Now those trying to access Solaris are redirected to its upstart rival, Kraken. But amid the scramble for power and wealth, experts have told VICE World News that the huge profits being generated by these platforms are being fuelled by money from gangs involved darknet marketplaces 2026 in increasingly sinister crimes. Nearly half of the marketplaces launched in 2024 accepted only Monero, representing a sharp increase from just over one-third in 2023, signaling a growing preference for enhanced privacy and anti-surveillance capabilities.

Secure Tor Access

This has led to the emergence of specialized markets that focus on niche products, further diversifying the ecosystem. Abacus Market stands out with 35,000+ listings and $5 million in monthly cryptocurrency trades via Bitcoin (BTC) and Monero (XMR). Serving 15,000+ users and 1,200+ vendors, it holds an 8% share of darknet drug trading. Known for its robust escrow security and diverse offerings, Abacus is a top choice for 2025. These darknet markets are difficult to disrupt directly, but efforts to thwart customers of stolen data from using it offers some hope.

The dark web privacy dilemma: linguistic diversity, talkativeness, and user engagement on the cryptomarket forums

The Chainalysis 2024 Crypto Crime Report highlights a $1.7 billion revenue surge in darknet markets and a rise in crypto-linked sanctions and new scam trends. The increased use of DeFi comes amid tight regulations on centralized exchanges. With stricter Know Your Customer (KYC) and Anti-Money Laundering (AML) measures, illicit actors are facing greater challenges when attempting to cash out. Furthermore, law enforcement worldwide has stepped up its efforts, seized assets, and disrupted key money laundering networks. We classify all entities either as sellers or buyers as a function of time. The result is a time series of lists of sellers and buyers for each period and for each market and the U2U network.

CISA releases Secure Connectivity Principles Checklist for Operational Technology Networks Connectivity

• Darknets also serve as a platform for whistleblowers and privacy advocates.
• Drugs lead the pack—weed, pills, some synthetics—but digital goods like hacked logins are gaining, tying into Telegram’s side gig boom.
• The dark net is famous for being a hub of black market websites for buying and selling products and services.
• Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products.
• It trades in hacked bank accounts, stolen credit card information, and other services that facilitate cryptocurrency laundering.

Law enforcement takedowns, such as Archetyp, demonstrate both impact and adversary adaptation. For cybersecurity professionals, focusing on payment methods, vendor migration, and marketplace specialisation offers the most effective path to actionable intelligence. Monitoring active marketplaces offers early access to malware kits, credential dumps, and fraud tools. Tracking vendor migration—such as from Archetyp to Exodus—provides insight into tactical shifts. Focusing intelligence collection on specialised marketplaces yields better ROI for threat detection and proactive defence. Darknet marketplaces remain central to illicit trade in 2025, with evolving business models, payment systems, and law enforcement responses.

Why do different sources list different “top” dark web marketplaces?

Its interface is easy to navigate, and it has a reliable escrow system, as well as allowing payments with Bitcoin and Monero. All of this has made it one of the most reliable markets still active in 2025. The evolution of darknet markets has been marked by significant advancements in technology, user experience, and security protocols.

What happens if your data is sold on the dark web?

The vendors aren’t required to register or apply for a vendor account while using this platform. It ensures the buyer’s identity is kept hidden and accepts payments through cryptocurrencies, including Bitcoin, Litecoin, Ethereum, and Monero. Different reports rank marketplaces based on varying criteria such as time period, transaction volume, or investigative relevance.

Beyond Bug Bounties: How Private Researchers Are Taking Down Ransomware Operations

In contrast to the other types of sellers, the median income of U2U-only sellers increases after operation Bayonet. Moreover, we observe a trend of increase in their median income relative to the value before operation Bayonet—an increase of almost six times by the end of the period of observation (see Supplementary Information S4). Further supporting this interpretation, we observe that the trading volume of the U2U network increases after Bayonet, while the trading volume of markets decreases (see Supplementary Information Section S4). The evolution of the ecosystem of all buyers and sellers obtained from the considered markets and the U2U network is shown in Fig. Although it shows fluctuations, including those caused by external shocks, the ecosystem exhibits a positive growth trend in terms of trading volume. The following month RuTor retaliated, hacking WayAway and posting screenshots of the breach, arguing that WayAway’s security was too weak to be trusted.

