Finally, we note that our analysis is hardly exhaustive in terms of considered network measures. Although we did experiment with a wider selection of measures, none of which outperformed betweenness centrality, it is possible that another (specialized) network measure would provide better performance. Despite this, we note that the network measures reported on in this paper cover a wide range of network interpretations relevant to the cryptomarket forum setting. Therefore, we believe that the results reported in this paper are a good account of what can be achieved with network measures. The identification of key players in cryptomarkets such as successful vendors and administrators, is a vital step in law enforcement interventions.
Detecting Vendors In The User Base
Darknet markets — also known as cryptomarkets — provide a largely anonymous platform for trading in a range of illicit goods and services. Accessing the dark web can only be done using specific browsers, such as TOR Browser. We classify all entities either as sellers or buyers as a function of time. The result is a time series of lists of sellers and buyers for each period and for each market and the U2U network. The classification is performed in five steps (see Fig. 1), as detailed next.
Cryptomarket Operations
Table 1 shows the average monthly overlap of each network measure with each individual activity indicator and the union of detected vendors by all activity indicators. We see that PageRank and betweenness centrality detect the greatest share of vendors also found by the activity indicators, detecting on average approximately 80% of all current vendors and 75% of all future vendors found. However, respectively nearly 99% and 97% of all vendors detected by PageRank are also found by the activity indicators. On the contrary, the activity indicators find respectively only 94% and 90% of the vendors included by betweenness centrality. Thus, betweenness centrality is able to detect the largest share of successful vendors not included by any of the activity indicators. Therefore, reducing the set of users for law enforcement to investigate using betweenness centrality may provide a fresh perspective.
- In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers.
- From this the relative and absolute difference scores between vendors and non-vendors was computed for each of the four network measures and three activity indicators (see “Methods” section for more details on their computation).
- 11% of all opioid dependency products are sold from within Germany, in contrast to the pattern seen in other two groupings where German sales are relatively small components of the market.
- Note that we found this variant of PageRank to indeed have the best performance.
- Dark web marketplaces have been a significant outlet for illicit trade, serving millions of users worldwide for over a decade.
- The analysed dataset includes about 31 million transactions among more than 16 million users.
Dark Web Sites Darknet Market Links In 2025
Cryptomarkets may provide new data sources which can inform our understanding of drug markets. We do not engage with darknet markets; our mission is exclusively dedicated to providing information for research and educational purposes. Vendors with high ratings and verified histories dominate these platforms, ensuring product quality.
Relative/absolute Difference Score
However, for incoming and outgoing harmonic closeness centrality the paths may follow edges only in one direction, either following the direction of the edges (outgoing) or going against the direction of the edges (incoming). The weighted variants of these measures use the inverse of the edge weights during shortest distance computation, such that stronger connections equate to shorter distances. One of the central76 discussion forums was Reddit’s /r/DarkNetMarkets/,777879 which has been the subject of legal investigation, as well as the Tor-based discussion forum, The Hub. Cryptomarkets emerged in 2011 with the launch of Silk Road on the Tor network.
Collective Dynamics Of Dark Web Marketplaces
The most affected are multisellers, with a drop of 78% in the median income, followed by market-U2U and market-only sellers, with a drop of 59% and 47%, respectively. Although these three types of sellers are significantly affected, they recover and surpass the median income value they had before Bayonet (see Fig. 4c; Supplementary Information Section S4). (a) The number of sellers for each category and multisellers per quarter. The empty point on the multiseller median income line demarcates the quarter with only two multisellers. After that quarter, their number remains small, which is represented by the dashed line. In all panels, the dashed vertical line marks the time of operation Bayonet.
Classification Of Sellers And Buyers
We found that the measures of betweenness centrality and topic engagement included the greatest proportion of successful vendors when applying such a reduction (up to two thirds of the successful vendors when reducing to 20% of the users). Additionally, results showed that the vast majority (up to 98%) of post activity of the most successful vendors was produced by those included and that they were the relatively more successful vendors. As such, most successful vendors that are not retained by these measures are simply not very active on the forum.
- User-to-user (U2U) pairs are represented by arrows (direction indicates the flow of Bitcoin) and by their respective users.
- By definition, users that interact among themselves form U2U transactions.
- The following period, up to the November 2014 “Onymous” disruption5, shows stable but slightly decreasing difference scores for most measures.
- Tor darknet forums become meeting places for dealing to occur on social media rather than in the cryptomarkets 51.
- Consequently, we also see large fluctuations in vendor recall for the network measures between these months.
- The seller-buyer relationship is remote and impersonal, and the market is public and open, with features designed to promote professionalism.
After all, the resources required to investigate even 20% of users would likely exceed those available to law enforcement. Additionally, we find that topic engagement is the best measure for predicting vendors, regardless of their level of success. Darknet markets, or cryptomarkets, are online marketplaces that operate on anonymity networks like Tor or I2P and use cryptocurrencies for transactions — typically involving illegal or gray-market goods and services. The best darknet markets in 2025 prioritize user-friendly interfaces, making drug shopping as seamless as conventional e-commerce. Platforms like Nexus and Abacus feature intuitive layouts with search filters, product categories, and real-time chat support. Decentralized networks like Freenet and I2P are gaining traction, offering alternative infrastructures resistant to takedowns.
The starting point for this paper is the identification of U2U networks around DWMs. We analyse 40 DWMs for the time period spanning from June 18, 2011 to January 31, 2021. Our dataset covers all major DWMs that have ever existed, as identified by the European Monitoring Centre, Europol, the World Health Organization, and independent researchers24,25,26. Our analysis focuses on Bitcoin – the most popular cryptocurrency both on DWMs27,28 and in the regulated economy29,30. We focus on two kinds of transactions, occurring (i) between the user and a DWM and (ii) between two users of the same DWM.
Top Dark Web Markets List: History, Evolution, And Current Landscape (
He recommends verifying market employees carefully, and to weed out law enforcement infiltration through barium meal tests. All data needed to evaluate the conclusions in the paper are present in the paper. Additional data related to this paper may be requested from the corresponding author. Additional data related to this paper may be requested from the authors. Research for this project was provided by the Institute for Society, Culture, and the Environment at Virginia Tech.
Related Topics
First, we computed for each month the mean normalized value for each measure for the groups of all vendors and all non-vendors, using min-max normalization. From this the relative and absolute difference scores between vendors and non-vendors was computed for each of the four network measures and three activity indicators (see “Methods” section for more details on their computation). In these figures, lines give a third polynomial approximation of the trend based on the monthly centralities and activity indicators.
The evolving activity-driven model is an appropriate methodology for large temporal networks32 and it is implemented in the Python 3 pip library TemporalBackbone45, where default parameter values have been used. As input parameter, we considered the full network, transactions from/to DWMs and U2U transactions between users (see Section S4). Plotted lines indicate the median value while bands represent the 95% confidence interval. Negative and positive numbers indicate the days prior and after the closure, respectively. Only the 33 DWMs that closed during our time period are considered in the analysis. (a) Schematic representation of an ego network surrounding a dark web marketplace (“DWM”, in red).
Additionally, we found that more successful vendors have on average higher centralities and activity indicators than less successful vendors. This holds for both current and (to a slightly lesser extent for) future success. However, it is important to remember that these findings are about the average case; perfect delineations cannot be made. Even so, they indicate that the rankings induced by the measures have predictive potential for vendor success and may be useful to law enforcement activities.
