Users in such stable pairs turn out to be the ones with the largest trading volume on DWMs. Then, we show that new U2U pairs often form while both users are active on the same DWM, suggesting the marketplace may serve as a catalyst for new direct trading relationships. Finally, we reveal that stable U2U pairs tend to survive DWM closures and that they were not affected by COVID-19, indicating that their trading activity is resilient to external shocks. Our work unveils sophisticated patterns of trade emerging in the dark web and highlights the importance of investigating user behaviour beyond the immediate buyer-seller network on a single marketplace. The goods on sale range from stolen credit card data and forged documents to illegal drugs, weapons, malware as a service, and hacking tools.

How to gain safe access to the Dark Web marketplaces

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries. To support open access to our website and sustain editorial operations, certain commercial or partner references may appear on our site. These arrangements help maintain an accessible platform and do not result in additional costs to readers. Jardine also emphasized the importance of using services that actively emphasize security in the decentralized finance space. “Good digital hygiene, especially in terms of password and seed phrase management, is also crucial,” he said. The report did, however, present some more positive figures, including a year-over-year decline in revenue from crypto-based scams.

Verify Onion Links

• Further supporting this interpretation, we observe that the trading volume of the U2U network increases after Bayonet, while the trading volume of markets decreases (see Supplementary Information Section S4).
• Launched in 2020, Cypher Marketplace sells fraudulent documents, stolen credit cards, fake IDs, and malware.
• The classification is performed in five steps (see Fig. 1), as detailed next.
• The structural change seen in the multiseller network is not observed in the multibuyer network, as show in Fig.

In the first 24 hours of launching Check your hack, two million people took advantage of the service. So far, five million people have used the tool, and over 13,000 victims have been notified that their computer was infected, and received instructions to help them make their device safe again. Fentanyl and fentanyl-laced drugs also arrive in the United States through Latin America based cartels. U.S. customers predominantly purchase drugs from these groups that are known to have used crypto to source fentanyl precursor chemicals from labs based in China. The cartels then use those chemicals to manufacture fentanyl that is later sold in the U.S.

Multiseller network

Use Tor Browser from torproject.org for safe onion routing—update regularly. Fill out the form to speak with our team about investigative professional services. All sponsored and commercial content, including press releases, is clearly labeled and reviewed for accuracy, disclosure and compliance. All news, reviews, and analysis are produced with full journalistic independence and integrity.

SecureDrop

Unlike many other platforms, Evolution allowed for the wholesale trading of stolen credit card information, further diversifying the types of illicit goods available. The period between late 2013 and 2014 saw a flurry of activity, with the launch of successors like Silk Road 2.0 and Agora, alongside the takedown of various other markets. To do this, we first identified 30 darknet markets advertising stolen data products. Significant technological innovations and trends have reshaped dark-web marketplaces over recent years.

Security issues

Expect future trends in darknet markets to be shaped by advancements in encryption, the rise of decentralized platforms, and increased use of cryptocurrencies, enhancing anonymity and security for users. The sale of stolen data, including personal identification information (PII) and credit card details, plays a significant role in the illicit economy of the darknet. This stolen information is often used to commit various types of fraud, highlighting the interconnected nature of cybercrime on these platforms. Our research details a thriving underground economy and illicit supply chain enabled by darknet markets.

Security & Privacy Model (sector context)

Whilst a great many products are sold, drugs dominate the numbers of listings, with the drugs including cannabis, MDMA, modafinil,[107][108][109] LSD, cocaine, and designer drugs. The months and years after Silk Road’s closure were marked by a greatly increased number of shorter-lived markets as well as semi-regular law enforcement takedowns, hacks, scams and voluntary closures. Despite using a VPN, there’s always a risk of the VPN leaking your IP address through DNS or WebRTC leaks or misconfigurations when on a dark web forum or marketplace. Therefore, you must run an IP leak test to ensure that the VPN is working completely fine and is not risking your digital security. The website has a sleek design and interactive user interface, making it the most preferred choice in terms of user experience.

