As Hydra did, many of these markets have continued the tradition of including drug harm reduction information for drug buyers, such as providing drug testing and medical advice. “The RuTor forum has launched a series of webinars on medical topics, including first aid and overdose scenarios,” said Aleksey Lakhov, of St. Petersburg-based drug project Drugmap.ru. But Russians fleeing the country since the war have still been able to buy drugs on the dark web. In Georgia, on its southern border, where more than 100,000 Russians have fled, there is Matanga, a local Russian-speaking darknet market offering the same “treasure hunt” buying system as back home. The report said Solaris, a platform which has since been hijacked by Kraken, had sent KillNet $50,000. On New Year’s Eve people in Moscow spotted what looked like an up-and-coming tech startup projecting its logo onto the sides of various buildings.

EquiLend Employee Data Breached After January Ransomware Attack

The classification is performed in five steps (see Fig. 1), as detailed next. Each marketplace is a star-graph where the central node is the marketplace, and the leaf nodes, i.e., the first-neighbors, are the marketplace users. Therefore, all transactions involving the market have the market either as a source or as a destination node.

Crypto Payments

Darknet markets are characterized by several key features that distinguish them from conventional online marketplaces. One of the most crucial elements is the use of escrow services, which protect both buyers and sellers during transactions. These services hold funds in escrow until the buyer confirms receipt of the goods, ensuring a level of security and trust in a largely unregulated environment.

What Is Predictive Threat Intelligence? How AI Helps Anticipate Cyber Threats

The number of market-U2U and market-only buyers also drops as a consequence of operation Bayonet. However, compared to sellers, the drop is notably smaller, and the number of buyers rapidly recovers to previous values. Moreover, the number of multibuyers increases, which suggests a fast response from buyers to external shocks by trying to diversify their sources. Over the last year, “Alex,” the drug dealer from Moscow, said a new genre of content has been growing on Russian Telegram profiles. As of October 2022, the largest volume of drugs purchased at two large marketplaces – BlackSprut and Mega – were for cathinones such as mephedrone and alpha-PVP.

Secure Your Cryptocurrency Transactions

This further complicates monitoring efforts because now you need to search for the related Telegram channels and track activity there and on the marketplace itself. Track and analyze darknet activities using our advanced cyber threat intelligence platform to stay ahead of emerging threats. An award-winning cybercrime threat intelligence firm, KELA’s mission is to provide 100% real, actionable intelligence on threats emerging from the cybercrime underground, to support the prevention of digital crimes. By consistently applying these straightforward security tips, you can significantly mitigate risks and better protect your privacy, finances, and legal standing when interacting with dark-web marketplaces.

A Chainalysis report finds that there are fewer darknet markets—but they’re growing in revenue.

The dark net’s layered encryption and routing protocols offer stronger anonymity, making onion sites appealing to whistleblowers, political dissidents, privacy advocates — and, inevitably, cybercriminals. The surge stems from weak local enforcement, widespread use of streamlined crypto payments, and a digital space valuing privacy. These factors allow vendors to avoid typical oversight while operating covertly online. Established in 2022, Torzon market is one of the biggest and most diverse marketplaces on the dark web. It is considered very secure thanks to strict user validations and transparent payment and vendor review procedures. Russian Market has consistently remained one of the most popular and valuable data stores on the dark web.

Stay up-to-date with KELA news and insights

However, emerging cryptocurrencies with even stronger privacy features are gaining traction, further solidifying the financial infrastructure of these markets. Another key innovation is the adoption of AI-driven recommendation systems, which analyze user behavior to suggest products and services tailored to individual preferences. This not only improves the shopping experience but also fosters a sense of community within the darknet ecosystem. One of the most notable developments is the integration of cryptocurrencies as the primary medium of exchange.

Are any dark web marketplaces safe to use?

Axis Intelligence provides dark web surveillance solutions that help businesses identify leaked credentials, fraud attempts, and malware risks before they escalate. Known for its publicity stunt releasing millions of stolen card details for free, BidenCash specializes in credit card fraud and identity theft. Registration was mandatory to access the Silk Road (like most darknet platforms). In 2013, the FBI shut down the Silk Road, but it was later relaunched in 2014 with the new name of Silk Road 2.0, but the German authorities shut it down in the same year. Other than the Silk Road 2.0, similar marketplaces also emerged, but they all went down sooner or later.

