In the chart below, we see that the DNM Aggregator emerged as the clear leader among fraud shops enabling cybercrime, and Exploit.in and Kraken Market almost equally sold tools used to facilitate ransomware attacks. As for cybercriminal administration, the category includes inflows from ransomware affiliate wallets. This includes purchases such as malicious software and supporting services which cybercriminals sometimes make using escrow services on crime forums.

Scams and fraudulent activities on the darknet markets

• Official-torzon.markets claims to be the official gateway to the “Torzon Market,” providing links, PGP verification information, and a Tor Browser guide.
• Some dark web listings claim to offer services like hacking-for-hire or even hitmen.
• Even after the takedown of Hydra Market in April 2022, no other major Russian-language darknet markets have been dismantled, allowing them to continue driving illicit crypto drug activity.
• DWMs are accessed through darknet browsers supporting the onion routing protocol (e.g., Tor), which provides anonymous communication connections35.
• There’s high exposure to malware and cybersecurity threats that can steal your personal information.

The number of sellers in each category and multisellers as a function of time is shown in Fig. Until the end of 2013, when Silk Road is the dominant market (see Fig. 3), market-only sellers is the dominant category, and there are no multisellers. From the last quarter of 2013, U2U-only sellers become the largest category of sellers and remains as the largest throughout the rest of the observation period. The large number of U2U-only sellers is in accordance with previous results that showed that the trading volume in the U2U network is significantly larger than that of DWMs13 (also see Supplementary Information Figure S8). It has built a reputation for being a reliable source of stolen credit card data and PII.

Large number of U2U transactions

The classification is performed in five steps (see Fig. 1), as detailed next. The largest component of the S2S network one year before and one year after the operation Bayonet. Nodes are sellers that are active within the time period, and an edge is placed between two sellers if at least one transaction occurs between them during the period. These critical changes may not be perceived from macroscopic measures of the ecosystem as a whole. For instance, the typical net income of sellers is seemingly unaffected, as shown in Fig. 2a, where the overall ecosystem volume quickly recovers after market closures.

• Nodes are sellers that are active within the time period, and an edge is placed between two sellers if at least one transaction occurs between them during the period.
• All content in this repository is published solely for educational use and is intended to promote ethical research and knowledge.
• It tracks Tor user activity by region, showing trends in access and adoption without collecting personal data.
• BlackOps Market is described in community sources as a privacy-first, general-purpose dark-web marketplace that emerged in late 2024 and continued gaining visibility into 2025.
• However, in April 2022, this site went offline after American and German federal government law enforcement agencies seized the website servers.

Secure Your Cryptocurrency Transactions

Therefore, you must run an IP leak test to ensure that the VPN is working completely fine and is not risking your digital security. The website has a sleek design and interactive user interface, making it the most preferred choice in terms of user experience. You can pay through Monera and Bitcoin using the escrow system or the traditional market account after making a purchase on this shop. The ASAP is a moderate design marketplace on the dark web that offers helpful tools like mandatory PGP encryption and two-factor authentication for a safe browsing experience. Like other marketplaces, ASAP Market also requires you to register for an account. But since its relaunch, the developers are focusing more on operational security and ensuring that users can have a good experience on this site.

Security & Privacy Model (sector context)

With 12,000+ users and 900+ vendors, it boasts a 95% vendor rating—ideal for quality-focused dark pool trading. Our research details a thriving underground economy and illicit supply chain enabled by darknet markets. As long as data is routinely stolen, there are likely to be marketplaces for the stolen information.

Contents

That said, the social network’s data collection and tracking practices may seem at odds with many of the principles motivating dark web users. Concerns about how Meta treats user data have led many people to delete their Facebook profiles or at least limit their social media presence. Unfortunately, many dark web websites are devoted to the illegal trade of leaked personal information. If you’ve ever experienced an uptick in phishing attacks and spam after a data leak or breach, it may be because your personal information has been posted to the dark web. Onion sites, or dark web websites, are sites on the dark web that can typically only be accessed using special software like the Tor browser. These sites use “.onion” domains, which are made up of random letters and numbers up to 56 characters long.

• The site emphasizes on‑platform interactions and cryptocurrency settlement.
• Patterns recommended to avoid include hiring hitmen like Dread Pirate Roberts, and sharing handles for software questions on sites like Stack Exchange.
• Its builders created it from the ground up to offer a “cleaner” and more organized shopping experience than most.
• Due to its extensive inventory and reputation for reliability, Brian’s Club has maintained a significant presence on the dark web.
• Essentially, these payment processors provide a white label service for darknet markets and fraud shops, and a seamless checkout experience for those services’ customers.
• If any user is found not complying with the law, strict and immediate action will be taken against them.
• Latest updates from the darknet trading world as of February 2025—key shifts and developments.
• The following month RuTor retaliated, hacking WayAway and posting screenshots of the breach, arguing that WayAway’s security was too weak to be trusted.

