Jardine also emphasized the importance of using services that actively emphasize security in the decentralized finance space. “Good digital hygiene, especially in terms of password and seed phrase management, is also crucial,” he said. While DeFi adoption among darknet vendors is growing, it has not replaced centralized exchanges as the primary laundering method.
The future of darknet trade looks promising, with ongoing advancements poised to further enhance the user experience. In conclusion, the darknet ecosystem continues to evolve, driven by technological advancements and the growing demand for secure online trade. As these markets become more sophisticated, they offer users a reliable and efficient platform for conducting transactions, solidifying their position as a cornerstone of the digital economy. When it comes to cybercriminal enablement, markets like Kraken Market, the DNM Aggregator, and Exploit.in are go-to services, providing bad actors with tools to carry out ransomware attacks, hacks, and more. Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products. In addition to that activity, markets like these host vendors that advertise their own cashout or swapping services, resulting in tens of millions of dollars in laundered funds.
You can see all the product categories the marketplace deals with on the homepage. Like other marketplaces, it also requires registration for new users and accepts payments in Monero. Dark web search engines support dark web marketplaces and allow users to use them, but still accessing them is full of risks; they can infect your device with malware or viruses, and can bring other legal consequences.
By definition, users that interact among themselves form U2U transactions. If the pair of users interact with multiple DWMs these U2U transactions are included in darknet marketplaces 2026 all related DWMs and counted multiple times. Therefore, the simple sum of all U2U transactions of each DWM is more than the sum of all unique U2U transactions.
The anonymity and encryption provided in dark markets create a haven for cybercriminals and nation-state actors to buy and sell dangerous assets while evading detection. Our results also support recent recommendations of paying attention to individual sellers rather than entire DWMs40. Law enforcement agencies, however, have only recently started targeting individual sellers. The first operation took place in 2018 and successfully led to the arrest of 35 sellers41, while the largest operation to date occurred in 2020 and led to 179 arrests in six different countries42.
To study the performance of sellers, we analyse the quarterly median income, i.e., the quarterly median of the money received by each seller, for each category and multisellers, as shown in Fig. We find that multisellers have the largest median income throughout the period of observation—except in the last quarter of 2017 and 2018, when they have the second largest median income. They are followed by market-U2U sellers, then market-only sellers, and lastly U2U-only sellers. Therefore, although larger in number, U2U-only sellers typically make the smallest income. This suggests that sellers with more diverse sources of income, such as multisellers and market-U2U sellers, are able to produce a higher income. Additionally, we observe that, except for U2U-only sellers, the median income of the other types of sellers drops after the major shock caused by operation Bayonet (see Supplementary Information Section S4).
Importantly, the algorithm returns reasonable estimates for the number of sellers when compared against a benchmark of nine DWMs where estimates exist. Then, we reveal a concentration of activity around an elite group of participants, where a large fraction of the trading volume is driven by a small number of players. We find that trading properties of buyers and sellers reflect the dominance of DWMs in the ecosystem. In particular, we analyse networks of ‘multihomers’, defined as users that are simultaneously trading in multiple markets. We show that these users play a crucial role in the connectivity of the ecosystem because they act as connectors between markets.
The site aims to direct users to the actual Torzon Market, presumably a darknet marketplace. Freshtools is a unique marketplace in that it does not only provide the stolen data, but it allows criminals to purchase MaaS which can cause further damage to the victims. It is one of the most active and up to date markets and always provides new and updated malware and data. It is a hub for financial cybercrime and offers a wide range of illicit services and stolen data that cater to sophisticated cybercriminals.
The number of sellers in each category and multisellers as a function of time is shown in Fig. Until the end of 2013, when Silk Road is the dominant market (see Fig. 3), market-only sellers is the dominant category, and there are no multisellers. From the last quarter of 2013, U2U-only sellers become the largest category of sellers and remains as the largest throughout the rest of the observation period. The large number of U2U-only sellers is in accordance with previous results that showed that the trading volume in the U2U network is significantly larger than that of DWMs13 (also see Supplementary Information Figure S8). It has built a reputation for being a reliable source of stolen credit card data and PII.