Security issues

This structural change is reflected in the median net income of sellers and buyers, as shown in Fig. While the curves for the seller and buyer median net income were negatively correlated before Silk Road’s shutdown, after that moment they became positively correlated. Specifically, sellers show a trend of increase and buyers a trend of decrease in their median net income before the shutdown.

FAQ – Dark Web Markets 2025 and Cybersecurity

• Axis Intelligence provides dark web surveillance solutions that help businesses identify leaked credentials, fraud attempts, and malware risks before they escalate.
• These «credential dumps» allow criminals to access online accounts, steal identities, and commit fraud.
• The technology behind the darknet is actively maintained and continues to evolve.
• It uses the Tor network because it is a popular network that helps to circumvent censorship and online surveillance.
• Registration was mandatory to access the Silk Road (like most darknet platforms).
• This makes them suitable for purchasing illicit goods and services without revealing the identities of users.

This information is then processed to generate an index of average prices for a broad range of specific products. We do not engage with darknet markets; our mission is exclusively dedicated to providing information for research and educational purposes. Cryptocurrencies continue to play a pivotal role, with Monero and Bitcoin remaining the preferred payment methods due to their anonymity and global accessibility.

Following stricter bans on Telegram channels hosting cybercriminals, experts predict a resurgence of activity on dark web forums. Contrary to predictions, the market for cryptocurrency “cleaning” services, or Bitcoin mixers, stagnated. The competitive landscape remained unchanged, with no significant innovations reported. Black traffic schemes—malicious landing pages promoted via deceptive ads—remained a constant threat. These schemes leveraged mainstream ad platforms to distribute malware to unsuspecting users.

Malicious vendors often infect buyers with spyware, ransomware, or infostealer malware hidden in downloadable files. Some listings are nothing more than scams designed to trick people into sending cryptocurrency without delivering anything in return. Darknet marketplaces may look like regular online stores, but using or even browsing them comes with serious risks.

The crypto industry continues to suffer from cybercrimes, with darknet markets being one of the two categories showing an increase in revenue in 2023, according to the latest report from blockchain analysis firm Chainalysis. In response, darknet market vendors are increasingly shifting their financial activity toward decentralized platforms. Alright, let’s get into the meat of it—the darknet markets that are ruling 2025. I’ve been poking around these places for a while now, from the giants like Abacus to the old-timers like Vice City.

• According to Chainalysis, the total number of active markets in November 2020 (37) is the lowest total seen since November 2017.
• This technology initially had noble intentions, aiming to protect activists, whistleblowers, and individuals in repressive regimes.
• The TRM Labs report also revealed that crypto use in vendor shop drug sales more than doubled in 2024, reaching over $600 million in volume.
• WeTheNorth, valued at approximately $3 million, lists over 9,000 products for users.
• The top performers in darknet marketplaces for 2025, excelling in trade volume, vendor ratings, and market influence.
• As these marketplaces keep changing, it is critical to stay on top of the main platforms on the dark web worth monitoring.

The platform’s success was reflected in its growing market dominance, rising from 10% market share in 2022 to over 70% in 2024. Welcome to this collection of darknet resources, curated exclusively for educational and informational purposes. This repository serves as a knowledge hub for individuals interested in understanding the structure, functionalities, and applications of the darknet. Please note that all material provided here is aimed at promoting awareness, responsible research, and ethical use of information.

Search code, repositories, users, issues, pull requests…

They take BTC and Monero, and the site’s got a sharp, modern look—vendor profiles are loaded with ratings and reviews, easy to skim. What’s dope is their forums—real talk, not just noise—building trust like Telegram’s side hustle vibe. For 2025, they’re hyping a peer-to-peer escrow twist—could cut out middlemen and shake up how deals flow, which I’m stoked to see play out.

• This encryption makes attribution and tracking more difficult for authorities and cybersecurity professionals.
• Beyond traditional offerings, these platforms now provide access to a wide array of digital goods, including software, e-books, and even consulting services.
• Throughout the whole period of observation, the dominant category of buyers is market-U2U buyers followed by market-only buyers, representing on average 52% and 42% of all buyers, respectively.
• Public threat‑intel places its launch in 2021 and notes a design and workflow similar to mainstream DNMs.
• ProPublica is an investigative news site owned by an independent nonprofit that exposes abuses of power and corruption.
• All numbers are rounded; darknet telemetry is noisy and markets change weekly.
• Over time, ambitious individuals created infrastructure for these transactions, where for a fee, sellers have access to a digital ‘storefront’ to sell their products in a centralized marketplace.

