Darknet Market Revenue Rises in 2023

However, owing to the difficulty of identifying relevant transactions, most studies rely on user surveys17,18 and data scraped from DWM websites19,20,21,22,23,24. In particular, these studies are based on user reviews which carry many inaccuracies, for instance, with respect to the time and value of the transaction19, that further compound error in other measures. Moreover, data scraped from the DWMs cannot assess the U2U transactions which account for the largest fraction of the total trading volume of the ecosystem13. The Dark Web is a concealed segment of the internet that can be accessed only through specialized software such as Tor. In 2026, it remains an increasingly influential part of the digital landscape. It offers impressive features, including PGP-signed addresses, payment via Monera, sticky and featured listings, and auto shops.

– Hydra Collapse

Additionally, where non-compliant cash out points are facilitating the movement of illicit funds from DNMs, regulators and law enforcement may take action to disrupt activity at the cash out point itself. For example, concurrent with the takedown of Hydra was the sanctioning of Garantex, the Moscow-based exchange that made multiple transactions with Hydra-linked addresses. The first ever DNM — called Silk Road — was started in 2011 by U.S. citizen Ross Ulbricht.

Explicit content

Then, between 2017 and 2018, there is a drastic structural change in the multiseller network structure due to operation Bayonet, after which the connections almost vanished. This change persists until the end of the observed period of the data set (also see Supplementary Information S4). H25.io is a premium directory in the Tor network, offering access to a diverse and meticulously curated list of onion sites. Our mission is to simplify navigation in the complex and evolving world of the darknet.

How do cryptocurrencies like Bitcoin and Monero play a role in darknet transactions?

Community trackers place its launch in late 2023 and note a focus on stability, moderation, and a familiar “escrow + vendor‑reputation” model typical of modern DNMs. Public sources also indicate support for both Bitcoin and privacy‑centric coins, aligning with broader ecosystem trends. Explore our penetration testing services to see how we can uncover vulnerabilities before attackers do. We can also assist with dark web exposure assessments, simulating the view of an attacker scouting your leaked information.

Below are 2025’s leading darknet markets, ranked by listings, trade volume, and vendor reliability.
The network is mostly populated by U2U-only sellers, followed by market-only sellers.
They often wear clothes with shop logos and publish price lists and post links.
These systems often resemble eBay-like formats, allowing buyers to compare products and vendors based on reviews and ratings.
One of the key factors driving this evolution is the adoption of Tor-based platforms, which provide a high level of anonymity and security.
It offers access to hacked bank accounts, credit card data, and cryptocurrency laundering tools.

Insights and caveats from mining local and global temporal motifs in cryptocurrency transaction networks

We showed that a small fraction of traders is responsible for a large fraction of the trading volume, and by analysing the networks of buyers and sellers, we found different resilience regimes.
On average, marketplaces had 26,342 sales and generated $5,847,417 in revenue.
Renowned for its extensive inventory of financial data and sophisticated operating methods, Brian’s Club is a key player in the underground economy of financial cybercrime.
In the wake of recent headlines announcing actions against Hydra Marketplace by the U.S. and German governments, darknet markets have made an ironic entrance into the spotlight.
Monero, in particular, has become the preferred cryptocurrency on the dark web in 2026 due to its advanced privacy mechanisms, which obscure transaction histories and wallet balances from public view.
Drugs lead the pack—weed, pills, some synthetics—but digital goods like hacked logins are gaining, tying into Telegram’s side gig boom.

User reviews and ratings are commonly featured, allowing buyers to assess the quality and reliability of the drugs being offered. Torzon Market, which emerged in September 2022, has introduced a unique vendor feedback system that imports feedback from other markets with PGP proof, enhancing trust and transparency. The market also offers premium accounts that provide users with advanced seller statistics, catering to more serious buyers and sellers. Next, we extracted information about stolen data products from the markets on a weekly basis for eight months, from September 1, 2020, through April 30, 2021. We then used this information to determine the number of vendors selling stolen data products, the number of stolen data products advertised, the number of products sold, and the amount of revenue generated.

