Western drug flows in particular come from US-domiciled exchanges and trace flows from those to darknet markets. In total, darknet markets and fraud shops received $1.7 billion last year, a rebound from 2022 — the year that saw the sizable Hydra Marketplace close. What’s the difference between classic marketplaces and data stores? Despite growing crackdowns from law enforcement agencies, the dark web remains a hotbed of criminal activity, offering everything from drugs to stolen data.
Share This Article:
To them and others, Genesis sold forms of stolen PII like credentials for email and social media accounts, as well bank accounts and crypto service accounts, and in its lifetime received tens of millions of dollars in crypto, mostly Bitcoin. This includes purchases such as malicious software and supporting services which cybercriminals sometimes make using escrow services on crime forums. The last version of the market operated until February of 2023, and a month after that closure, a former AlphaBay vendor pled guilty to distributing fentanyl that caused fatal overdoses in Oregon. A once-sizable illicit enterprise that began in 2014, AlphaBay was closed by authorities in 2017 and then reopened in 2021. Though many customers are concentrated in Australia, Abacus has vendors and customers around the world, including the United States. Mega clearly dominated the realm of wholesale drug purchases, capturing 51.9% of that segment.
Financial Markets, Financial Institutions, And Fiscal Service
“That's why we will continue to join forces with our law enforcement partners around the globe to attack this problem together. The interagency efforts are aimed to both identify those who use anonymizing technologies to purchase illicit narcotics and direct them to available resources. JCODE has worked with every FBI field office in the country to facilitate outreach to households that have purchased individual amounts of opioids from the darknet.
Darknet Threat Monitoring With KELA
The debut of new markets continues as upheaval remains constant. Another theory is that administrators may have voluntarily left the market due to increased regulatory scrutiny. TRM Labs analysts suggested that law enforcement agencies might be conducting a covert operation to gather evidence.
- In the first arc of the anime series Lupin the 3rd Part V, Lupin III steals digital currency from the "Marco Polo" darknet market.
- Our affiliate relationships help us maintain an open-access platform, but they do not influence our editorial decisions.
- Welcome to Daily Security Review, the premier source for news and information on security threats, Ransomware and vulnerabilities.
- Abacus Market is one of the newer darknet marketplaces that quickly filled the gap left by AlphaBay's takedown.
- Mega Darknet Market is the dominant drug supply source for drug vendors on other darknet sites, holding a 63.4% share of that market.
The Rise Of Monero Amid DNM Decline
Its 13,000+ users and 1,100+ vendors prioritize speed and escrow security in darknet trading. Its 9,000+ users and 700+ vendors focus on drug trades with strong escrow security. With 8,000+ users and 600+ vendors, it commands a 10% share of darknet drug trades—a rising star since 2023. Serving 15,000+ users and 1,200+ vendors, it holds an 8% share of darknet drug trading. Below are 2025’s leading darknet markets, ranked by listings, trade volume, and vendor reliability.
Terrorism And Illicit Finance
Though Mega Darknet Market typically serves a Russian customer base, the drug revenue shown in the chart above likely came from customers based in Europe. Looking closer at ASAP Market inflows, it won some share of revenue across all drug purchase types, receiving 37.1% of social supply, 35.7% of large retail, 16.5% of small retail, and 13.5% of wholesale purchases. Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products. Darknet market role specialization provides one possible explanation as to why the ecosystem has yet to see a dominant player. We can see this pattern on the chart below, which shows the level of market share controlled by the dominant market of each epoch. The bus blocked two traffic lanes on a road near Russia’s Ministry of Foreign Affairs before security forces removed it an hour later.
Dark Web Marketplaces Vs Open Web Criminal Forums
The results of these markets are higher quality and lower prices of psychoactive substances as well as a lower risk of violent incidents. Online forum communities provide information about safe drug use in an environment where users can anonymously ask questions. In June 2015 journalist Jamie Bartlett gave a TED talk about the state of the darknet market ecosystem as it stood at the time. Their aim was to explore the ethical and philosophical implications of these markets, which, despite high-profile internationally co-ordinated raids, persist and flourish.
One of the most common is the exit scam, where a marketplace suddenly disappears and takes everyone’s money with it. Some were taken down by law enforcement, others just vanished overnight with users’ money. It was the first big site where people could anonymously buy drugs using Bitcoin, and it gained a lot of attention, until it was shut down by the FBI in 2013. The site’s operators charged fees on every transaction and even offered 3.3 million cards for free to lure in new users. In one major operation, U.S. agencies dismantled BidenCash, a platform that sold over 15 million stolen credit cards and credentials, generating more than $17 million since 2022. The major marketplace, Abacus, which held 70% of the market share in Bitcoin-enabled Western platforms in 2024, has reportedly vanished.