These advancements have not only enhanced accessibility but also improved the overall user experience, making secure online trade more efficient and reliable. Below are 2025’s leading darknet markets, ranked by listings, trade volume, and vendor reliability. Each offers unique strengths in cryptocurrency trading and escrow security—essential for navigating the onion network.

Key Takeaways

Overall, our study provides a first step towards a better microscopic characterisation of the DWM ecosystem, indicating a direction of investigation that may be of interest to both researchers and law enforcement agencies. The results further support the recent efforts of law enforcement agencies to focus on individual sellers43,44,45, darknet markets 2026 as well as, more recently, also buyers46,47. Since the beginning of DWMs’ activity, there has been a shift in the law enforcement approach from focusing on market admins towards sellers and buyers9,13. For instance, a recent London Metropolitan Police (MET) investigation examined the transactions of a seller profile on a DWM10.

They are followed by market-U2U sellers, then market-only sellers, and lastly U2U-only sellers. Therefore, although larger in number, U2U-only sellers typically make the smallest income. This suggests that sellers with more diverse sources of income, such as multisellers and market-U2U sellers, are able to produce a higher income. Additionally, we observe that, except for U2U-only sellers, the median income of the other types of sellers drops after the major shock caused by operation Bayonet (see Supplementary Information Section S4). The most affected are multisellers, with a drop of 78% in the median income, followed by market-U2U and market-only sellers, with a drop of 59% and 47%, respectively. Although these three types of sellers are significantly affected, they recover and surpass the median income value they had before Bayonet (see Fig. 4c; Supplementary Information Section S4).

• This includes purchases such as malicious software and supporting services which cybercriminals sometimes make using escrow services on crime forums.
• This not only helps protect your identity but also contributes to your overall cybersecurity in the digital age.
• We find that the dominance of markets is reflected in trading properties of buyers and sellers.
• Use Norton VPN to encrypt the data you send and receive and surf more anonymously.
• Many people also prefer to buy goods and services online, which allows for more opportunities to steal people’s personal data and financial information.
• At CloudSEK, we combine the power of Cyber Intelligence, Brand Monitoring, Attack Surface Monitoring, Infrastructure Monitoring and Supply Chain Intelligence to give context to our customers’ digital risks.
• In the first 24 hours of launching Check your hack, two million people took advantage of the service.

The sale of counterfeit items highlights the diverse nature of illicit activities on the dark web, catering to a wide range of criminal enterprises. Commonly traded substances include heroin, cocaine, methamphetamine, and ecstasy, with a noticeable increase in the availability of synthetic drugs marketed as legal alternatives to controlled substances. The persistent demand for these illegal drugs underscores the ongoing challenges faced by law enforcement agencies in curbing the illicit drug trade on the dark web. These platforms offer a wide variety of drug listings, often organized by categories such as stimulants, depressants, and hallucinogens.

The availability of such services underscores the ongoing threat posed by cybercriminals operating on these platforms. The market’s diverse product range and secure transaction methods have made it a prominent player in the darknet market ecosystem. As we move through 2025, WeTheNorth continues to be a crucial platform for dark web users. Cypher Marketplace’s extensive product listings and secure transaction methods have made it a popular destination for dark web users. Its continued growth and prominence in the darknet market ecosystem highlight its importance in 2025.

The story of dark web markets began with the Silk Road, the pioneering platform that set the stage for future darknet marketplaces. Operating until 2012, Silk Road’s estimated annual revenue soared over $100 million, highlighting the potential profitability of these hidden markets. By late 2014, Evolution had risen to prominence as one of the largest drug markets on the dark web, capitalizing on the offline status of competitors following Operation Onymous. Darknet markets are online platforms for the anonymous buying and selling of illegal goods and services. Operating in the hidden parts of the internet, these markets largely rely on cryptocurrencies. In this article, you’ll discover the key players in 2025, how they operate, their histories, and the risks involved.

