Darknet Markets: Why DeFi Is the New Money Laundering Tool

Christian Jordan Howell is assistant professor in cybercrime, University of South Florida, and David Maimon is professor of criminal justice and criminology, Georgia State University. All sponsored and commercial content, including press releases, is clearly labeled and reviewed for accuracy, disclosure and compliance. All news, reviews, and analysis are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy. The Chainalysis report estimates that romance scams have the “worst impact on victims of all scam types” due to the average payment size.

• Built on Tor, these sites mask IP addresses by routing traffic through encrypted relays, ensuring anonymity for both buyers and sellers.
• Abacus Market appeared on the scene in 2021 and quickly became one of the heavyweights among English-speaking markets on the dark web.
• Known for its robust escrow security and diverse offerings, Abacus is a top choice for 2025.
• Serving 15,000+ users and 1,200+ vendors, it holds an 8% share of darknet drug trading.
• Essential advice for navigating darknet marketplaces safely and effectively in 2025.
• However, the trend is clear—illicit actors are expanding their strategies, forcing enforcement agencies to evolve their tracking methods to keep pace with increasingly sophisticated laundering techniques.

Stolen personal data

Nodes are sellers that are active within the time period, and an edge is placed between two sellers if at least one transaction occurs between them during the period. Buyers simultaneously active on multiple markets also play the role of connectors in the ecosystem. Therefore, we analyse the temporal network where nodes are the active markets and an edge between the nodes represents the number of multibuyers between them, what we henceforth call the multibuyer network. The structural change seen in the multiseller network is not observed in the multibuyer network, as show in Fig. The evolution of the multibuyer network follows a similar pattern to the multiseller network until 2015, despite a stronger polarization around Hydra instead of AlphaBay during 2017.

What’s the benefit of escrow security?

However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated. Many operators have since moved to accepting only Monero (XMR),” Chainalysis added.

Primary Risks for Users of Darknet Marketplaces

• The same pattern is observed in the whole S2S network (see Supplementary Information Section S5).
• But before we start, install Norton VPN to help protect your digital identity and stay safer online.
• Darknets and dark markets have propelled the growth of cybercrime by offering a platform for the sale and exchange of malicious tools and services.
• And while the number of markets appears to be on the decline, those that remain are making more money than ever before.
• Law enforcement agencies around the world have been intensifying their efforts to crack down on darknet markets.
• A public FBI/CISA advisory reports more than 21,000 infostealer-log listings across cybercriminal forums in a single quarter of 2024.

Vice City Market is a new and cutting-edge dark web marketplace where you can find a range of products and vendors at an affordable price (compared to the damage they do to the victims). To access this marketplace, you must register, but before that, you must verify yourself as a human by passing a CAPTCHA test. Participation in dark web marketplaces can lead to serious criminal charges, even if involvement seems limited. Law enforcement investigations often span years and rely on digital traces collected over time.

Alphabay

• Until 2012, there is only one active market, namely Silk Road market, and hence no multihomer activity.
• Its interface is easy to navigate, and it has a reliable escrow system, as well as allowing payments with Bitcoin and Monero.
• Christian Jordan Howell is assistant professor in cybercrime, University of South Florida, and David Maimon is professor of criminal justice and criminology, Georgia State University.
• Cryptocurrencies have played a pivotal role in the functioning of darknet markets, providing the anonymity needed for transactions involving illicit goods and services.
• The following month RuTor retaliated, hacking WayAway and posting screenshots of the breach, arguing that WayAway’s security was too weak to be trusted.
• But since its relaunch, the developers are focusing more on operational security and ensuring that users can have a good experience on this site.

Its strategy is to acquire users through mainstream channels first; toys, retail partnerships and viral media, then onboard them into Web3 through games, NFTs and the PENGU token. “After major exchanges delisted XMR, we observed a significant increase in bitcoin inflows,” Jardine said in an interview with CoinDesk. Also, set up two-factor authentication (2FA) to add an extra layer of protection in case someone manages to figure out your password. Moreover, if you must use public Wi-Fi, ensure that you use a VPN to mask your browsing activity and keep yourself secure. The darknet is basically an overlay network that exists within the internet and can only be accessed with specific configurations, software, and usually uses certain customized communication protocols. The availability of counterfeit goods on these platforms underscores the challenges faced by legitimate businesses in protecting their brands and products from being counterfeited.

Security & Privacy Posture (as described)

Moreover, this darknet shop provides detailed statistics about each user profile on the platform, giving users a better idea of the vendors for the buyers and vice versa. This marketplace accepts payments via Monero but also supports the Escrow system. Despite most darknet markets banning the sale of fentanyl in their terms of service, nearly all mainstream Western-facing markets have vendors that sell fentanyl-laced products. While it received a relatively small share of large retail purchases as shown in the previous chart, Abacus Market is one such example. Though many customers are concentrated in Australia, Abacus has vendors and customers around the world, including the United States.