Atlantis, the first site to accept Litecoin as well as Bitcoin, closed in September 2013, just prior to the Silk Road raid, leaving users just one week to withdraw any coins. This in turn led to political pressure from Senator Chuck Schumer on the US DEA and Department of Justice to shut it down, which they finally did in October 2013 after a lengthy investigation. In the 2000s, early cybercrime and carding forums such as ShadowCrew experimented with drug wholesaling on a limited scale. One of the better-known web-based drug forums, The Hive, launched in 1997, serving as an information sharing forum for practical drug synthesis and legal discussion. With the development and popularization of the World Wide Web and e-commerce in the 1990s, the tools to discuss or conduct illicit transactions became more widely available. Though e-commerce on the dark web started around 2006, illicit goods were among the first items to be transacted using the internet, when in the early 1970s students at Stanford University and Massachusetts Institute of Technology used the ARPANET to coordinate the purchase of cannabis.
The months and years after Silk Road's closure were marked by a greatly increased number of shorter-lived markets as well as semi-regular law enforcement takedowns, hacks, scams and voluntary closures. Solutions like SAGA® by Munit.io help organizations gain visibility, detect emerging risks, and act quickly when their data, credentials, or brand appear in underground markets. Understanding how dark web marketplaces work helps analysts evaluate the extent of exposure during an investigation. Understanding how dark web marketplaces work helps organizations assess the risks they face.
Unlike competitors, such as Archetyp, DrugHub, ASAP Market, and Incognito Market, Abacus operated as a central deposit wallet, multisignature DNM that supported both Bitcoin and Monero. In late June 2025, users began reporting withdrawal issues with Abacus Market, which typically indicates an impending exit scam. Abacus’s exit follows the June 16, 2025 law enforcement seizure of Archetyp Market, marking the latest in a series of shutdowns in the Western DNM ecosystem. Welcome to Daily Security Review, the premier source for news and information on security threats, Ransomware and vulnerabilities.
‘Fair Trade’ Cocaine And ‘conflict-free’ Opium: The Future Of Online Drug Marketing
Russian Market has operated since 2019, specialising in stolen credentials, stealer logs, and remote desktop access. This survey highlights active and recently shuttered markets with actionable metrics and intelligence for threat hunters, CISOs, and red team leaders. Though Genesis Market domains and servers were seized and antivirus programs have been updated, cybercriminals have already rebuilt illicit services like these.
- TRM Labs said the closure could be the result of attention from law enforcement, as Abacus Market clocked a monthly record after the closure of Archetyp Market, one of the longest-running dark web marketplaces, in mid-June.
- It sells stolen card data — dumps, CVVs, even wholesale batches — and lets users bid on fresh leaks.
- Abacus Market was launched in 2021 and now lists over 40,000 illicit goods, including hacking tools, counterfeit documents, and listings for drugs.
- A number of studies suggest that markets such as Silk Road may have helped users reduce the harm caused by illicit drug use, particularly compared with street-based drug marketplaces.
- The top performers in darknet marketplaces for 2025, excelling in trade volume, vendor ratings, and market influence.
Europol shuttered one of the longest-running dark web marketplaces, Archetyp Market, on June 16, causing its users to flood Abacus, leading to its largest-ever monthly sales volume of $6.3 million in June. TRM Labs said the closure could be the result of attention from law enforcement, as Abacus Market clocked a monthly record after the closure of Archetyp Market, one of the longest-running dark web marketplaces, in mid-June. Abacus commanded around 70% of the market share across all Bitcoin-enabled Western darknet marketplaces in 2024. We expand the discussion by assessing the synergetic threat posed by ransomware distributed via darknet markets. Ransomware vendors advertise their products on multiple illicit markets, which increases vendor revenue and market resiliency. The number of markets and vendors highlight the availability of ransomware and ease of access.
"The war has widened the splits in the cybercrime underground," Ian Gray, director of analysis and research at Flashpoint, told Information Security Media Group. After major players get disrupted by law enforcement, fresh alternatives typically debut quickly. They're typically reachable only via an anonymizing network – aka darknet – such as Tor or I2P.
In late June, users began reporting withdrawal issues, which prompted the Abacus administrator known by the handle “Vito” to assure users that the problems were merely a result of an influx of new people and a distributed denial-of-service attack. The content provided herein is for general informational purposes only and should not be construed as legal, regulatory, compliance, or cybersecurity advice. Established in 2022, WizardShop is one of the biggest data stores on the dark web, focusing mainly on carding and financial data.