Revisiting CIA: Developing Your Security Strategy in the SaaS Shared Reality

The nature of the dark web (anonymity and privacy) opens opportunities for drug dealers to reach a wide customer base across the globe without getting caught. This is an estimated reading time to let you know how long it will take you to read all the content on this particular PrivacyRadar.com page. However, it has a sneak peek, easy guide steps, and/or a quick list providing quick in-page navigations and easily-found answers if desired. Chainalysis also noted that some markets are openly advertising their wares in Russia, with giant 3D billboards (Kraken Market) and QR codes on subway trains (Mega Darknet Market).

Financial Tracking

As law enforcement agencies’ tactics improve, some markets respond by introducing more security features, like mandatory encryption or invite-only access. But no matter how polished or professional these sites seem, the risk of getting scammed — or tracked — is always high. During the second half of 2022, law enforcement cracked down on a large number of darknet markets, temporarily disrupting the supply of such illicit goods. The results of that investigation were published in a report called Technical analysis of the Genesis Market.

TRM Talks: Hydra Takedown: A discussion with experts from U.S. Treasury, Flashpoint and TRM Labs

As with any hidden service, availability, policies, and coin options can change without notice; much of what’s known is either a point‑in‑time analyst snapshot or self‑reported market copy. Treat category rosters and counts from tracker pages as indicative, not definitive. Public monitoring describes DarkMatter as primarily drug‑centric, with additional categories reported for fraud, counterfeit documents, and malware/digital tools—a mix consistent with mainstream DNMs. The project’s marketing leans heavily on “security/education” messaging, aligning with its privacy‑coin‑only stance. Specific moderation rules are not authoritatively documented on clearnet sources and can change over time. The best marketplaces in 2026 cater to diverse needs, offering a broad spectrum of products ranging from privacy-enhancing software, digital documents, and cryptocurrency exchanges to more sensitive or controversial goods.

AlphaBay Market

On New Year’s Eve people in Moscow spotted what looked like an up-and-coming tech startup projecting its logo onto the sides of various buildings. But in fact it was a guerrilla marketing stunt promoting OMG, a darknet marketplace selling heroin, mephedrone, marijuana, and everything else in between. The collapse of Abacus Market highlights the ongoing volatility in the Western darknet ecosystem, where sustained law enforcement pressure has created an environment of constant uncertainty. Unlike competitors such as Archetyp, DrugHub, ASAP Market, and Incognito Market, Abacus’s technical architecture allowed for more sophisticated payment processing and escrow services. The cybersecurity challenges seen in 2024 highlight the dynamic and ever-evolving nature of cyber threats. As cryptors, loaders, and stealers become more sophisticated, and underground markets remain resilient, organizations must prioritize robust cybersecurity measures in 2025.

Abacus Market, the largest Bitcoin-enabled Western darknet marketplace, has likely executed an exit scam after going offline in early July 2025, according to blockchain intelligence firm TRM Labs.
With stricter Know Your Customer (KYC) and Anti-Money Laundering (AML) measures, illicit actors are facing greater challenges when attempting to cash out.
Facebook’s onion mirror allows people to access it in countries that block the platform, allowing people to connect across digital borders.
Explore our penetration testing services to see how we can uncover vulnerabilities before attackers do.
One of the most crucial elements is the use of escrow services, which protect both buyers and sellers during transactions.
For example, one month Abacus is king, next month it’s gone and TorZon is on top.
The availability of inexpensive drug precursor chemicals—primarily sourced from China—has further fueled the growth of these platforms.

NCSC Set to Retire Web Check and Mail Check Tools

This repository and its contributors are not liable for any misuse of the provided information. A curated collection of darknet resources for educational purposes, offering insights into darknet frameworks, tools, and security practices. Contrary to predictions, the market for cryptocurrency “cleaning” services, or Bitcoin mixers, stagnated. The competitive landscape remained unchanged, with no significant innovations reported.

The Significance of This Data

The U2U network is formed by the entire set of interacting users (black and gray arrows with their respective users). Using the evolving activity-driven model31, U2U pairs are divided in either stable (black arrows and respective users) or non-stable (gray arrows and respective users). Plotted lines indicate the median value while bands represent the 95% confidence interval. Negative and positive numbers indicate the days prior and after the closure, respectively. Only the 33 DWMs that closed during our time period are considered in the analysis. The first major darknet market pioneered BTC trading, processing $1.2 billion before its 2013 shutdown.

