January 28, 2026

• admin
• darknet markets
• 0

However, many sites on the dark web host illegal content or activities, and engaging with those can lead to serious legal consequences. In some countries, like Russia or China, dark web access itself may be blocked or penalized. Facebook’s onion mirror allows people to access it in countries that block the platform, allowing people to connect across digital borders. That said, the social network’s data collection and tracking practices may seem at odds with many of the principles motivating dark web users.

Ready to Revolutionize Your Security Operations?

According to the TRM Labs 2025 Crypto Crime Report, Russian-language darknet marketplaces brought in more than $1.7 billion in 2024, continuing a year-over-year increase first noted in 2023. Valued at approximately $15 million, Abacus Market is one of the most lucrative platforms in the dark web ecosystem. Darknets are not limited to criminal activities; nation-state actors use these hidden platforms for espionage, disseminating propaganda, and recruiting agents. Governments and businesses must invest in advanced threat intelligence, cyber defense, and counter-espionage measures.

Fraud shops use payment processor to boost efficiency

At KELA, we help you identify and mitigate risks by providing actionable intelligence from the darknet. Our solutions empower you to monitor illicit darknet marketplaces and track emerging threats, ensuring you can take proactive measures to protect your organization and reputation. Darknet marketplaces emerged around 2011, with Silk Road setting the standard for how these platforms operate. Built on Tor, these sites mask IP addresses by routing traffic through encrypted relays, ensuring anonymity for both buyers and sellers.

Cloned Credit Cards and Cardholder Data

• Use Norton VPN to encrypt the data you send and receive and surf more anonymously.
• The darknet marketplace is home to a plethora of illegal and legal activities.
• The report did, however, present some more positive figures, including a year-over-year decline in revenue from crypto-based scams.
• Tor, short for “The Onion Router,” routes internet traffic through a global network of volunteer-operated servers to anonymize a user’s online activity.
• “The RuTor forum has launched a series of webinars on medical topics, including first aid and overdose scenarios,” said Aleksey Lakhov, of St. Petersburg-based drug project Drugmap.ru.
• The platform allows buyers to review the vendor’s products and services, so it’s easy for them to decide if the vendor is reputable or just scamming them.

Its commitment to privacy, diverse product offerings, and robust security measures make it a preferred choice for users seeking discreet transactions within the darknet. Personal and financial data are commonly sold on dark markets, facilitating identity theft and fraudulent activities. The significance here lies in the potential damage to individuals and businesses. Companies must implement strong data security measures, employ encryption, and monitor for data breaches to protect customer and employee information. In this system, cryptocurrency is held by a trusted third party until the buyer receives the product or service as described. Silk Road quickly grew into the largest darknet market, handling hundreds of millions in transactions.

Market features

Law enforcement regularly shuts down these markets, but new ones continuously emerge. By 2025, these platforms are expected to further refine their operations, offering enhanced privacy and efficiency for users engaged in secure online trade. The integration of blockchain technology and decentralized dark web markets marketplaces has already begun to reshape the landscape, ensuring that transactions remain anonymous and resistant to external interference. These platforms have created a thriving digital economy, with vendors and buyers engaging in transactions that are both efficient and secure.

Rise of Malware-as-a-Service (MaaS)

Then, after operation Bayonet, the number of sellers in all categories and multisellers significantly drops, as shown in Fig. Notably, the number of multisellers suffers the largest drop of \(-99\%\) by the end of the first quarter of 2018. Interestingly, while the other categories of sellers show signs of recovery relative to their previous levels, the number of multisellers remains low after that shock (see Supplementary Information Section S4). He said the proceeds from ransomware attacks, as well as investment schemes, violent extremism and child sexual abuse material, are also being laundered through Russian darknet markets.

Trade‑offs & Ecosystem Risks

Specifically, sellers show a trend of increase and buyers a trend of decrease in their median net income before the shutdown. The evolution of the ecosystem of all buyers and sellers obtained from the considered markets and the U2U network is shown in Fig. Although it shows fluctuations, including those caused by external shocks, the ecosystem exhibits a positive growth trend in terms of trading volume. Decentralized messaging apps let vendors switch platforms easily and maintain privacy. These services provide secure channels, reducing reliance on older networks and lowering exposure to law enforcement tactics.

