Darknet markets are online platforms for the anonymous buying and selling of illegal goods and services. Operating in the hidden parts of the internet, these markets largely rely on cryptocurrencies. In this article, you’ll discover the key players in 2025, how they operate, their histories, and the risks involved.

ChatGPT Down? Anonymous Sudan Claims Responsibility for DDoS Attacks

• Onion sites, or dark web websites, are sites on the dark web that can typically only be accessed using special software like the Tor browser.
• Constant uncertainty, fear of scams, and enforcement pressure create sustained stress.
• With stricter Know Your Customer (KYC) and Anti-Money Laundering (AML) measures, illicit actors are facing greater challenges when attempting to cash out.
• One of the most well-known technologies enabling darknets is the Tor network, which was developed by the U.S.
• Darknet markets are characterized by several key features that distinguish them from conventional online marketplaces.
• This could stop the flow of stolen data through the supply chain and disrupt the underground economy that profits from your personal data.
• The report also revealed that despite a likely record year for overall crypto crime revenue, inflows to darknet markets and fraud shops declined in 2024.
• It’s an ever-evolving ecosystem—constantly shifting, reinventing itself, and adapting.

The third convicted cybercriminal — the biggest Dutch user and the number 10 user worldwide — received a four-year sentence. The information-stealing malware package that Genesis Market used to exploit victims included a hidden Chromium-based browser plugin, made to look like a Google Drive plugin, which captured credentials stored in victims’ browsers. Fentanyl and fentanyl-laced drugs also arrive in the United States through Latin America based cartels. U.S. customers predominantly purchase drugs from these groups that are known to have used crypto to source fentanyl precursor chemicals from labs based in China. The cartels then use those chemicals to manufacture fentanyl that is later sold in the U.S. U.S.-based drug vendors on Abacus Market advertising a synthetic opioid called China White, which its customers can purchase using Bitcoin or Monero.

Evolution of Darknet Markets

Patterns recommended to avoid include hiring hitmen like Dread Pirate Roberts, and sharing handles for software questions on sites like Stack Exchange. One of the central[75] discussion forums was Reddit’s /r/DarkNetMarkets/,[76][77][78] which has been the subject of legal investigation, as well as the Tor-based discussion forum, The Hub. Agencies like the Federal Bureau of Investigation and Europol monitor marketplaces over long periods rather than acting immediately. This allows them to map infrastructure, track financial flows, and identify administrators and vendors. Law enforcement pressure is one of the main reasons dark web marketplaces remain unstable and short-lived. Dark web marketplaces expose users to multiple layers of risk that extend beyond financial loss and affect legal standing, personal safety, and long-term consequences.

Darknet markets differentiate themselves by unique service offering

These tools enable a rapidly growing cohort of organizations around the world to safely embrace cryptocurrency-related transactions, products, and partnerships. The report also revealed that despite a likely record year for overall crypto crime revenue, inflows to darknet markets and fraud shops declined in 2024. Total darknet market revenue fell from $2.3 billion in 2023 to $2 billion in 2024. Tor2door’s been a standout since 2020—over 20,000 listings and a custom-built site that’s not some cookie-cutter junk. They take BTC and Monero, with multi-signature escrow and global shipping—vendors swear by it, and I’ve snagged rare stuff (think DMT or niche scripts) without a hitch. Drugs lead the pack—weed, pills, some synthetics—but digital goods like hacked logins are gaining, tying into Telegram’s side gig boom.

Alphabay

Launched in February 2018; the Empire market is heavily inspired by Alphabay, with LTC, BTC, XMR, PGP 2FA, and MultiSig features. Abacus Market, the largest Bitcoin-enabled Western darknet marketplace, has likely executed an exit scam after going offline in early July 2025, according to blockchain intelligence firm TRM Labs. The cybersecurity challenges seen in 2024 highlight the dynamic and ever-evolving nature of cyber threats.

• This change persists until the end of the observed period of the data set (also see Supplementary Information S4).
• These schemes leveraged mainstream ad platforms to distribute malware to unsuspecting users.
• The site’s unique—loads fast, looks sharp, and vendors get treated right, keeping turnover low.
• Cryptocurrency accounts were the only category that we saw to have experienced an increase.
• It offers access to hacked bank accounts, credit card data, and cryptocurrency laundering tools.
• Despite a recent push for security awareness and forcing people to implement 2FA, a huge number of people still become victims of cybercriminals who manage to steal their online payment accounts.