Have streamlined the trading process, enhancing user satisfaction and market efficiency. As far as financial recourse for victims, some banks and insurance companies have provided payouts and will include those funds as damages in lawsuits against Genesis Market cybercriminals. As for Genesis Market cybercriminals located in the Netherlands, three have already been convicted and received prison sentences considered severe for that jurisdiction. The third convicted cybercriminal — the biggest Dutch user and the number 10 user worldwide — received a four-year sentence.

Moreover, we find a change of trend between the seller and the buyer median net income time series which reflects the dominance of markets, as detailed in the next section.
The integration of cryptocurrencies has made them a significant player in the dark web market ecosystem, facilitating secure and anonymous transactions.
Using darknet markets poses significant risks, including exposure to fraudulent services, exit scams, and potential legal consequences.
As we move through 2025, WeTheNorth continues to be a crucial platform for dark web users.
2a, where the overall ecosystem volume quickly recovers after market closures.
However, the website has some security risks, and users experience glitches.
In terms of vendor behavior, the change is largely dominated by wholesale vendors.

Cyber Threat Actors Ramp Up Attacks on Industrial Environments

On a smaller scale, Mega Darknet Market placed a few ads with QR codes in public places like Moscow subway trains. While tactics like these may have helped boost revenue for both markets, again, they have yet to match Hydra’s sizable financial success. Unlike the surface web (the normal, open internet we use every day), you can’t search for .onion sit… The most important thing is to ensure that you never click on links that you’re not sure of their source. Also, it should be common knowledge not to share personal information online. Latest updates from the darknet trading world as of February 2025—key shifts and developments.

The Emergence of Marketplaces on the Darknet

However in December last year a Ukrainian-born hacker broke into the Solaris market’s crypto-wallets and donated $25,000 to a charity for Ukrainian refugees. On Friday the 13th of January, the WayAway team hacked Solaris, taking advantage of a weakness in its coding, and shut it down. Now those trying to access Solaris are redirected to its upstart rival, Kraken.

Top-11 Dark-Web Marketplaces in 2026: Overviews, Use-Cases, and Risks

The implementation of Ring Confidential Transactions further conceals transaction amounts, making Monero a favored choice for those seeking privacy on the dark web. Abacus Market emerged in September 2021 and has quickly become a formidable player in the darknet market ecosystem. With an estimated market value of $15 million, Abacus Market offers over 40,000 products, making it one of the most extensive platforms on the dark web. The primary currencies used for transactions are Bitcoin and Monero, ensuring both traceability and privacy for users.

Purchasing or selling illegal goods—such as controlled substances, counterfeit documents, or stolen data—can result in significant legal penalties, including fines, criminal charges, and imprisonment. Even users who access these platforms without intent to buy illegal items risk suspicion or investigation. One of the key factors driving this evolution is the adoption of Tor-based platforms, which provide a high level of anonymity and security. By leveraging the decentralized nature of the Tor network, users can engage in transactions without exposing their identities or compromising their privacy.

Although the S2S network is composed only of U2U transactions, all categories of sellers (i.e, market-only, U2U-only, and market-U2U) are present in the S2S network.
But since its relaunch, the developers are focusing more on operational security and ensuring that users can have a good experience on this site.
Not all onion sites are dangerous, but many host illegal, harmful, or deceptive content.
Trackers characterize it as a newer, security-centric platform emphasizing Monero-only transactions, hardened account controls, and a “PGP + escrow + multisig-encouraged” model aligned with more privacy-oriented DNMs.
We reveal that stable U2U pairs play a crucial role for marketplaces by spending significantly more time and generating far greater transaction volume with DWMs than other users.
Each takedown affects the wider ecosystem by spreading distrust across other marketplaces.
“The RuTor forum has launched a series of webinars on medical topics, including first aid and overdose scenarios,” said Aleksey Lakhov, of St. Petersburg-based drug project Drugmap.ru.
My work bridges the gap between technology and cybersecurity education, helping to inform and empower others in the ever-evolving cyber landscape.