Search code, repositories, users, issues, pull requests…

Founded in early 2023, shortly after major law enforcement operations shut down several competing platforms, Abacus quickly filled the void by prioritizing reliability, advanced security, and user anonymity. Dark-web marketplaces operate through encrypted networks, primarily utilizing anonymity-enhancing technologies such as Tor (The Onion Router) and I2P (Invisible Internet Project). These technologies obscure users’ identities and locations by routing their internet traffic through multiple volunteer-operated servers worldwide, making it extremely difficult to trace activities back to individuals. Tor remains the most prevalent method due to its ease of use and robust anonymity features, but the popularity of I2P is steadily growing due to its increased resistance to surveillance and censorship. Launched in 2020, Cypher Marketplace sells fraudulent documents, stolen credit cards, fake IDs, and malware.

What Risks Are Associated With Dark Web Marketplaces?

Ares Market is presented in open sources as a general‑purpose marketplace with a familiar trust stack (escrow, feedback, PGP/MFA) and BTC/XMR settlement—features that align with sector norms rather than set it apart. As with any hidden service, availability, policies, and coin options can change without notice; much of what’s known is either a point‑in‑time analyst snapshot or self‑reported market copy. Flugsvamp 4.0 presents as a localized, drug‑centric market that inherited the Flugsvamp brand but not its full network effects. Scholarly analyses highlight how Swedish vendors largely migrated away from FS4 after 2021, with the 2025 Archetyp takedown again reshaping where Swedish traffic lands. As with any hidden service, features and status are fluid; third‑party tracker details should be treated as directional rather than definitive.

Dark Web Market Revenues Rebound but Sector Fragments

TorZon Market is a large, general‑purpose dark‑web marketplace that’s frequently cited in 2024–2025 roundups. It operates on Tor and, by 2025, is commonly reported as hosting tens of thousands of active listings. To make seller reputations more portable, TorZon supports imported, PGP‑signed reviews, and it accepts both Bitcoin and Monero.

Essential Security Tips for Using Dark-Web Marketplaces

We deliver contextualized, actionable intelligence through our dedicated platform or API integration, ensuring that you can respond effectively to darknet threats. Notably, Abacus explicitly forbids highly dangerous goods, including weapons, explosives, and exploitative material, which has helped maintain a relatively favorable reputation among its user base. While this topic may seem distant for most people, understanding how these spaces operate is crucial.

Trade‑offs & Ongoing Risks

• Archetyp Market was dismantled in June 2025 during Operation Deep Sentinel in a coordinated raid across six countries.
• Chainalysis had previously identified over $37.8 million in suspicious transfers involving suspected China-based chemical vendors.
• Now those trying to access Solaris are redirected to its upstart rival, Kraken.
• Plotted lines indicate the median value while bands represent the 95% confidence interval.
• As a result, darknet markets have become a hub for innovation, with new features and services being introduced regularly to meet the evolving needs of the community.
• It’s recommended not to use new alternative links, as they could just be planned exit scams.
• Legally, they are limited to observing publicly accessible areas using tools like the Tor browser, without engaging in unauthorized access or illegal transactions.

Each offers unique strengths in cryptocurrency trading and escrow security—essential for navigating the onion network. Beginning in September 2021, Abacus Market has established itself as one of the leading dark web marketplaces. After AlphaBay closed, Abacus Market took its place as the world’s largest underground darknet marketplaces. Abacus Market quickly rose to prominence by attracting former AlphaBay users and providing a comprehensive platform for a wide range of illicit activities.

Access Brokers: Their Pivotal Role in Cybercrime

With law enforcement agencies improving their ability to track Bitcoin (BTC) transactions, darknet market operators and vendors are moving to Monero (XMR) as their cryptocurrency of choice. We showed that a small fraction of traders is responsible for a large fraction of the trading volume, and by analysing the networks of buyers and sellers, we found different resilience regimes. Shocks tend to induce serious structural changes in the multiseller network, but impact the multibuyer network much less severely.