After the shutdown of Silk Road, in the last quarter of 2013, the ecosystem evolves to a structure where several markets coexist. This structural change is reflected in the median net income of sellers and buyers, as shown in Fig. While the curves for the seller and buyer median net income were negatively correlated before Silk Road’s shutdown, after that moment they became positively correlated. Specifically, sellers show a trend of increase and buyers a trend of decrease in their median net income before the shutdown. TRM Labs calculated that in the eight months since Hydra had been shut down, the new cluster of darknet markets had amassed $820 million in crypto currency deposits.
Its emphasis on user anonymity and document forgery makes it a core tool for identity fraud. Founded in 2014, BriansClub remains one of the oldest and most infamous dark web markets for stolen credit cards, fullz (complete identity kits), and dumps. As these marketplaces keep changing, it is critical to stay on top of the main platforms on the dark web worth monitoring. Monitoring dark web markets is crucial, no matter if you are a business or an individual, as you can then proactively identify and mitigate potential breaches and cyber threats.
While market dynamics may have shifted since, the cited data illustrates how cartels had previously exploited crypto ecosystems. The TRM Labs report also revealed that crypto use in vendor shop drug sales more than doubled in 2024, reaching over $600 million in volume. The findings by TRM Labs align with other investigations into the intersection of cryptocurrency and the drug trade. TRM Labs found that only four Russian-language marketplaces exited the ecosystem in 2024, out of approximately 20 operating during the year.
Founded in early 2023, shortly after major law enforcement operations shut down several competing platforms, Abacus quickly filled the void by prioritizing reliability, advanced security, and user anonymity. Dark-web marketplaces operate through encrypted networks, primarily utilizing anonymity-enhancing technologies such as Tor (The Onion Router) and I2P (Invisible Internet Project). These technologies obscure users’ identities and locations by routing their internet traffic through multiple volunteer-operated servers worldwide, making it extremely difficult to trace activities back to individuals. Tor remains the most prevalent method due to its ease of use and robust anonymity features, but the popularity of I2P is steadily growing due to its increased resistance to surveillance and censorship. Launched in 2020, Cypher Marketplace sells fraudulent documents, stolen credit cards, fake IDs, and malware.
You can legally browse darknet sites for legitimate purposes like research or privacy protection. However, engaging in illegal activities on the darknet is against the law and can result in serious criminal charges. If you access illegal content or participate in criminal transactions, you face legal consequences.
Europol’s IOCTA notes that darknet marketplaces increasingly rely on resilience services such as rotating onion addresses to stay online despite DDoS attacks and law-enforcement pressure. Abacus Market was launched in 2021 and now lists over 40,000 illicit goods, including hacking tools, counterfeit documents, and listings for drugs. In 2024, it recorded on-chain revenue of $43.3 million, a 183 per cent increase, driven by vendor migrations post-shutdown of competitors, according to Chainalysis’ 2023 market report Darknet revenue in 2023.
ProPublica is an investigative news site owned by an independent nonprofit that exposes abuses of power and corruption. It hosts an onion site so people in countries with restricted press freedom can access its journalism, which covers everything from hacktivism to government repression. On the dark web, traffic is routed through multiple server nodes that don’t log activity, obscuring the user’s origin and enabling anonymous communication. Lawmakers and platforms alike will need to decide what responsibility they’re willing to accept. TRM Labs reported that TRON accounted for 58% of illicit crypto activity in 2024, followed by Ethereum at 24% and Bitcoin at 12%. By utilizing crypto transactions, these cartels can efficiently fund and facilitate the production of fentanyl, which is then trafficked into the United States, contributing to the ongoing opioid crisis.
Even browsing these sites can put you at risk of malware infections or attract unwanted attention from law enforcement. BidenCash became known for regularly leaking huge amounts of stolen credit card data and personal information — often for free. The goal is simple — make financial fraud easy and get as much attention as possible. Some now offer customer support, escrow systems to prevent fraud, and even user-friendly interfaces that make illegal trade feel strangely routine.