Norwegian Dam Valve Forced Open for Hours in Cyberattack

These features help create a sense of ‘trust’ among users, even in the criminal ecosystem. To access darknets, users typically need to download and configure the Tor Browser; a modified version of Mozilla Firefox that routes all traffic through the Tor network. This browser enables access to websites with .onion domain extensions, which are specific to the Tor network. These addresses cannot be resolved by conventional DNS servers, contributing to the hidden nature of darknets. Driven by a passion for continuous learning, I strive to explore the complexities of digital anonymity, the ethical and security implications of hidden networks, and the tools necessary to navigate these spaces responsibly. My work bridges the gap between technology and cybersecurity education, helping to inform and empower others in the ever-evolving cyber landscape.

How to Prevent Phishing Attacks?

“Over the years some markets … developed a robust catalog of illicit services like money laundering, fiat offramping, and products that enable cyber-criminal activities like ransomware and malware attacks. One such sophisticated darknet market, Hydra, offered all that and more,” Chainalysis explained. Administrators and sellers on dark web marketplaces had a better 2023 than the previous year, pulling in an estimated $1.7bn in cryptocurrency-based revenues, according to new Chainalysis data. In total, there were 2,158 vendors who advertised at least one of the 96,672 product listings across the 30 marketplaces. On average, marketplaces had 109 unique vendor aliases and 3,222 product listings related to stolen data products.

Illicit and Risky Use-Cases

Conversely, transaction networks obtained from the blockchain contain the entire transaction data of the DWMs and U2U transactions, allowing a thorough investigation of the ecosystem as a whole. In fact, previous studies on DWM transaction networks have revealed crucial aspects of the ecosystem13,14,15. However, they have so far mainly focused on DWM users, without distinguishing between buyers and sellers, and neglecting the different weight that more active users may have in the system.

Torzon Market

• The last version of the market operated until February of 2023, and a month after that closure, a former AlphaBay vendor pled guilty to distributing fentanyl that caused fatal overdoses in Oregon.
• Darknet marketplaces are commercial websites accessed by an encrypted browser which operate on the dark web, functioning primarily as black markets for illegal activity or substances.
• This shift will likely drive forum operators to introduce features like automated escrow services and enhanced anonymity to attract users.
• The combination of Tor integration and user-centric design has set a new standard for secure online trade, ensuring that these platforms remain at the forefront of the digital economy.
• Facebook’s onion mirror allows people to access it in countries that block the platform, allowing people to connect across digital borders.

Besides, not everyone wants to purchase an illegal item – some want items anonymously. Next, we extracted information about stolen data products from the markets on a weekly basis for eight months, from September 1, 2020, through April 30, 2021. We then used this information to determine the number of vendors selling stolen data products, the number of stolen data products advertised, the number of products sold, and the amount of revenue generated. Silk Road, which emerged in 2011, combined TOR and bitcoin to become the first known darknet market.

Abacus Market operated as a central deposit wallet, multisignature darknet marketplace supporting both Bitcoin and Monero cryptocurrencies. Abacus Market, the largest Bitcoin-enabled Western darknet marketplace, has likely executed an exit scam after going offline in early July 2025, according to blockchain intelligence firm TRM Labs. The cybersecurity challenges seen in 2024 highlight the dynamic and ever-evolving nature of cyber threats. As cryptors, loaders, and stealers become more sophisticated, and underground markets remain resilient, organizations must prioritize robust cybersecurity measures in 2025.

Dark web websites: 10 Onion sites to explore

• By 2025, these platforms are expected to further refine their operations, offering enhanced privacy and efficiency for users engaged in secure online trade.
• SecureDrop is an anonymous file-sharing platform designed for secure communication between whistleblowers and journalists.
• Using his credentials, cybercriminals committed a variety of online fraud activity over the course of six months.
• For instance, there may be sellers that make a small amount of transactions, or spend more than receive, which we would classify as buyers.

All news, reviews, and analysis are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy. The Chainalysis report estimates that romance scams have the “worst impact on victims of all scam types” due to the average payment size. The report reveals that 2023 also saw a rise in the prominence of approval phishing scams.

Use cryptocurrency for transactions

The nodes of the S2S network are active sellers (i.e., sellers that are trading at the time) and two sellers are connected by an edge if at least one transaction was made between them during the considered snapshot period. Although the S2S network is composed only of U2U transactions, all categories of sellers (i.e, market-only, U2U-only, and market-U2U) are present in the S2S network. For instance, market-only sellers are entities classified as sellers only in markets, but that may promote U2U transactions with other sellers, hence being part of the S2S network. Therefore, the S2S network can be seen as a proxy for a distribution network of illegal products. In panels (b, c), we show the number of all sellers and buyers per quarter, respectively.