The Silk Road marketplace

Therefore, although larger in number, U2U-only sellers typically make the smallest income. This suggests that sellers with more diverse sources of income, such as multisellers and market-U2U sellers, are able to produce a higher income. Additionally, we observe that, except for U2U-only sellers, the median income of the other types of sellers drops after the major shock caused by operation Bayonet (see Supplementary Information Section S4). The most affected are multisellers, with a drop of 78% in the median income, followed by market-U2U and market-only sellers, with a drop of 59% and 47%, respectively. Although these three types of sellers are significantly affected, they recover and surpass the median income value they had before Bayonet (see Fig. 4c; Supplementary Information Section S4). The number of sellers in each category and multisellers as a function of time is shown in Fig.

Abacus Upgrades

A significant positive signal is that Google Safe Browsing reports the domain as clean, indicating no detected malware or phishing attempts. This is a strong indicator that Google does not currently see the website as malicious. It uses ring signatures and stealth addresses to obscure transaction details. Tor Browser provides anonymity by routing your traffic through a global volunteer network. We’re back with another video in our Webz Insider video series on everything web data. Learn how to automate financial risk reports using AI and news data with this guide for product managers, featuring tools from Webz.io and OpenAI.

News

You can use a dark web scan tool to tell if your data has landed on the dark web. The tool scans the dark web marketplaces and forums for signs of compromised personal credentials. The market has built trust among users as it brings vendor reviews from different places and then verifies them with PGP signatures – that way, the buyers feel confident. All payments on the platform are via Bitcoin (BTC) and Monero (XMR) for anonymous transactions.

Key Takeaways

The concept of darknets emerged as a response to concerns about digital privacy and government surveillance. One of the most well-known technologies enabling darknets is the Tor network, which was developed by the U.S. Tor, short for “The Onion Router,” routes internet traffic through a global network of volunteer-operated servers to anonymize a user’s online activity. This technology initially had noble intentions, aiming to protect activists, whistleblowers, and individuals in repressive regimes.

Trade‑offs & Ongoing Risks

Many people also prefer to buy goods and services online, which allows for more opportunities to steal people’s personal data and financial information. Using his credentials, cybercriminals committed a variety of online fraud activity over the course of six months. Another darknet market known for facilitating fentanyl sales to the United States was Canada-based AlphaBay. A once-sizable illicit enterprise that began in 2014, AlphaBay was closed by authorities in 2017 and then reopened in 2021. The last version of the market operated until February of 2023, and a month after that closure, a former AlphaBay vendor pled guilty to distributing fentanyl that caused fatal overdoses in Oregon. Chainalysis data shows that about 0.14% of all transactions in crypto, some $50 billion, involve illicit activity, with a rise in stablecoins as an illicit payment mechanism.

As Hydra did, many of these markets have continued the tradition of including drug harm reduction information for drug buyers, such as providing drug testing and medical advice. “The RuTor forum has launched a series of webinars on medical topics, including first aid and overdose scenarios,” said Aleksey Lakhov, of St. Petersburg-based drug project Drugmap.ru. But Russians fleeing the country since the war have still been able to buy drugs on the dark web. In Georgia, on its southern border, where more than 100,000 Russians have fled, there is Matanga, a local Russian-speaking darknet market offering the same “treasure hunt” buying system as back home. The report said Solaris, a platform which has since been hijacked by Kraken, had sent KillNet $50,000.

• Facebook’s onion mirror allows people to access it in countries that block the platform, allowing people to connect across digital borders.
• A VPN encrypts the data traffic and keeps your activities private on the dark web.
• It’s not established yet how the drugs were brought to occupied Ukraine but the dealing network likely has some connection with Russian soldiers or non-combat staff.
• To support open access to our website and sustain editorial operations, certain commercial or partner references may appear on our site.
• The market started in 2021 in Canada and features both international and Canadian users.
• Counterfeit items are another significant category of goods available on darknet markets.