Crypto Investigations

The results of that investigation were published in a report called Technical analysis of the Genesis Market. Though Genesis Market domains and servers were seized and antivirus programs have been updated, cybercriminals have already rebuilt illicit services like these. Mega Darknet Market is the dominant drug supply source for drug vendors on other darknet sites, holding a 63.4% share of that market.

• We find that multisellers have the largest median income throughout the period of observation—except in the last quarter of 2017 and 2018, when they have the second largest median income.
• Established in 2022, Torzon market is one of the biggest and most diverse marketplaces on the dark web.
• But since its relaunch, the developers are focusing more on operational security and ensuring that users can have a good experience on this site.
• These arrangements help maintain an accessible platform and do not result in additional costs to readers.
• In panels (f, g), we show the PDF of the total money received by each seller and the total money sent by each buyer, respectively.
• Who doesn’t like privacy, especially when dealing with the buying and selling of illegal products and services?
• The most recent example is the shutdown of the oldest marketplace Hydra Market in 2022 which took a combined effort of the FBI and the German authorities.

Dangerous fake or malicious vendors

In this paper, we look closely at patterns of U2U trading relationships among DWM users. Alphabay Market leads with 60,000+ listings and $20 million in monthly trades via BTC and XMR, dominating 20% of darknet marketplaces. With 25,000+ users and 3,000+ vendors, it’s the gold standard for escrow security and scale. Just like traditional e-commerce sites, darknet markets provide a platform for vendors to connect with potential buyers to facilitate transactions.

• This multi-role classification, to be implemented in future work, can help gain a more nuanced understanding of the ecosystem and the structure of the dark web supply chains.
• However, emerging cryptocurrencies with even stronger privacy features are gaining traction, further solidifying the financial infrastructure of these markets.
• The concept of darknets emerged as a response to concerns about digital privacy and government surveillance.
• Surprisingly, although DWMs have gained significant attention from the scientific community and law enforcement agencies, little is known about the key players sustaining their unusual adaptability and responsive dynamics.

Monero (XMR)

• Jardine also emphasized the importance of using services that actively emphasize security in the decentralized finance space.
• Participation in dark web marketplaces can lead to serious criminal charges, even if involvement seems limited.
• Ares Market is commonly profiled by threat‑intel trackers as a general‑purpose dark‑web marketplace that appeared in 2021.
• “They show an affluent lifestyle with expensive apartments, luxury brands, but with a touch of illicit intrigue.” Many of Telegram’s Russian drug bloggers are most likely sponsored by new darknet drug shops.
• Next, we extracted information about stolen data products from the markets on a weekly basis for eight months, from September 1, 2020, through April 30, 2021.
• Renowned for its extensive inventory of financial data and sophisticated operating methods, Brian’s Club is a key player in the underground economy of financial cybercrime.

After the shutdown of Silk Road, in the last quarter of 2013, the ecosystem evolves to a structure where several markets coexist. This structural change is reflected in the median net income of sellers and buyers, as shown in Fig. While the curves for the seller and buyer median net income were negatively correlated before Silk Road’s shutdown, after that moment they became positively correlated. Specifically, sellers show a trend of increase and buyers a trend of decrease in their median net income before the shutdown. TRM Labs calculated that in the eight months since Hydra had been shut down, the new cluster of darknet markets had amassed $820 million in crypto currency deposits.

Stay up-to-date with KELA news and insights

Some listings are nothing more than scams designed to trick people into sending cryptocurrency without delivering anything in return. Many listings involve stolen personal information, including credit card data, Social Security details, and full identity profiles. Darknet marketplaces may look like regular online stores, but using or even browsing them comes with serious risks.