– Silk Road Launch

Launched after the takedown of AlphaBay in 2021, Abacus Market has rapidly risen to prominence. It features over 40,000 listings including narcotics, counterfeit items, hacking tools, and stolen data. The marketplace is well-known for its bug bounty programs and robust security mechanisms, including mandatory 2FA.

Comparative Snapshot of Key Platforms

• Overall, dark-web marketplaces in 2026 are more sophisticated, secure, and resilient than ever before, evolving rapidly in response to both technological advancements and intensified scrutiny from global law enforcement agencies.
• See how the SentinelOne threat-hunting service WatchTower can surface greater insights and help you outpace attacks.
• Vendors on Hydra also offered services such as “Hacking for Hire,” “Ransomware as a Service” (“RaaS”), and a myriad of money laundering features.
• This aligns with the dominant listing patterns seen on general-purpose markets like Vortex.
• This data enables account takeover attacks across email, social media, and corporate tools.
• One of the most crucial elements is the use of escrow services, which protect both buyers and sellers during transactions.
• If you’re after a darknet market with variety and a forward-thinking edge, Tor2door Market’s a contender—watch it close in 2025 as that AI kicks in.
• Defined as illegal, unregulated commercial websites, these dark markets constantly adapt to law enforcement pressures, evolving in complexity and sophistication.
• It uses the Tor network because it is a popular network that helps to circumvent censorship and online surveillance.

There is a gray zone in which some sellers and buyers may not be easily distinguishable in transaction networks. For instance, there may be sellers that make a small amount of transactions, or spend more than receive, which we would classify as buyers. Nevertheless, it is important to stress that the results are robust under considerable variation of the parameters, indicating that the coherent picture emerging from our analysis does not depend on the details of the method. Future work may further extend the approach presented here, for example using machine learning methods to capture further behavioral regularities.

Financing and fraud

We found several thousand vendors selling tens of thousands of stolen data products on 30 darknet markets. These vendors had more than $140 million in revenue over an eight-month period. ASAP is a tech nerd’s playground—accepting BTC, LTC, ZCash, and Monero, it’s got options for days.

Ethical and Legal Boundaries in Monitoring Darknet Marketplaces

Nemesis Market is a relatively new wallet-less shop on the dark web where you don’t need to deposit any amount in your wallet before buying products from here. The platform allows buyers to review the vendor’s products and services, so it’s easy for them to decide if the vendor is reputable or just scamming them. You can see all the product categories the marketplace deals with on the homepage.

Law Enforcement Action Had Little Effect on Supply and Prices

Below are the best marketplaces on the dark net that we hand-picked after going through multiple shops and doing extensive research. In the first arc of the anime series Lupin the 3rd Part V, Lupin III steals digital currency from the “Marco Polo” darknet market. Whilst a great many products are sold, drugs dominate the numbers of listings, with the drugs including cannabis, MDMA, modafinil,[107][108][109] LSD, cocaine, and designer drugs. The months and years after Silk Road’s closure were marked by a greatly increased number of shorter-lived markets as well as semi-regular law enforcement takedowns, hacks, scams and voluntary closures.

Revisiting CIA: Developing Your Security Strategy in the SaaS Shared Reality

It’s another dark net marketplace that grabbed a lot of attention was the Hydra market. It accepted payments through Bitcoin and the Escrow system and ensured that users’ identities remain anonymous during their purchases. Cypher marketplace has been on the list of the best dark web shops for a while and deals with the business of a variety of products and services.

Explicit content

Furthermore, we analyse the seller-to-seller (S2S) network, i.e., the network composed only of transactions among sellers, which can be regarded as a supply chain network of illicit goods and services. We highlight that these networks exhibit different resilience regimes in the presence of external shocks, the ecosystem’s resilience being mostly guaranteed by the network of buyers rather than sellers. The Dark Web is a concealed segment of the internet that can be accessed only through specialized software such as Tor. In 2026, it remains an increasingly influential part of the digital landscape. The darknet market ecosystem has undergone significant changes over the years, evolving from the days of Silk Road to the diverse and sophisticated platforms we see today. From Abacus Market to WeTheNorth, the leading markets of 2025 offer a wide range of illicit goods and services, each with unique features and transaction methods.

Stay up-to-date with KELA news and insights

As for Genesis Market cybercriminals located in the Netherlands, three have already been convicted and received prison sentences considered severe for that jurisdiction. The third convicted cybercriminal — the biggest Dutch user and the number 10 user worldwide — received a four-year sentence. Indeed, one of the most recent darknet market busts was the Nemesis online market. The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) specifically cited the market’s role in the fentanyl trade as a reason for the bust. On-chain data from BitInfoCharts shows that the daily number of monero transactions has halved from this time last year.