However, according to Chainalysis, the driving force of this revenue is a combination of increased competition and efforts by law enforcement to crack down on the markets themselves. Throughout the whole period of observation, the dominant category of buyers is market-U2U buyers followed by market-only buyers, representing on average 52% and 42% of all buyers, respectively. The U2U-only category is comparatively small, representing only 6% of all buyers on average.

We believe that advances in artificial intelligence can provide law enforcement agencies, financial institutions, and others with information needed to prevent stolen data from being used to commit fraud. This could stop the flow of stolen data through the supply chain and disrupt the underground economy that profits from your personal data. The median net income is positive for sellers while negative for buyers throughout the whole period of observation. In fact, when we compute the total net income for each seller, a considerable fraction (16%) has a negative net income because they spend in markets where they are not classified as sellers, or in the U2U network.

Torrez Market

Darknet marketplaces are commercial websites accessed by an encrypted browser which operate on the dark web, functioning primarily as black markets for illegal activity or substances. The fact they were being advertised so publicly in Moscow was slightly bizarre. This shift will likely drive forum operators to introduce features like automated escrow services and enhanced anonymity to attract users. The dark web hosts a wide range of sites — from whistleblower dark web markets tools and secure email platforms to underground forums, black markets, and dark web mirrors of legitimate news outlets. We pulled six months of uptime data from open monitoring relays, read 2 400+ recent user comments on three invite-only forums, and tested each site with a clean Tor setup to check speed, PGP workflow and dispute flow. Longevity, code reuse and past exit-scam history are factored in, but we weigh present behaviour more heavily.

Enhancing Darknet Trade with Tor Integration and User-Friendly Design

The browser uses onion routing technology to route the internet traffic through multiple relay nodes that provide layered encryption. The goal is understanding ecosystem behavior, not validating or promoting marketplace activity. Transaction trends and cryptocurrency movement patterns are analyzed at a high level. These signals help identify laundering activity and operational stress without engaging directly. Access is semi-private, and membership is restricted to reputation-verified users.

Cryptocurrency

It issued a press release revealing that, from December 2021, the website will no longer be functional. DarkOde Reborn is a great darknet market where you can find anything you want. The website has a great design and a clean and organized interface that is easy to use. The homepage includes options like browsing products, searching, mixer, and coin exchange. However, the website has some security risks, and users experience glitches.

TorShop Mart

Its main inventory includes corporate credentials, system logs, RDP access points, and internal network data. These assets are often used as initial entry points for ransomware operations. Marketplaces are hosted on hidden services that conceal server locations and user identities. BidenCash and other exit-scam markets such as Torzon and Kingdom Market collapsed between 2022 and 2024.

Dark web reveals tech companies leak most user data

The dark web is only accessible through specific software like Tor (The Onion Router). Also, while this huge portion of the internet has a reputation as home to nefarious activities like hacking and drug trafficking, it also harbors legitimate activities like journalists and whistleblowers. The U2U network is formed by the entire set of interacting users (black and gray arrows with their respective users). Using the evolving activity-driven model31, U2U pairs are divided in either stable (black arrows and respective users) or non-stable (gray arrows and respective users). Plotted lines indicate the median value while bands represent the 95% confidence interval. Negative and positive numbers indicate the days prior and after the closure, respectively.

Financial Tracking

An intuitive, user-friendly interface is crucial, especially given the complex nature of dark-web interactions. Users favor marketplaces with straightforward navigation, efficient search functions, and clear product categorizations. The ability to seamlessly communicate with vendors via secure messaging systems also greatly improves overall user experience. Transactions within these marketplaces typically leverage cryptocurrencies—most commonly Monero, Bitcoin, and privacy-centric digital currencies developed specifically to enhance transaction anonymity. Monero, in particular, has become the preferred cryptocurrency on the dark web in 2026 due to its advanced privacy mechanisms, which obscure transaction histories and wallet balances from public view. Known for its publicity stunt releasing millions of stolen card details for free, BidenCash specializes in credit card fraud and identity theft.