Tweak Tor browser settings

If you’re into a darknet market with a community pulse and solid uptime, Bohemia Dark Market’s climbing the ranks—give it a spin if you like a vibe that’s less corporate, more crew. In contrast to the other types of sellers, the median income of U2U-only sellers increases after operation Bayonet. Moreover, we observe a trend of increase in their median income relative to the value before operation Bayonet—an increase of almost six times by the end of the period of observation (see Supplementary Information S4).

Russian market

To access them, copy and paste the hyperlinks provided into the Tor browser. On the dark web, traffic is routed through multiple server nodes that don’t log activity, obscuring the user’s origin and enabling anonymous communication. While market dynamics may have shifted since, the cited data illustrates how cartels had previously exploited crypto ecosystems.

Insights and caveats from mining local and global temporal motifs in cryptocurrency transaction networks

WeTheNorth, often abbreviated as WTN, was launched to fill the void left by a previous Canadian market and has since grown steadily. By 2025, it serves not just Canada but also international buyers, though it retains a distinctly Canadian character in terms of vendors, products, and even language supporting both English and French. By 2025, STYX is a rising star in the underground, not as large as the big drug markets, but highly respected among fraudsters for its exclusive offerings and security measures.

Darknet market revenues rose slightly, but have yet to regain Hydra Marketplace highs

Launched after the takedown of AlphaBay in 2021, Abacus Market has rapidly risen to prominence. It features over 40,000 listings including narcotics, counterfeit items, hacking tools, and stolen data. The marketplace is well-known for its bug bounty programs and robust security mechanisms, including mandatory 2FA. Nemesis Market is a relatively new wallet-less shop on the dark web where you don’t need to deposit any amount in your wallet before buying products from here. The platform allows buyers to review the vendor’s products and services, so it’s easy for them to decide if the vendor is reputable or just scamming them. You can see all the product categories the marketplace deals with on the homepage.

As of April 22, 2025, open‑source monitoring counted 9,000+ listings across drugs, fraud, counterfeit documents, malware, and “how‑to” guides. The site emphasizes on‑platform interactions and cryptocurrency settlement. Catharsis Market is described by community trackers as an active, general-purpose darknet marketplace with a strong focus on narcotics and other illicit goods. It operates on the Tor network and, according to self-reported claims, supports Bitcoin, Monero, and Litecoin. Users frequently highlight its emphasis on continuity with older markets by allowing vendors to migrate reputations and listings—an increasingly common feature among newer DNMs. Ideal marketplaces support anonymous browsing through networks like Tor and I2P, utilize privacy-focused cryptocurrencies such as Monero, and implement measures to prevent tracking and transaction tracing.

The ongoing move toward decentralized platforms suggests the crypto drug ecosystem will remain fluid, creating new enforcement challenges. Last month, blockchain analytics firm Chainalysis uncovered direct financial ties between Mexican drug cartels and Chinese suppliers of fentanyl precursors through crypto transactions. While the SSL certificate and clean Google Safe Browsing status are positive, the connection to a darknet market (even as a gateway) inherently increases risk. Gateways to such markets are often targets for phishing or may distribute inaccurate information. As of September 2025, public trackers mark it closed, underscoring the sector’s churn amid phishing/DDoS and sustained law‑enforcement pressure. Nexus Market is widely described as a second‑generation, general‑purpose dark‑web marketplace that gained traction through 2024–2025.

As law enforcement agencies’ tactics improve, some markets respond by introducing more security features, like mandatory encryption or invite-only access. But no matter how polished or professional these sites seem, the risk of getting scammed — or tracked — is always high. During the second half of 2022, law enforcement cracked down on a large number of darknet markets, temporarily disrupting the supply of such illicit goods. The results of that investigation were published in a report called Technical analysis of the Genesis Market.

Hacking groups and services

Silk Road, which emerged in 2011, combined TOR and bitcoin to become the first known darknet market. The market was eventually seized in 2013, and the founder, Ross Ulbricht, was sentenced to two life sentences plus 40 years without the possibility of parole. Ulbricht’s hefty prison sentence did not appear to have the intended deterrent effect. Multiple markets emerged to fill the void and, in doing so, created a thriving ecosystem profiting from stolen personal data.