However, trading behaviour in DWM closely resembles what is observed on regulated online platforms despite their significant differences in operational and legal nature14. Nevertheless, due to their unregulated nature, DWMs exhibit behaviours not observed in regulated marketplaces. They offer anonymity to their users by using and developing specialized tools. DWMs are accessed through darknet browsers supporting the onion routing protocol (e.g., Tor), which provides anonymous communication connections35. Additionally, transactions are made with cryptocurrencies, mostly Bitcoin, which also provide anonymity to the transaction parties6,36.

Criteria for Choosing the Best Dark-Web Marketplaces

The market offers things like malware, fake documents, and financial fraud services. This market is not open to the general public and is subject to a thorough vetting process to ensure its security. In fact, WeTheNorth is more of a private club than an open market – something its operators want.

How to Prevent Phishing Attacks?

Due to its extensive inventory and reputation for reliability, Brian’s Club has maintained a significant presence on the dark web. Quality and validity of the data it provides justify its higher cost over other marketplaces. The platform’s popularity continues to grow, attracting both new and returning customers.

However, according to Chainalysis, the driving force of this revenue is a combination of increased competition and efforts by law enforcement to crack down on the markets themselves. According to Chainalysis’ 2025 Crypto Crime Report, darknet market (DNM) vendors are adapting their money laundering tactics. While centralized exchanges (CEXs) remain the dominant cash-out method, a notable shift has been toward decentralized finance (DeFi) protocols. The largest component of the S2S network of U2U transactions between sellers for each year with the respective number of nodes (N). The nodes are sellers that are active in that year, and an edge is placed between two sellers if at least one transaction occurs between them during that year. The network is mostly populated by U2U-only sellers, followed by market-only sellers.

A Chainalysis report finds that there are fewer darknet markets—but they’re growing in revenue.

Buyers often rely on reviews to choose vendors, even though no real identity checks or legal protections exist. To keep a closer eye on your personal information, you can use services like NordStellar’s dark web monitoring. This solution scans dark web forums to alert you if your data is being listed, traded, or otherwise exposed. The dark web alert system is designed to urge you to take action before any significant harm is done. Even if you’ve never visited these markets, your personal and financial data might already be there, having been leaked through a data breach. Criminals use this information for money laundering, opening bank accounts, applying for loans, and draining your finances.

However, compared to sellers, the drop is notably smaller, and the number of buyers rapidly recovers to previous values. Moreover, the number of multibuyers increases, which suggests a fast response from buyers to external shocks by trying to diversify their sources. With the advent of several markets at the beginning of 2014, the number of multisellers rapidly grows, representing more than 20% of all sellers until the beginning of 2016 (see Supplementary Information Section S3).

We developed Lunar to monitor the deep and dark web, including dark web marketplace sites. Dark markets include features similar to those found in legitimate e-commerce platforms, such as product listings, user reviews, ratings, and customer support. These features help create a sense of ‘trust’ among users, even in the criminal ecosystem. Treat category rosters and counts from tracker pages as indicative, not definitive.

Its catalog includes physical narcotics, digital goods, stolen accounts, and subscription bypass tools. The broad category mix positions Vortex as an entry-level market for general illicit trade. A public FBI/CISA advisory reports more than 21,000 infostealer-log listings darknet marketplaces 2026 across cybercriminal forums in a single quarter of 2024. This figure highlights the scale of log-driven access markets like Exodus. Torzon Market promotes stability and uptime, making it appealing during periods when other markets face outages or takedowns.

Two, casual buyers are making larger purchases in response to uncertainty. Darknet markets have surpassed their 2019 revenue this year with a month to spare, according to a report published by Chainalysis yesterday. Cointelegraph covers fintech, blockchain and Bitcoin bringing you the latest crypto news and analyses on the future of money. The list of sanctioned individuals linked to crypto includes the North Korean hacking group Kimsuky, crypto mixer Sinbad.io, Russian national Ekaterina Zhdanova and the Gaza-based MSB Buy Cash. Crypto inflows to sanctioned entities and jurisdictions comprised 61.5% of all illicit transaction volume, representing $14.9 billion in transaction volume in 2023. “Last year, DNM vendors sent a significantly higher portion of their funds to DeFi than they did historically,” the report read.

“They show an affluent lifestyle with expensive apartments, luxury brands, but with a touch of illicit intrigue.” Many of Telegram’s Russian drug bloggers are most likely sponsored by new darknet drug shops. They often wear clothes with shop logos and publish price lists and post links. However in December last year a Ukrainian-born hacker broke into the Solaris market’s crypto-wallets and donated $25,000 to a charity for Ukrainian refugees. On Friday the 13th of January, the WayAway team hacked Solaris, taking advantage of a weakness in its coding, and shut it down.