Niche Trends and Ecosystem Shifts

In Georgia, on its southern border, where more than 100,000 Russians have fled, there is Matanga, a local Russian-speaking darknet market offering the same “treasure hunt” buying system as back home. The report said Solaris, a platform which has since been hijacked by Kraken, had sent KillNet $50,000. On New Year’s Eve people in Moscow spotted what looked like an up-and-coming tech startup projecting its logo onto the sides of various buildings. But in fact it was a guerrilla marketing stunt promoting OMG, a darknet marketplace selling heroin, mephedrone, marijuana, and everything else in between. Unlike competitors such as Archetyp, DrugHub, ASAP Market, and Incognito Market, Abacus’s technical architecture allowed for more sophisticated payment processing and escrow services. All content in this repository is published solely for educational use and is intended to promote ethical research and knowledge.

Use cryptocurrency for transactions

Therefore, you must know how to access dark web marketplaces safely (covered later in this article). Dark web marketplaces are online markets that exist on hidden networks and cannot be accessed through regular browsers. They are used to trade illegal goods and services while keeping user identities concealed.

Secure Tor Access

At the time, it had over 600,000 users, 17,000 listings, and approximately €250 million in transactions. Authorities seized €7.8 million and arrested operators in Germany, Spain, Sweden, Romania, the Netherlands, and the US Europol leads takedown of Archetyp. These listings often include detailed descriptions, user reviews, and even shipping guarantees. One of the most common types of illicit goods is stolen login credentials, often collected from data breaches. These «credential dumps» allow criminals to access online accounts, steal identities, and commit fraud.

Top Darknet Marketplaces

At CloudSEK, we combine the power of Cyber Intelligence, Brand Monitoring, Attack Surface Monitoring, Infrastructure Monitoring and Supply Chain Intelligence to give context to our customers’ digital risks. Dark web marketplaces discussed in 2026 are best understood as temporary systems shaped by pressure, not permanence. Their repeated rise and collapse reflect enforcement advances, trust failures, and structural weaknesses rather than innovation or stability. Government of Canada reporting confirms that traffickers use both the surface web and dark web to sell drugs delivered by mail or courier. The same reports highlight gaps in the national ability to measure the full scale of this activity.

• Dark markets continually adapt and evolve to stay ahead of law enforcement and security measures.
• Darknet marketplaces in 2025 illustrate a resilient and evolving underground economy.
• To do this, we first identified 30 darknet markets advertising stolen data products.
• Meanwhile, retail vendors, who operate on a smaller scale, are holding more of their illicit earnings in personal wallets, delaying conversion to fiat to avoid detection.
• Besides this, it supports wallet-less transactions and accepts payments through Bitcoin, Litecoin, Monero, and Zcash.
• One could end up with their details being used to open accounts on various pornographic websites or cryptocurrency trading sites.

If the address is in one of the cybercrime datasets, the person will receive an email that includes personalized instructions on how to clean up their computer and make it safe again. In the first 24 hours of launching Check your hack, two million people took advantage of the service. So far, five million people have used the tool, and over 13,000 victims have been notified that their computer was infected, and received instructions to help them make their device safe again. Fentanyl and fentanyl-laced drugs also arrive in the United States through Latin America based cartels.

Transaction analysis and operational mistakes can still link activity to real individuals. Past behavior is used to assess credibility, including uptime history, prior shutdowns, and administrator actions. User messages, order histories, and account data are frequently stored without protection. Funds can be lost instantly through exit scams, frozen escrow wallets, or sudden marketplace shutdowns.

The future of darknet trade looks promising, with ongoing advancements poised to further enhance the user experience. In conclusion, the darknet ecosystem continues to evolve, driven by technological advancements and the growing demand for secure online trade. As these markets become more sophisticated, they offer users a reliable and efficient platform for conducting transactions, solidifying their position as a cornerstone of the digital economy. When it comes to cybercriminal enablement, markets like Kraken Market, the DNM Aggregator, and Exploit.in are go-to services, providing bad actors with tools to carry out ransomware attacks, hacks, and more. Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products. In addition to that activity, markets like these host vendors that advertise their own cashout or swapping services, resulting in tens of millions of dollars in laundered funds.

• In many places, including the U.S., the UK, and the EU, accessing the dark web is legal for legitimate purposes.
• Malware can compromise systems running on various operating systems, including Microsoft Windows and Android.
• Therefore, you need to start by changing your passwords, and you need to notify your credit card or bank provider.
• Valued at approximately $15 million, Abacus Market is one of the most lucrative platforms in the dark web ecosystem.
• Beginning in September 2021, Abacus Market has established itself as one of the leading dark web marketplaces.
• In 2020, a total of 6778 pairs of users in stable pairs met inside a DWM, corresponding to 192% of the 2019 level and to 255% of the 2018 level, see Fig.
• The trading volume generated by stable pairs is more than five times larger than that of non-stable pairs13.
• Much like with drug sales, a similar pattern of task differentiation emerged among darknet markets providing cybercriminal services.