Darknet markets generate millions in revenue selling stolen personal data

• It ensures the buyer’s identity is kept hidden and accepts payments through cryptocurrencies, including Bitcoin, Litecoin, Ethereum, and Monero.
• Unfortunately, the platform was shut down in 2013 after an extensive investigation that was spearheaded by US Senator Charles Schumer.
• He recommends verifying market employees carefully, and to weed out law enforcement infiltration through barium meal tests.
• It doesn’t track searches or store personal data, making it a strong option for users seeking more anonymous private browsing.
• Law enforcement regularly shuts down these markets, but new ones continuously emerge.
• Customer reviews found on the Abacus site indicate that some of its American vendors sell drug products laced with fentanyl.
• Dark markets continually adapt and evolve to stay ahead of law enforcement and security measures.
• Abacus Market operated as a central deposit wallet, multisignature darknet marketplace supporting both Bitcoin and Monero cryptocurrencies.

Interestingly, the S2S network shows an intermediate level of resilience, which suggests that the S2S network might play the role of a supply chain network on the dark web. Furthermore, after a shock, the activity of buyers is resumed almost immediately, while the activity of sellers recovers more slowly. These different regimes suggest that the ecosystem’s resilience is mainly supported by the high demand of buyers rather than the response of the sellers. To reduce the presence of noise in the S2S network, we consider only stable U2U pairs, i.e., pairs that have at least three transactions throughout the whole period of observation13. The trading volume generated by stable pairs is more than five times larger than that of non-stable pairs13.

Unique threads discussing drainers on dark web forums increased from 55 in 2022 to 129 in 2024, with Telegram channels serving as prominent hubs for these activities. Kaspersky report states, Last year, the underground market for cryptors—tools used by cybercriminals to obfuscate malicious code and evade detection—grew significantly. Developers introduced advanced techniques, advertising subscriptions ranging from $100 to $20,000. Not all onion sites are dangerous, but many host illegal, harmful, or deceptive content. The dark net’s layered encryption and routing protocols offer stronger anonymity, making onion sites appealing to whistleblowers, political dissidents, privacy advocates — and, inevitably, cybercriminals.

Dark web marketplaces discussed in 2026 are best understood as temporary systems shaped by pressure, not permanence. Their repeated rise and collapse reflect enforcement advances, trust failures, and structural weaknesses rather than innovation or stability. In many cases, fear of arrest prompts administrators to run exit scams before enforcement action becomes public. Constant uncertainty, fear of scams, and enforcement pressure create sustained stress. Government of Canada reporting confirms that traffickers use both the surface web and dark web to sell drugs delivered by mail or courier.

• The number of multisellers steeply decreases after operation Bayonet but they still sustain high incomes.
• Bitcoin was initially used to process payments, offering pseudonymity rather than full anonymity.
• Western drug flows in particular come from US-domiciled exchanges and trace flows from those to darknet markets.
• Vendors may also choose to exit with their escrowed funds to avoid competition at a higher volume and price level.
• While it received a relatively small share of large retail purchases as shown in the previous chart, Abacus Market is one such example.

The reason is that the operational structure of DWMs inherently hides the seller–buyer link, as all transactions are made through the marketplace. Buyers send money to the marketplace, which in turn sends the money to the seller. Thus, further analyses in this direction have been hindered by the lack of heuristics able to identify these two key classes of actors in transaction networks and their roles in the structure and dynamics of the ecosystem.

Longevity, code reuse and past exit-scam history are factored in, but we weigh present behaviour more heavily. Finally, we ran a small sample order on each to time escrow release and support response. All numbers are rounded; darknet telemetry is noisy and markets change weekly.

Saved searches

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries. To support open access to our website and sustain editorial operations, certain commercial or partner references may appear on our site. These arrangements help maintain an accessible platform and do not result in additional costs to readers. Jardine also emphasized the importance of using services that actively emphasize security in the decentralized finance space.

Despite these successes, the anonymity of the darknet complicates legal accountability, exposing users to potential legal consequences without clear recourse. Commonly traded substances include heroin, cocaine, methamphetamine, and ecstasy, with a noticeable increase in the availability of synthetic drugs marketed as legal alternatives to controlled substances. The persistent demand for these illegal drugs underscores the ongoing challenges faced by law enforcement agencies in curbing the illicit drug trade on the dark web.