• The market was eventually seized in 2013, and the founder, Ross Ulbricht, was sentenced to two life sentences plus 40 years without the possibility of parole.
• However, the markets are dominated by things like illegal drugs, explicit content, pirated files, hacking services, and stolen personal information, among others.
• To study the performance of sellers, we analyse the quarterly median income, i.e., the quarterly median of the money received by each seller, for each category and multisellers, as shown in Fig.
• This market is not open to the general public and is subject to a thorough vetting process to ensure its security.
• It’s the place where you can buy or sell stolen credit card numbers, SSH login credentials, and personally identifiable information (PII).
• A significant positive signal is that Google Safe Browsing reports the domain as clean, indicating no detected malware or phishing attempts.

Moreover, the layers of encryption and the bounce of your data from node to node effectively mask your IP address, enabling online anonymity. It allows access to the .onion sites on the dark web that you won’t find using a regular browser. Different reports rank marketplaces based on varying criteria such as time period, transaction volume, or investigative relevance. Cryptocurrency transactions are analyzed to identify payment patterns and laundering methods.

• Unfortunately, the increasing availability of personal information on the Dark Web results in lower costs—and consequently, a higher likelihood—that your accounts will be compromised.
• Marketplaces are hosted on hidden services that conceal server locations and user identities.
• Also, set up two-factor authentication (2FA) to add an extra layer of protection in case someone manages to figure out your password.
• These arrangements help maintain an accessible platform and do not result in additional costs to readers.
• So far, five million people have used the tool, and over 13,000 victims have been notified that their computer was infected, and received instructions to help them make their device safe again.
• Torzon Market has established itself as a significant player in the darknet ecosystem, offering a secure, user-centric platform for anonymous trading.

Ready to Explore Web Data at Scale?

Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products. In addition to that activity, markets like these host vendors that advertise their own cashout or swapping services, resulting in tens of millions of dollars in laundered funds. Darknet markets were one of two categories of crypto crime that saw revenues rise in 2023. In total, darknet markets and fraud shops received $1.7 billion last year, a rebound from 2022 — the year that saw the sizable Hydra Marketplace close. The ensuing war for darknet market dominance that began in 2022 continued into 2023, but no other market has since matched Hydra’s financial success.

Dark.fail tweeted on Friday that Empire was targeted with a DDoS (distributed denial of service) attack. In a DDoS attack, the server is bombarded with artificial traffic, which makes it difficult for the server to process web requests, and it ultimately goes down. The Malware-as-a-Service model is expected to expand as it lowers the barrier for entry into cybercrime. The arrest followed an extensive investigation by the Central Office for Combating Internet Crime (ZIT), which tracked the platform’s operations across multiple jurisdictions.

The dark web is home to numerous marketplaces, each carving out its niche in the illicit economy. In 2025, several popular dark web marketplaces have risen to prominence, attracting users with their diverse offerings and robust security measures. From Abacus Market to WeTheNorth, these platforms represent the cutting edge of dark web marketplaces. In total, there were 2,158 vendors who advertised at least one of the 96,672 product listings across the 30 marketplaces.

They also offer access to online subscription services for cheaper prices—but customers have to gamble with the chance of being caught. The information-stealing malware package that Genesis Market used to exploit victims included a hidden Chromium-based browser plugin, made to look like a Google Drive plugin, which captured credentials stored in victims’ browsers. Fentanyl and fentanyl-laced drugs also arrive in the United States through Latin America based cartels. U.S. customers predominantly purchase drugs from these groups that are known to have used crypto to source fentanyl precursor chemicals from labs based in China.

The shop accepts payment through Bitcoin and Monero, while some vendors accept the coins. As these marketplaces keep changing, it is critical to stay on top of the main platforms on the dark web worth monitoring. Monitoring dark web markets is crucial, no matter if you are a business or an individual, as you can then proactively identify and mitigate darknet markets legit potential breaches and cyber threats. In Grand Theft Auto Online, players who purchase warehouses and garages for illicit cargo and stolen cars can buy/steal and sell them through trade on the “SecuroServ” syndicate website. No dark web marketplace is safe to use because they involve illegal activity, financial risk, and potential legal consequences.

As much as authorities work hard to shut down various sites, it shows what the dark web is capable of doing if left unchecked. The dark web is famous when it comes to hosting as well as spreading explicit and illegal content. It is home to all sorts of disturbing content, given that the markets share content related to non-consensual recordings and child exploitation. The internet is a wide landscape that comprises the surface part – the internet that we all know and the hidden portion. The hidden part of the internet is the larger portion that features over 95% of the entire internet. This is the part of the internet known as the dark web, and it’s accessible via mainstream search engines such as Google.