Western drug flows in particular come from US-domiciled exchanges and trace flows from those to darknet markets. The entity “DNM Aggregator” that appears within each category refers to a service we’ve identified as being in control of multiple, disparate darknet markets. For instance, a factory employee can secretly slip away with one and sell it on the darknet markets.

This is likely due to the fact that cryptocurrency prices have been largely stagnating in H and H1 2023, which resulted in less interest shown by the mainstream population. The average cost of credit card information varies from $10 (in countries such as the U.S., Canada, and Australia) to $240 each (with a card balance). New websites and forums were created nearly overnight and very quickly filled the gap left by the sites taken down by authorities. This, however, did little to reduce the supply of illicit goods and services on the dark web. Looking ahead, the focus will likely shift toward decentralized autonomous organizations (DAOs), which could revolutionize governance and decision-making within darknet platforms.

Drughub Market

Nevertheless, by analysing the income of each multiseller, we observe that the median income still reflects their high income, as shown in Fig. Individually, they are able to yield significant high incomes compared to other types of sellers. As Hydra did, many of these markets have continued the tradition of including drug harm reduction information for drug buyers, such as providing drug testing and medical advice. “The RuTor forum has launched a series of webinars on medical topics, including first aid and overdose scenarios,” said Aleksey Lakhov, of St. Petersburg-based drug project Drugmap.ru. But Russians fleeing the country since the war have still been able to buy drugs on the dark web. In Georgia, on its southern border, where more than 100,000 Russians have fled, there is Matanga, a local Russian-speaking darknet market offering the same “treasure hunt” buying system as back home.

• Whether you’re new to the dark web or a vet who’s seen it all, you’ll find something here to chew on.
• But since its relaunch, the developers are focusing more on operational security and ensuring that users can have a good experience on this site.
• Another key distinction is that access to darknet markets requires the use of special software such as the Onion Router, or TOR, which provides security and anonymity.
• Dark markets, on the other hand, are platforms within darknets where illicit transactions occur.
• They are followed by market-U2U sellers, then market-only sellers, and lastly U2U-only sellers.
• The growing ecosystem of darknet markets reflects a thriving digital economy, where innovation and adaptability are key to sustaining user trust.
• Looking ahead, the continued integration of blockchain technology and privacy-focused tools is expected to further enhance the functionality and security of these platforms.
• We found several thousand vendors selling tens of thousands of stolen data products on 30 darknet markets.

The best way to protect yourself from the dangers of darknet markets is to simply avoid them altogether. Even browsing these sites can put you at risk of malware infections or attract unwanted attention from law enforcement. Some dark web listings claim to offer services like hacking-for-hire or even hitmen. Many listings involve stolen personal information, including credit card data, Social Security details, and full identity profiles. One of the most notable developments in recent years is the rise of user-friendly interfaces on platforms like Tor Markets. These interfaces have made it easier for users to navigate complex systems, ensuring that even those with limited technical expertise can participate in the digital economy.

Furthermore, law enforcement worldwide has stepped up its efforts, seized assets, and disrupted key money laundering networks. Additionally, we analyse the U2U network of transactions, i.e., the transactions between pairs of market first-neighbors where the source and destination nodes are market users without the market as an intermediate. In the U2U network, an edge connects nodes that are not necessarily users of the same market. Previous studies have shown that, although the number of users and transactions is larger in markets, the trading volume in the U2U network is larger than that of markets13. The largest component of the S2S network one year before and one year after the operation Bayonet. Nodes are sellers that are active within the time period, and an edge is placed between two sellers if at least one transaction occurs between them during the period.

The dark web hosts a wide range of sites — from whistleblower tools and secure email platforms to underground forums, black markets, and dark web mirrors of legitimate news outlets. Unfortunately, many dark web websites are devoted to the illegal trade of leaked personal information. If you’ve ever experienced an uptick in phishing attacks and spam after a data leak or breach, it may be because your personal information has been posted to the dark web. Policing involves targeting specific activities of the private web deemed illegal or subject to internet censorship.

Constant uncertainty, fear of scams, and enforcement pressure create sustained stress. Reputation scores and user feedback guide buyer decisions in the absence of real-world verification.