Key Goods and Services Offered

The Torrez market is one of the biggest dark net marketplaces, also called a community-driven marketplace. It contains a good selection of product listings that range over 35,000 items. It uses PGP encryption, two-factor authentication, and OPTP authentication to ensure users’ security. Vice City Market is a new and cutting-edge dark web marketplace where you can find a range of products and vendors at an affordable price (compared to the damage they do to the victims). To access this marketplace, you must register, but before that, you must verify yourself as a human by passing a CAPTCHA test.

The dangers of darknet marketplaces

• The project’s marketing leans heavily on “security/education” messaging, aligning with its privacy‑coin‑only stance.
• The trading volume generated by stable pairs is more than five times larger than that of non-stable pairs13.
• Latest updates from the darknet trading world as of February 2025—key shifts and developments.
• Monitoring dark web markets is crucial, no matter if you are a business or an individual, as you can then proactively identify and mitigate potential breaches and cyber threats.
• Kaspersky report states, Last year, the underground market for cryptors—tools used by cybercriminals to obfuscate malicious code and evade detection—grew significantly.
• The platform also advertises user‑engagement features such as a raffle and paid account upgrades for expanded functionality.
• This indicates that hacking such accounts still remains extremely profitable.
• These range from luxury products, such as designer handbags and apparel, to fake identification documents.

The horizontal bars represent each market lifetime, i.e., the time when the market becomes active until its closure, and is colored according to the market’s monthly trading volume in USD. In the vertical axis, markets are in the chronological order of their launch date, although for some markets the activity effectively starts after the launch date (e.g., AlphaBay). Buyers simultaneously active on multiple markets also play the role of connectors in the ecosystem.

These platforms have streamlined navigation, making it easier for users to access products, communicate with vendors, and complete transactions. For instance, markets like AlphaBay and Hansa have set benchmarks in terms of design and functionality, offering features such as escrow services, vendor ratings, and dispute resolution mechanisms. Alphabay Market leads with 60,000+ listings and $20 million in monthly trades via BTC and darknet markets links XMR, dominating 20% of darknet marketplaces. With 25,000+ users and 3,000+ vendors, it’s the gold standard for escrow security and scale. The main types of goods and services on darknet markets include illicit drugs, stolen data, hacking tools, and counterfeit items. One of the most significant threats is the prevalence of fraudulent services, including fake vendor shops, unreliable gun stores, and fake assassination websites.

The vendors aren’t required to register or apply for a vendor account while using this platform. It ensures the buyer’s identity is kept hidden and accepts payments through cryptocurrencies, including Bitcoin, Litecoin, Ethereum, and Monero. Its builders created it from the ground up to offer a “cleaner” and more organized shopping experience than most.

From digital goods to pharmaceuticals, these markets cater to diverse needs, all while maintaining a high standard of security and anonymity. The future of darknet trade looks promising, with ongoing advancements poised to further enhance the user experience. The raw dataset consists in transactions between Bitcoin addresses, which is initially preprocessed by Chainalysis Inc. (see Section S2). The resulting dataset consists in transactions between entities, that group together clusters of Bitcoin addresses. Namely, we consider transactions made by the 40 entities representing the 40 DWMs under consideration, which directly interact with more than 16 million other entities, who are the users of these DWMs.

• Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing.
• Plotted lines indicate the median value while bands represent the 95% confidence interval.
• It added that many fraud shops are increasingly offering third-party crypto-payment processors like UAPS via API calls, as a way to reduce their own costs, improve operational efficiency and increase security.
• Over the past decade, it has built a reputation as a reliable source for huge volumes of credit cards and personal data.
• Even though DuckDuckGo is the Tor browser’s default search engine, it doesn’t index dark web websites, which means you won’t be able to find .onion sites with it.

Miklos has long-time experience in cybersecurity and data privacy having worked with international teams for more than 10 years in projects involving penetration testing, network security and cryptography. Every location where personal data is stored is a potential target for cybercriminals. Here are some methods to thwart unauthorized access to your data repositories. One could end up with their details being used to open accounts on various pornographic websites or cryptocurrency trading sites. In one particularly devastating case, a man lost his entire $80,000 pension. Using his credentials, cybercriminals committed a variety of online fraud activity over the course of six months.