Bandwidth.com reports multimillion dollar loss post DDoS attacks

The integration of cryptocurrencies such as Bitcoin and Monero has further enhanced transactional security, making these platforms a reliable choice for users seeking discreet online trade. By 2025, these platforms are expected to further refine their operations, offering enhanced privacy and efficiency for users engaged in secure online trade. The integration of blockchain technology and decentralized marketplaces has already begun to reshape the landscape, ensuring that transactions remain anonymous and resistant to external interference. These platforms have created a thriving digital economy, with vendors and buyers engaging in transactions that are both efficient and secure.

Contrary to predictions, the market for cryptocurrency “cleaning” services, or Bitcoin mixers, stagnated. The competitive landscape remained unchanged, with no significant innovations reported. Black traffic schemes—malicious landing pages promoted via deceptive ads—remained a constant threat. These schemes leveraged mainstream ad platforms to distribute malware to unsuspecting users. After shut down, the site displayed a seizure notice and directed users to their hidden service[9] to find more information about the operation. Law enforcement seized substantial evidence, including 47 smartphones, 45 computers and notebooks, eight mobile phones, four computers, and 34 data storage devices from the primary suspect’s locations.

The Silk Road was a famous dark web marketplace where users could buy and sell goods and services anonymously. All the payments were made through cryptocurrency, further enhancing marketplace anonymity. The users on this site could review and rate the products that promote reliable and fraudster vendors. One of the key factors driving this evolution is the adoption of Tor-based platforms, which provide a high level of anonymity and security.

This list is not exhaustive, and there are many more types of onion sites on the dark net, including websites offering fraud services, botnet panels, file repositories for pirated media, forums for extremist groups, and more. Telegram, once a popular platform for selling drugs due to its security and perception of non-cooperation with law enforcement, saw many of its drug vendors migrate to alternative platforms like Signal, Session, and WhatsApp. A new report published by blockchain forensic firm TRM Labs in early 2025 outlined a major rise in crypto-fueled drug sales throughout 2024, driven largely by Russian-language darknet marketplaces. Official-torzon.markets claims to be the official gateway to the “Torzon Market,” providing links, PGP verification information, and a Tor Browser guide.

Our study indicates that a much higher number of highly active DWM users, on the order of tens of thousands, is involved in transactions with other DWM users. Moreover, our analysis paves the way to a deeper understanding of U2U transactions in online marketplaces. Recent results have shown that transaction networks and activity on DWMs and regulated online marketplaces share several robust macroscopic properties43. One might therefore hypothesise that U2U trading is also a prevalent feature on regulated online marketplaces. We have shown that the U2U network is resilient to abrupt external shocks, such as marketplace closures, and does not need the centralised structure of DWMs to survive.

Dark Web Market Revenues Rebound but Sector Fragments

You can find drugs, weapons, stolen data, and counterfeit documents on these marketplaces. They operate similarly to regular e-commerce sites but use cryptocurrencies for transactions. Most dark markets have user review systems and vendor ratings to establish trust. Law enforcement regularly shuts down these markets, but new ones continuously emerge. Much like with drug sales, a similar pattern of task differentiation emerged among darknet markets providing cybercriminal services.

Our work unveils sophisticated patterns of trade emerging in the dark web and highlights the importance of investigating user behaviour beyond the immediate buyer-seller network on a single marketplace. Today, darknets are populated by a vast array of users, ranging from privacy-conscious individuals to cybercriminals, hacktivists, and nation-state actors. These hidden networks provide a platform for illegal activities that include the sale of stolen data, hacking tools, weapons, counterfeit currency, and narcotics. Dark markets, often accessed through specialized marketplaces within darknets, are breeding grounds for underground economies, where users can engage in transactions while evading law enforcement and ethical oversight. The goods on sale range from stolen credit card data and forged documents to illegal drugs, weapons, malware as a service, and hacking tools.