• The cartels then use those chemicals to manufacture fentanyl that is later sold in the U.S.
• For operations security he suggests avoiding storing conversation logs, varying writing styles, avoiding mobile phone-based tracking and leaking false personal details to further obfuscate one’s identity.
• Abacus Market operated as a central deposit wallet, multisignature darknet marketplace supporting both Bitcoin and Monero cryptocurrencies.
• By limiting sales to domestic channels, the platform reduces customs risks and cross-border enforcement pressure.
• With Abacus’s departure, remaining platforms such as DrugHub, TorZon Market, and MGM Grand face increased pressure to absorb displaced users while navigating the same risks that led to their predecessor’s downfall.
• Darknets are not limited to criminal activities; nation-state actors use these hidden platforms for espionage, disseminating propaganda, and recruiting agents.
• Other major news sources blocked in some countries, like the BBC, also have dark web versions.

Government of Canada reporting confirms that traffickers use both the surface web and dark web to sell drugs delivered by mail or courier. The same reports highlight gaps in the national ability to measure the full scale of this activity. Journalists use the dark web to communicate with sources anonymously, and whistleblowers rely on it to share sensitive information without fear of retaliation.

Of course, not all activity on the dark web is criminal, but such marketplaces are where a lot of illegal trade and money laundering happens. By relying on encryption, pseudo-anonymous currencies, and network-level anonymity, they create a false sense of safety, drawing in both buyers and sellers. When it comes to cybercriminal enablement, markets like Kraken Market, the DNM Aggregator, and Exploit.in are go-to services, providing bad actors with tools to carry out ransomware attacks, hacks, and more. Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products. In addition to that activity, markets like these host vendors that advertise their own cashout or swapping services, resulting in tens of millions of dollars in laundered funds.

For operations security he suggests avoiding storing conversation logs, varying writing styles, avoiding mobile phone-based tracking and leaking false personal details to further obfuscate one’s identity. Each takedown affects the wider ecosystem by spreading distrust across other marketplaces. As a result, platforms fragment, rebrand, or disappear faster after major enforcement actions. A public FBI/CISA advisory reports more than 21,000 infostealer-log listings across cybercriminal forums in a single quarter of 2024.

This not only helps protect your identity but also contributes to your overall cybersecurity in the digital age. Hacked social media accounts are evidence that cybercriminals have a diverse appetite for Dark Web data products. Prices of hacked cryptocurrency accounts still remain overall the highest among all hacked online accounts.

The evolution of darknet markets has been marked by significant advancements in security, user experience, and market diversity. Over the years, these platforms have transformed into sophisticated ecosystems, offering a wide range of products and services while prioritizing privacy and anonymity. The integration of cryptocurrencies such as Bitcoin and Monero has further enhanced transactional security, making these platforms a reliable choice for users seeking discreet online trade. Much like with drug sales, a similar pattern of task differentiation emerged among darknet markets providing cybercriminal services.

At its launch, the platform accepted payments through Litecoin, but now it has incorporated support for other payment methods like Monero and Bitcoin. The platform also cares about its users and uses PGP encryption and two-factor authentication to secure their data and communication. With a growing user base and expanding inventory, Vortex is positioning itself as an “all-in-one” darknet marketplace. It blends illegal trade with features like gambling, all while maintaining a clear and accessible structure.

We find that trading properties of buyers and sellers reflect the dominance of DWMs in the ecosystem. In particular, we analyse networks of ‘multihomers’, defined as users that are simultaneously trading in multiple markets. We show that these users play a crucial role in the connectivity of the ecosystem because they act as connectors between markets. Analogously, we identify and characterise ‘multisellers’ (i.e., multihomers that are sellers) and ‘multibuyers’ (i.e., multihomers that are buyers). Furthermore, we analyse the seller-to-seller (S2S) network, i.e., the network composed only of transactions among sellers, which can be regarded as a supply chain network of illicit goods and services.

In the vertical axis, markets are in the chronological order of their launch date, although for some markets the activity effectively starts after the launch date (e.g., AlphaBay). The largest component of the S2S network of U2U transactions between sellers for each year with the respective number of nodes (N). The nodes are sellers that are active in that year, and an edge is placed between two sellers if at least one transaction occurs between them during that year. The network is mostly populated by U2U-only sellers, followed by market-only sellers.

Exploring the dark web can be eye-opening, but it’s also risky without the right protection. While the Tor browser boosts privacy, pairing it with a VPN adds a critical layer of security. Use Norton VPN to encrypt the data you send and receive and surf more anonymously. These aren’t distant problems—they are immediate, and they affect public safety, financial systems, and global cooperation. TRM Labs has provided a snapshot of an ecosystem that continues to evolve beneath the surface.