Trackers note that, like several modern markets, Catharsis claims to prohibit highly harmful or reputationally damaging categories (e.g., explicit abuse material, certain forms of violence-related content). Such bans can influence users’ trust perceptions but do not mitigate the inherent risks of illicit-market environments. Although some of these markets prohibit certain extreme content such as violence or exploitation, most operate with very few rules beyond ensuring the security and anonymity of their users. Because it’s newer, some users were initially wary new markets can be scams, but TorZon proved itself by not exit scamming during its first year and by implementing community friendly features. Overall, WeTheNorth’s security approach is about building a walled garden, a somewhat self contained community where people follow the rules or get kicked out. By not tolerating the most dangerous illicit goods and by ensuring members are vetted and accounts secured, WTN fosters a kind of fragile trust on an anonymous network.

Darknet markets are online platforms for the anonymous buying and selling of illegal goods and services. Operating in the hidden parts of the internet, these markets largely rely on cryptocurrencies. In this article, you’ll discover the key players in 2025, how they operate, their histories, and the risks involved. In total, there were 2,158 vendors who advertised at least one of the 96,672 product listings across the 30 marketplaces. On average, marketplaces had 109 unique vendor aliases and 3,222 product listings related to stolen data products.

In fact, Tor usage remains high in 2023 the dark web averaged about 2.7 million daily users, with Germany overtaking the U.S. as the country with the most Tor users. A dark web search engine like DuckDuckGo offers impressive anonymity features and makes it easy to access the shops. These search engines neither track your search queries nor record any information, improving digital privacy and keeping your data private. Registration was mandatory to access the Silk Road (like most darknet platforms).

I’ve used it a handful of times; deliveries landed smooth via DeadDrops—plain packaging, no fuss. It’s not the biggest player like Abacus, but it’s got a loyal crew and uptime that rarely blinks. If you’re into a darknet market that feels cutting-edge and keeps your coins safe, ASAP Darknet Market’s a gem—just don’t expect a massive catalog yet; it’s more about precision than sprawl. Brian’s Club has been around since 2014 and remains one of the most well-known credit card shops on the dark web. It sells stolen card data — dumps, CVVs, even wholesale batches — and lets users bid on fresh leaks. Despite multiple takedown efforts by law enforcement and security researchers, Brian’s Club has resurfaced repeatedly and continues to add new stolen credit card data.

DarkOde Reborn is a great darknet market where you can find anything you want. The website has a great design and a clean and organized interface that is easy to use. The homepage includes options like browsing products, searching, mixer, and coin exchange. During our tests for the research, we were able to register with a bogus email and a random username. All that one can expect from a deep web marketplace when it comes to anonymity and security. Moreover, the layers of encryption and the bounce of your data from node to node effectively mask your IP address, enabling online anonymity.

We showed that a small fraction of traders is responsible for a large fraction of the trading volume, and by analysing the networks of buyers and sellers, we found different resilience regimes. Shocks tend to induce serious structural changes in the multiseller network, but impact the multibuyer network much less severely. Interestingly, the S2S network shows an intermediate level of resilience, which suggests that the S2S network might play the role of a supply chain network on the dark web. Furthermore, after a shock, the activity of buyers is resumed almost immediately, while the activity of sellers recovers more slowly. These different regimes suggest that the ecosystem’s resilience is mainly supported by the high demand of buyers rather than the response of the sellers. In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers.

Launched in 2020, Cypher Marketplace sells fraudulent documents, stolen credit cards, fake IDs, and malware. Its emphasis on user anonymity and document forgery makes it a core tool for identity fraud. Founded in 2014, BriansClub remains one of the oldest and most infamous dark web markets for stolen credit cards, fullz (complete identity kits), and dumps. Its look, design, options, and interface are exactly the exact copy of its competitor, but everything else, including buyers, vendors, and servers, is different.

All of this has made it one of the most reliable markets still active in 2025. Dark web marketplaces have been a significant outlet for illicit trade, serving millions of users worldwide for over a decade. First, we propose an algorithm that categorizes users either as buyers or sellers, and show that a large fraction of the trading volume is concentrated in a small group of elite market participants. We find that the dominance of markets is reflected in trading properties of buyers and sellers. Then, we investigate both market star-graphs and user-to-user networks, and highlight the importance of a new class of users, namely ‘multihomers’, who operate on multiple marketplaces concurrently.