It said Russian-language darknet markets, which chiefly trade in Russia and countries of the former Soviet Union, accounted for 80 percent of the global market. By contrast, the English language ASAP market, the largest non-Russian darknet market, accounts for less than 10 percent of dark web sales. The marketplace’s operators appear to have disappeared with users’ cryptocurrency funds, marking another significant blow to the Western darknet ecosystem following the law enforcement seizure of Archetyp Market in June 2025. DuckDuckGo is a privacy-focused search engine that works as Tor browser’s primary search engine. It doesn’t track searches or store personal data, making it a strong option for users seeking more anonymous private browsing.

We classify all entities either as sellers or buyers as a function of time. The result is a time series of lists of sellers and buyers for each period and for each market and the U2U network. The classification is performed in five steps (see Fig. 1), as detailed next.

We showed that a small fraction of traders is responsible for a large fraction of the trading volume, and by analysing the networks of buyers and sellers, we found different resilience regimes. Shocks tend to induce serious structural changes in the multiseller network, but impact the multibuyer network much less severely. Interestingly, the S2S network shows an intermediate level of resilience, which suggests that the S2S network might play the role of a supply chain network on the dark darknet markets web. Furthermore, after a shock, the activity of buyers is resumed almost immediately, while the activity of sellers recovers more slowly. These different regimes suggest that the ecosystem’s resilience is mainly supported by the high demand of buyers rather than the response of the sellers. In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers.

This has been particularly beneficial for vendors and buyers who prioritize discretion in their operations. The evolution of darknet markets has been significantly influenced by the seamless integration of Tor networks and the development of user-friendly interfaces. These advancements have not only enhanced accessibility but also improved the overall user experience, making secure online trade more efficient and reliable. One fraud shop that provided services like these, Genesis Market, saw its end last April after a coordinated, international law enforcement effort called Operation Cookie Monster closed it down, and OFAC sanctioned it.

Examples include the sale of high-quality products with low risk for contamination (including lacing and cutting), vendor-tested products, sharing of trip reports, and online discussion of harm reduction practices. Much like with drug sales, a similar pattern of task differentiation emerged among darknet markets providing cybercriminal services. In the chart below, we see that the DNM Aggregator emerged as the clear leader among fraud shops enabling cybercrime, and Exploit.in and Kraken Market almost equally sold tools used to facilitate ransomware attacks. As for cybercriminal administration, the category includes inflows from ransomware affiliate wallets. This includes purchases such as malicious software and supporting services which cybercriminals sometimes make using escrow services on crime forums. Previous analyses of U2U trading relationships around DWMs include only two studies21,22 based on unstructured21 or semi-structured22 interviews of 17 users of Silk Road and 13 sellers on various DWMs, respectively.

Specifically, to be classified as a multiseller, a user must be classified as a seller in at least two markets simultaneously. The multihomers play a crucial role in the ecosystem because they act as edges between markets. Hence we do not distinguish multisellers by the number of markets in which they operate. The evolution of the ecosystem of all buyers and sellers obtained from the considered markets and the U2U network is shown in Fig. Although it shows fluctuations, including those caused by external shocks, the ecosystem exhibits a positive growth trend in terms of trading volume. Torch is one of the more established dark web search engines, designed to help users navigate the Tor network and discover onion sites.

Abacus Market is one of the newer darknet marketplaces that quickly filled the gap left by AlphaBay’s takedown. It hosts over 40,000 listings and offers everything from illicit goods and substances to hacking tools. With an estimated market value of around $15 million, it has grown into a massive hub for cybercriminal activity. As the darknet ecosystem continues to grow, it has become a hub for innovation, offering a wide range of products and services.

Exit scams are another common issue, where vendors disappear with users’ funds, leaving customers unable to recover their investments. Vendors may also choose to exit with their escrowed funds to avoid competition at a higher volume and price level. Marketplaces like Cypher specialize in selling fraudulent documents and stolen credit card data, while platforms like BidenCash draw in potential buyers by releasing stolen data for free.

You can pay through Monera and Bitcoin using the escrow system or the traditional market account after making a purchase on this shop. The ASAP is a moderate design marketplace on the dark web that offers helpful tools like mandatory PGP encryption and two-factor authentication for a safe browsing experience. Like other marketplaces, ASAP Market also requires you to register for an account. But since its relaunch, the developers are focusing more on operational security and ensuring that users can have a good experience on this site.