We discard single Bitcoin transactions below $0.01 or above $100,000, which are unlikely to show real purchases and minimise false positives. They may be attributed to a residual amount of Bitcoins in an address or transactions between two business partners where no good is actually given in return, respectively. The analysed dataset includes about 31 million transactions among more than 16 million users. By definition, users that interact among themselves form U2U transactions. If the pair of users interact with multiple DWMs these U2U transactions are included in all related DWMs and counted multiple times. Therefore, the simple sum of all U2U transactions of each DWM is more than the sum of all unique U2U transactions.
Why Is It Critical To Monitor Dark Web Marketplaces?
While there may occasionally be multihomers who are active in several markets simultaneously (see Supplementary Information Section S3), multihomers predominantly operate in at most two markets throughout the period of observation. Hence we do not distinguish multisellers by the number of markets in which they operate. The period of dominance by Silk Road is unique, because the ecosystem structure is effectively composed of and dominated by a single market, expressed by a market share equal to one, as shown in Fig. After the shutdown of Silk Road, in the last quarter of 2013, the ecosystem evolves to a structure where several markets coexist. This structural change is reflected in the median net income of sellers and buyers, as shown in Fig.
Torzon Market
The market usually has a real-time exchange rate for currency conversion, even though most item prices are shown in US dollars. That means the buyer will pay the corresponding cryptocurrency according to the exchange rate. Additionally, Litecoin (LTC) and Tether (USTD) are also available in some markets, but in a very small percentage.
Behaviour Of The U2U Network
- Chainalysis data shows darknet marketplace revenue dropped post-Hydra seizure in 2022 but recovered to $2 billion in Bitcoin inflows during 2024 Darknet market BTC inflow drop and shift to Monero.
- Due to the novelty of these substances (and the fact that many are analogs) the true number of overdoses in Europe could be higher, as forensic drug testing may lag behind the pace of the crisis.
- It’s known for its strong security features (like a trusted escrow system, PGP two-factor authentication) and anonymity.
- Like DNMs, online pharmacies receive most of their revenues from larger drug resellers.
- The decentralized, pseudonymous nature of cryptocurrencies has provided a strong foundation for these underground markets to expand, adapt, and resist law enforcement pressure.
Therefore, key actors in the ecosystem of DWMs may play important roles in broader criminal networks. The finding that multisellers and, in specific cases, multibuyers play a central role in connecting the ecosystem, thus contributing to its resilience, may illuminate how to better target future law enforcement operations. In general, by understanding the operation of key players within the DWM ecosystem, our work highlights how appropriate strategies can be designed to counteract the online trade of illicit goods more effectively. We report on certain defined categories — stolen funds, darknet markets, and ransomware, to name a few — on an annual basis. In particular, we have seen the emergence of large-scale on-chain services that provide infrastructure for numerous types of illicit actors to help them launder their ill-gotten crypto.
Tracking Virtual Currency Transactions To Disrupt DNMs
- Another notable trend is the rise of encrypted peer-to-peer (P2P) messaging systems integrated directly within marketplaces, providing secure communication channels between buyers and sellers.
- To reduce the presence of noise in the S2S network, we consider only stable U2U pairs, i.e., pairs that have at least three transactions throughout the whole period of observation13.
- Let’s get this straight — not everything on the dark web is illegal or harmful.
- With an estimated market value of around $15 million, it has grown into a massive hub for cybercriminal activity.
- In the experiments conducted by the authors, they overcame some restrictions (e.g., rate limiting, page loading time) by using different strategies when crawling different websites.
For cybersecurity professionals, journalists, and policymakers, understanding how these systems evolve is crucial to monitoring and mitigating the impact of underground economies. These distributions are explored for each of the 40 DWMs under consideration in Figure S5 and S6, respectively. (a) Schematic representation of an ego network surrounding a dark web marketplace (“DWM”, in red).
The goods on sale range from stolen credit card data and forged documents to illegal drugs, weapons, malware as a service, and hacking tools. Our results also support recent recommendations of paying attention to individual sellers rather than entire DWMs40. Law enforcement agencies, however, have only recently started targeting individual sellers.