The number of multisellers steeply decreases after operation Bayonet but they still sustain high incomes. Nevertheless, by analysing the income of each multiseller, we observe that the median income still reflects their high income, as shown in Fig. Individually, they are able to yield significant high incomes compared to other types of sellers.

The platform’s popularity continues to grow, attracting both new and returning customers. STYX Market focuses specifically on financial fraud, making it a go-to destination for cybercriminals engaged in this activity. To expand their reach, some marketplaces established parallel channels on Telegram.

In 2017, the website went offline following a law enforcement action taken by the American, Canadian, and Thai authorities, but since August 2021, it’s been operational again. The darknet marketplace is home to a plethora of illegal and legal activities. However, the markets are dominated by things like illegal drugs, explicit content, pirated files, hacking services, and stolen personal information, among others. It’s one of the largest darknet markets that launched in 2022 and trades sensitive financial credential transactions.

User reviews and ratings are commonly featured, allowing buyers to assess the quality and reliability of the drugs being offered. Torzon Market, which emerged in September 2022, has introduced a unique vendor feedback system that imports feedback from other markets with PGP proof, enhancing trust and transparency. The market also offers premium accounts that provide users with advanced seller statistics, catering to more serious buyers and sellers.

There are some things that you can’t find on the surface internet but are available in the darknet markets. Therefore, it’s almost impossible for authorities to track those who run the darknet markets or even their locations. Emerging trends shaping darknet marketplaces in 2025—insights into cryptocurrency trading and security. TRM provides blockchain intelligence darknet markets to help financial institutions, cryptocurrency businesses, and public agencies detect, investigate, and manage crypto-related fraud and financial crime. TRM’s risk management platform includes solutions for transaction monitoring and wallet screening, entity risk scoring – including VASP due diligence – and source and destination of funds tracing.

Ideal marketplaces support anonymous browsing through networks like Tor and I2P, utilize privacy-focused cryptocurrencies such as Monero, and implement measures to prevent tracking and transaction tracing. Platforms that provide clear guidelines for maintaining operational security (OpSec) and offer built-in tools for data obfuscation are especially favored. Its look, design, options, and interface are exactly the exact copy of its competitor, but everything else, including buyers, vendors, and servers, is different. At its launch, the platform accepted payments through Litecoin, but now it has incorporated support for other payment methods like Monero and Bitcoin.

Our mission is to simplify navigation in the complex and evolving world of the darknet. Here, you’ll find links to various resources, including educational archives, private forums, anonymous services, and more. Although dark-web marketplaces utilize technologies like Tor and I2P to enhance anonymity, these methods are not foolproof. Law enforcement agencies continuously improve their ability to trace transactions and monitor marketplace activity. Simple mistakes—such as inadequate operational security practices, sharing identifiable details, or using compromised devices—can quickly compromise anonymity and expose users’ real-world identities. Analyst write‑ups point to a wide spectrum of vendor‑run listings, with drugs typically dominant and fraud/digital‑goods categories active.

• As of October 2022, the largest volume of drugs purchased at two large marketplaces – BlackSprut and Mega – were for cathinones such as mephedrone and alpha-PVP.
• Its main inventory includes corporate credentials, system logs, RDP access points, and internal network data.
• As with our previous reports, we gather data by scanning Dark Web marketplaces, forums, and websites.
• As far as financial recourse for victims, some banks and insurance companies have provided payouts and will include those funds as damages in lawsuits against Genesis Market cybercriminals.
• If you’re after a darknet market with variety and a forward-thinking edge, Tor2door Market’s a contender—watch it close in 2025 as that AI kicks in.
• Changing the Tor browser settings can further boost your security levels on the dark web shops.
• In total, darknet markets and fraud shops received $1.7 billion last year, a rebound from 2022 — the year that saw the sizable Hydra Marketplace close.

We use data of DWM transactions on the Bitcoin blockchain pre-processed by Chainalysis Inc. Although other coins are used, such as Monero recently, Bitcoin is still the mostly used in the ecosystem, being supported by more than 93% of markets7,9. The pre-processing relies on established state-of-the-art heuristics to cluster addresses into entities, such as cospending, intelligence-base, and behavioral clustering39,40,41,42. The resulting data set includes for each transaction the source and destination entities, the time, and the value of the transaction.