I’ve been poking around these places for a while now, from the giants like Abacus to the old-timers like Vice City. This isn’t just a quick list; it’s the full scoop on what they offer, how they keep things tight, and why they’re worth your time—or not. Whether you’re new to the dark web or a vet who’s seen it all, you’ll find something here to chew on. Below, I’m breaking down each market with everything I’ve picked up—listings, quirks, the works. Each marketplace is a star-graph where the central node is the marketplace, and the leaf nodes, i.e., the first-neighbors, are the marketplace users. Therefore, all transactions involving the market have the market either as a source or as a destination node.

Financial fraud is common, and you have no recourse if transactions go wrong since these markets operate outside legal frameworks. The evolution of darknet markets has been marked by significant advancements in technology, user experience, and economic efficiency. Over the past decade, these platforms have transformed into sophisticated ecosystems that cater to a wide range of consumer needs, offering unparalleled convenience and security. The integration of cryptocurrencies has played a pivotal role in this transformation, enabling seamless and anonymous transactions that are resistant to traditional financial oversight. One of the key developments in recent years has been the emergence of user-friendly interfaces and Tor-based marketplaces.

Monero’s ring signatures, stealth addresses, and RingCT obfuscate transaction details—enhancing privacy and hindering traceability The Rise of Monero. Sites such as Abacus and Russian Market accept both currencies to broaden their appeal. Journalists use the dark web to communicate with sources anonymously, and whistleblowers rely on it to share sensitive information without fear of retaliation. By adopting a few straightforward rules and habits, you can make it more difficult for hackers to access your data and remove yourself from their line of sight.

Major news outlets like The New York Times, The Economist, and The Guardian host SecureDrop instances on the dark web to give sources a safe, anonymous way to share sensitive information. But while anonymous email services can help protect your identity, they don’t make you immune to threats like email spoofing or social engineering. And it’s still essential to use strong passwords and two-factor authentication (2FA) to help keep your account secure. The CIA’s onion site allows users to securely report threats or suspicious activity, especially in regions where online surveillance is common. Its presence on the dark web also supports intelligence gathering and helps track cybercriminal activity.

• Nodes are sellers that are active within the time period, and an edge is placed between two sellers if at least one transaction occurs between them during the period.
• It’s one of the largest darknet markets that launched in 2022 and trades sensitive financial credential transactions.
• The goal is understanding ecosystem behavior, not validating or promoting marketplace activity.
• Moreover, the number of multibuyers increases, which suggests a fast response from buyers to external shocks by trying to diversify their sources.
• While DeFi adoption among darknet vendors is growing, it has not replaced centralized exchanges as the primary laundering method.
• BlackOps Market is described in community sources as a privacy-first, general-purpose dark-web marketplace that emerged in late 2024 and continued gaining visibility into 2025.

With law enforcement agencies improving their ability to track Bitcoin (BTC) transactions, darknet market operators and vendors are moving to Monero (XMR) as their cryptocurrency of choice. We showed that a small fraction of traders is responsible for a large fraction of the trading volume, and by analysing the networks of buyers and sellers, we found different resilience regimes. Shocks tend to induce serious structural changes in the multiseller network, but impact the multibuyer network much less severely.

Yes, the darknet still exists and continues to operate through networks like Tor, I2P, and Freenet. While law enforcement regularly shuts down illegal marketplaces, the underlying infrastructure remains functional. New darknet sites and markets continuously emerge to replace those that get shut down. The technology behind the darknet is actively maintained and continues to evolve. Darknets and dark markets present a multifaceted challenge to businesses and society as a whole.

In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers. The nodes of the S2S network are active sellers (i.e., sellers that are trading at the time) and two sellers are connected by an edge if at least one transaction was made between them during the considered snapshot period. Although the S2S network is composed only of U2U transactions, all categories of sellers (i.e, market-only, U2U-only, and market-U2U) are present in the S2S network.

Its catalog includes physical narcotics, digital goods, stolen accounts, and subscription bypass tools. The broad category mix positions Vortex as an entry-level market for general illicit trade. A public FBI/CISA advisory reports more than 21,000 infostealer-log listings across cybercriminal forums in a single quarter of 2024. This figure highlights the scale of log-driven access markets like Exodus. Torzon Market promotes stability and uptime, making it appealing during periods when other markets face outages or takedowns.