The S2S network is mostly populated by U2U-only sellers, followed by market-only, and market-U2U (see Supplementary Information Section S5). In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers. The nodes of the S2S network are active sellers (i.e., sellers that are trading at the time) and two sellers are connected by an edge if at least one transaction was made between them during the considered snapshot period. Although the S2S network is composed only of U2U transactions, all categories of sellers (i.e, market-only, U2U-only, and market-U2U) are present in the S2S network. For instance, market-only sellers are entities classified as sellers only in markets, but that may promote U2U transactions with other sellers, hence being part of the S2S network.
Dark Web Reveals Tech Companies Leak Most User Data
Considering Monero transactions, the researchers estimate that total sales on Abacus were likely closer to at least $300 million. The best month for the darkweb market was this June, when the value of brokered sales peaked at $6.3 million. Abacus launched in September 2021 as ‘Alphabet Market,’ and gradually increased its popularity, especially as the number of other markets on the dark web dwindled, mostly as a result of law enforcement actions.
24 Account Kill-switch
Of course, not all the popular and widely-used dark web sites and things like marketplaces on the dark net are illegal. Some use them due to privacy concerns, such as journalists talking to informants or whistleblowers, while others may simply want to protect their confidential information from observation or tracking. Nevertheless, most people on the internet do not need to communicate or venture into the dark web. Ransomware has continued to see revenues in the hundreds of millions of dollars, but a number of large, multilateral law enforcement disruptions coupled with decreased victim appetite to pay ransoms have made a dent in the ecosystem.
Challenges like cross-border enforcement and privacy concerns complicate regulation. To outpace criminals, continuous innovation in AI-driven analytics and forensic tools is necessary, ensuring real-time monitoring and intervention. Indeed, one of the most recent darknet market busts was the Nemesis online market. The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) specifically cited the market’s role in the fentanyl trade as a reason for the bust. On-chain data from BitInfoCharts shows that the daily number of monero transactions has halved from this time last year.
TRM Labs analysis shows that nearly half of the marketplaces launched in 2024 accepted only Monero — a sharp increase from just over one-third in 2023. This signals a growing preference among darknet operators for obfuscation and anti-surveillance tools. Cryptocurrency-enabled drug sales also grew by over 19% from 2023 to 2024, reaching nearly USD 2.4 billion in volume. During the same period, the number of newly launched darknet marketplaces declined 42% year over year — indicating that while the ecosystem is consolidating, remaining actors may be becoming more operationally advanced.
In particular, we analyse networks of ‘multihomers’, defined as users that are simultaneously trading in multiple markets. We show that these users play a crucial role in the connectivity of the ecosystem because they act as connectors between markets. Analogously, we identify and characterise ‘multisellers’ (i.e., multihomers that are sellers) and ‘multibuyers’ (i.e., multihomers that are buyers). Furthermore, we analyse the seller-to-seller (S2S) network, i.e., the network composed only of transactions among sellers, which can be regarded as a supply chain network of illicit goods and services.
Bitcoin Miner IREN’s AI Push Gains Momentum, Price Target Hiked 60% To $37: Canaccord
We count a total of 11 million transactions around all DWMs, that goes down to 9.9 million when multiple counting is avoided. Similarly, the simple sum of the single trading volumes surrounding all DWMs amounts to $33 billion, while the overall trading volume in all unique U2U pairs is $30 billion. Among the 40 large DWMs under consideration, 17 participate in at least one transaction in either 2020 or 2021, while the remaining 23 closed before 2020.
This increase may be due in part to the closures of top DNMs, the shift to the exclusive acceptance of XMR by other active markets, and delistings of XMR by popular centralized exchanges. The below graph shows an increase in Abacus sales (in BTC) following the closure of ASAP Market in July 2023, and a further increase following some CEXs delisting XMR. Nemesis Market also saw its demise in March, when German authorities seized its infrastructure, along with $102,000 in cryptocurrency. “Markets have sort of varying levels of sensitivity to fentanyl-related sales,” he said.