Darknet is your best source for the latest hacking tools, hacker news, cyber security best practices, ethical hacking & pen-testing. Darknet markets operate within this hidden space, often hosting illegal activity, while the deep web primarily consists of everyday private or password-protected content. For instance, buying fake documents may indirectly support larger operations involving trafficking, extortion, or organized crime.

Top 7 Dark Web Marketplaces Of 2026

This has led to the emergence of specialized markets that focus on niche products, further diversifying the ecosystem. Abacus Market stands out with 35,000+ listings and $5 million in monthly cryptocurrency trades via Bitcoin (BTC) and Monero (XMR). Serving 15,000+ users and 1,200+ vendors, it holds an 8% share of darknet drug trading. Known for its robust escrow security and diverse offerings, Abacus is a top choice for 2025. These darknet markets are difficult to disrupt directly, but efforts to thwart customers of stolen data from using it offers some hope.

• Many «trusted» sellers use fake reviews or steal reputations from shutdown markets.
• From drug sales and breached data to scam services and malware, dark web markets are some of the most dangerous corners of the internet.
• Catharsis Market is described by community trackers as an active, general-purpose darknet marketplace with a strong focus on narcotics and other illicit goods.
• The arrest of Durov heightened fears that Telegram would start cooperating with authorities, forcing vendors to find new places to operate.
• We then identify stable U2U trading relationships, which represent a subset of persistent pairs in our dataset31,32 forming the backbone of the U2U network.
• Major active platforms include Abacus, Russian Market, BriansClub, and Exodus.
• However, owing to the difficulty of identifying relevant transactions, most studies rely on user surveys17,18 and data scraped from DWM websites19,20,21,22,23,24.

Threat actors may also manipulate old or publicly available data to generate hype and damage reputations. The arrest followed an extensive investigation by the Central Office for Combating Internet Crime (ZIT), which tracked the platform’s operations across multiple jurisdictions. Exploring the dark web can be eye-opening, but it’s also risky without the right protection. While the Tor browser boosts privacy, pairing it with a VPN adds a critical layer of security.

Two, casual buyers are making larger purchases in response to uncertainty. Darknet markets have surpassed their 2019 revenue this year with a month to spare, according to a report published by Chainalysis yesterday. Cointelegraph covers fintech, blockchain and Bitcoin bringing you the latest crypto news and analyses on the future of money. The list of sanctioned individuals linked to crypto includes the North Korean hacking group Kimsuky, crypto mixer Sinbad.io, Russian national Ekaterina Zhdanova and the Gaza-based MSB Buy Cash. Crypto inflows to sanctioned entities and jurisdictions comprised 61.5% of all illicit transaction volume, representing $14.9 billion in transaction volume in 2023. “Last year, DNM vendors sent a significantly higher portion of their funds to DeFi than they did historically,” the report read.

While market dynamics may have shifted since, the cited data illustrates how cartels had previously exploited crypto ecosystems. The TRM Labs report also revealed that crypto use in vendor shop drug sales more than doubled in 2024, reaching over $600 million in volume. The findings by TRM Labs align with other investigations into the intersection of cryptocurrency and the drug trade. TRM Labs found that only four Russian-language marketplaces exited the ecosystem in 2024, out of approximately 20 operating during the year.

The website utilizes a valid SSL certificate issued by Google Trust Services, expiring in 2026, indicating basic encryption and identity verification. Hosted in Canada and utilizing Cloudflare suggests efforts to improve performance and potentially mitigate DDoS attacks. A significant positive signal is that Google Safe Browsing reports the domain as clean, indicating no detected malware or phishing attempts. This is a strong indicator that Google does not currently see the website as malicious. It uses ring signatures and stealth addresses to obscure transaction details.

That prevents small dealers from participating in the market and a natural tendency towards fewer but larger dealers on those markets,” Fiedler told Decrypt. These numbers show that darknet customers are making fewer purchases in total, but these purchases are, on average, for larger amounts. All sponsored and commercial content, including press releases, is clearly labeled and reviewed for accuracy, disclosure and compliance. All news, reviews, and analysis are produced with full journalistic independence and integrity.

