be sure many more view it as dystopian—especially if the dealers are in fact scammers or selling dodgy goods.
It has built a reputation for being a reliable source of stolen credit card data and PII. Its focus on financial fraud and high-value transactions has attracted a dedicated user base, contributing to its growing reputation and market value. STYX Market focuses specifically on financial fraud, making it a go-to destination for cybercriminals engaged in this activity.
Another Record Year For Ransomware Beckons As Crypto Profits Hit $460m
If you want to test your organization’s resilience or hunt down hidden vulnerabilities before criminals do, DeepStrike can help. Each takedown from Silk Road to Archetyp has shown that anonymity on Tor is fragile against determined investigators. In practice, no market in the past decade has survived indefinitely. See our guides on Dark Web Monitoring Tools for how companies watch for leaked info.
Diving deeper, several RuTor posts and other available sources for our analysts suggest the Khimprom Syndicate, an international drug mafia notorious for slicing off the fingers of “disobedient” members, covertly operate the forum. The actors behind the possible attack on Blacksput threatened the administrators with the leakage of their identities, as well as to reveal sensitive operations between buyers and sellers. Killnet has attracted a lot of attention because of past DDOS attacks against NATO, U.S. law enforcement, and multiple EU government agencies during the peak of war in Ukraine. Typically, drug traffickers have become very careful in their tactics, and try to choose locations where it would be complicated to monitor couriers without prior knowledge (parks, forests, abandoned buildings, etc.). Typically, the drug shops providing such mobile apps don’t reveal a lot of information, and their customers have substantial prior knowledge about them and their inventory from references or their past experience.