Likewise, law enforcement agencies each day continue to fine-tune their strategies to get past these networks. The first thing on the minds of many users when it comes to the dark web environment is illegal drugs. In fact, the Guardian referred to darknet markets as “the eBay of drug dealing,” and rightly so, illegal drugs are found in almost all the shops on the dark web. The raw dataset consists in transactions between Bitcoin addresses, which is initially preprocessed by Chainalysis Inc. (see Section S2). The resulting dataset consists in transactions between entities, that group together clusters of Bitcoin addresses.

This list is not exhaustive, and there are many more types of onion sites on the dark net, including websites offering fraud services, botnet panels, file repositories for pirated media, forums for extremist groups, and more. Telegram, once a popular platform for selling drugs due to its security and perception of non-cooperation with law enforcement, saw many of its drug vendors migrate to alternative platforms like Signal, Session, and WhatsApp. A new report published by blockchain forensic firm TRM Labs in early 2025 outlined a major rise in crypto-fueled drug sales throughout 2024, driven largely by Russian-language darknet marketplaces. Official-torzon.markets claims to be the official gateway to the «Torzon Market,» providing links, PGP verification information, and a Tor Browser guide.

Businesses should be aware of the potential for data leaks and invest in data loss prevention measures. As of September 2025, public trackers mark it closed, underscoring the sector’s churn amid phishing/DDoS and sustained law‑enforcement pressure. And beware—while many explore out of curiosity or for research purposes, it’s important to remember that engaging with these platforms, even as an observer, can lead to serious legal and ethical consequences. Having JavaScript enabled on the dark web can cause havoc because it can reveal your IP address to your website.

Our work unveils sophisticated patterns of trade emerging in the dark web and highlights the importance of investigating user behaviour beyond the immediate buyer-seller network on a single marketplace. Today, darknets are populated by a vast array of users, ranging from privacy-conscious individuals to cybercriminals, hacktivists, and nation-state actors. These hidden networks provide a platform for illegal activities that include the sale of stolen data, hacking tools, weapons, counterfeit currency, and narcotics. Dark markets, often accessed through specialized marketplaces within darknets, are breeding grounds for underground economies, where users can engage in transactions while evading law enforcement and ethical oversight. The goods on sale range from stolen credit card data and forged documents to illegal drugs, weapons, malware as a service, and hacking tools.

The vendors aren’t required to register or apply for a vendor account while using this platform. It ensures the buyer’s identity is kept hidden and accepts payments through cryptocurrencies, including Bitcoin, Litecoin, Ethereum, and Monero. Different reports rank marketplaces based on varying criteria such as time period, transaction volume, or investigative relevance.

Use Norton VPN to encrypt the data you send and receive and surf more anonymously. Administrator and prolific vendor Gal Vallerius was arrested in August 2017. These aren’t distant problems—they are immediate, and they affect public safety, financial systems, and global cooperation. According to a 2024 report citing unsealed court documents, USDT was widely available in Mexico at a discount, allowing resellers to profit in countries like Colombia. The arrest of Durov heightened fears that Telegram would start cooperating with authorities, forcing vendors to find new places to operate. Nexus opened in late-2023 after the Fall of Bohemia and quickly absorbed many of that community’s well-rated vendors.

The total trading volume users sent to DWMs was $3.8 billion, volume received from DWMs was $3.7 billion, while the volume exchanged through U2U pairs reached $30 billion. In Figure S3, we illustrate the number of transactions, trading volume, and lifespan of U2U pairs. (a) Total number of users interacting with a DWM against the total number of users forming U2U transactions. (b) Trading volume in dollars sent to a DWM compared with the total trading volume in its surrounding U2U transactions. The dashed line is the bisector and allows to easily compare the two trading volumes. (c) Total monthly trading volume sent to all DWMs and exchanged in all unique U2U pairs.

The use of escrow systems and reputation-based feedback mechanisms has fostered trust among users, ensuring a smooth trading experience. As a result, darknet markets have become a hub for innovation, with new features and services being introduced regularly to meet the evolving needs of the community. Dark markets are online platforms on the darknet where illegal goods and services are traded.