As much as authorities work hard to shut down various sites, it shows what the dark web is capable of doing if left unchecked. Who doesn’t like privacy, especially when dealing with the buying and selling of illegal products and services? Therefore, given the nature of anonymity and privacy of the dark web, several stores keep on emerging in the dark despite a continuous crackdown on several others. The internet is a wide landscape that comprises the surface part – the internet that we all know and the hidden portion.

The Rise of Secure and Anonymous Commerce: Darknet Markets in 2025

Moreover, we find a change of trend between the seller and the buyer median net income time series which reflects the dominance of markets, as detailed in the next section. Conversely, transaction networks obtained from the blockchain contain the entire transaction data of the DWMs and U2U transactions, allowing a thorough investigation of the ecosystem as a whole. In fact, previous studies on DWM transaction networks have revealed crucial aspects of the ecosystem13,14,15. However, they have so far mainly focused on DWM users, without distinguishing between buyers and sellers, and neglecting the different weight that more active users may have in the system. The reason is that the operational structure of DWMs inherently hides the seller–buyer link, as all transactions are made through the marketplace.

Daily Debrief Newsletter

Each offers unique strengths in cryptocurrency trading and escrow security—essential for navigating the onion network. Expect future trends in darknet markets to be shaped by advancements in encryption, the rise of decentralized platforms, and increased use of cryptocurrencies, enhancing anonymity and security for users. Darknet markets typically incorporate anonymous access through the Tor network, further enhancing user privacy.

Hidden Services

Recently, two interview-based studies have suggested that DWMs may also promote the emergence of direct user-to-user (U2U) trading relationships. Here, we carefully investigate and quantify the scale of U2U trading around DWMs by analysing 31 million Bitcoin transactions among users of 40 DWMs between June 2011 and Jan 2021. We find that half of the DWM users trade through U2U pairs generating a total trading volume greater than DWMs themselves. We then show that hundreds of thousands of DWM users form stable trading pairs that are persistent over time.

Are onion sites dangerous?

Over time, ambitious individuals created infrastructure for these transactions, where for a fee, sellers have access to a digital ‘storefront’ to sell their products in a centralized marketplace. As we move forward, technological advancements and regulatory measures will continue to shape the future of darknet markets. Users and law enforcement agencies alike must stay vigilant, navigating the ever-changing landscape of the dark web.

Beyond Bug Bounties: How Private Researchers Are Taking Down Ransomware Operations

2a, where the overall ecosystem volume quickly recovers after market closures. This is an outcome of the ecosystem’s resilience, largely supported by the migration of users15. Correspondingly, the multihoming activity is a mechanism that contributes to the ecosystem’s resilience. Because they are already active in more than one market, the migration cost for the multihomers is usually smaller compared to that for non-multihomer users, especially for sellers, that need to rebuilt their reputation23.

Darknet markets

Kaspersky report states, Last year, the underground market for cryptors—tools used by cybercriminals to obfuscate malicious code and evade detection—grew significantly. Developers introduced advanced techniques, advertising subscriptions ranging from $100 to $20,000. After shut down, the site displayed a seizure notice and directed users to their hidden service[9] to find more information about the operation. Law enforcement seized substantial evidence, including 47 smartphones, 45 computers and notebooks, eight mobile phones, four computers, and 34 data storage devices from the primary suspect’s locations.

• The growing ecosystem of darknet markets reflects a thriving digital economy, where innovation and adaptability are key to sustaining user trust.
• While no information is stolen during a DDoS attack, it can be used for extortion or to conceal other hacking activities.
• This technology employs multiple layers of encryption, routing data through a series of nodes to effectively mask the user’s digital trail.
• While it included some innocuous listings such as health supplements, the majority of vendors and most of the sales were related to illicit drugs.
• Official-torzon.markets claims to be the official gateway to the “Torzon Market,” providing links, PGP verification information, and a Tor Browser guide.

How We Reviewed Dark Web Marketplaces?

Amid the cyber warfare between those vying to succeed Hydra, Russia’s drug trade, most of it orchestrated via darknet marketplaces continues almost in plain sight. The Hidden Wiki is a longstanding directory of dark web sites that offers a way to browse onion services. It’s been around for many years and helps users navigate the dark web by curating links to various resources. Note that Hidden Wiki links sometimes lead to unsafe content, so be wary about what you click.

Torzon Market

• Dark markets include features similar to those found in legitimate e-commerce platforms, such as product listings, user reviews, ratings, and customer support.
• This marketplace accepts payments via Monero but also supports the Escrow system.
• The market also had accompanying forums, hosted on a different URL, where buyers, vendors, and other members of the community could interact.
• Transactions on WeTheNorth are primarily conducted using Bitcoin and Monero, ensuring secure and private dealings.
• When your data is found on the dark web, it means that you’ve been compromised.
• Unlike the surface web (the normal, open internet we use every day), you can’t search for .onion sit…
• First, while the dataset is preprocessed with state-of-the-art methods, there is no ground truth for validation, and this uncertainty propagates to our findings.

Despite these explanations, the darknet community remained skeptical, leading to a dramatic 94% decline in deposit volumes. Threat actors may also manipulate old or publicly available data to generate hype and damage reputations. The arrest followed an extensive investigation by the Central Office for Combating Internet Crime (ZIT), which tracked the platform’s operations across multiple jurisdictions.

Security issues

This suggests that the multiseller activity is sensitive to external shocks but also that it yields higher profits. The structural change in the multiseller network and the resilience of the multibuyer network. Temporal network of multisellers (top) and multibuyers (bottom) between markets for each year. Edges are multihomers, i.e., traders that are simultaneously active in both markets (sellers in the multiseller network, and buyers in the multibuyer network). The width of the edges is proportional to the number of multihomers acting between the markets.

We find that 137,667 (i.e., 1.7% out of 7.85 million total) pairs are stable, generating a total trading volume of $1.5 billion (i.e., 5% out of $30 billion total volume). We reveal that stable U2U pairs play a crucial role for marketplaces by spending significantly more time and generating far greater transaction volume with DWMs than other users. By analysing the temporal evolution of stable pairs, we unveil that DWMs acted as meeting points for 37,192 users (out of around 16 million), whose trading volume is estimated to be $417 million.

Cryptocurrency Transactions

Empire is one of the two biggest darknet markets globally, the other being Russia’s Hydra market. Launched in February 2018; the Empire market is heavily inspired by Alphabay, with LTC, BTC, XMR, PGP 2FA, and MultiSig features. Abacus Market operated as a central deposit wallet, multisignature darknet marketplace supporting both Bitcoin and Monero cryptocurrencies.

• A defining feature of darknet markets is their reliance on cryptocurrencies as the primary transactional medium.
• WeTheNorth, valued at approximately $3 million, lists over 9,000 products for users.
• Though Genesis Market domains and servers were seized and antivirus programs have been updated, cybercriminals have already rebuilt illicit services like these.
• Darknets and dark markets have fueled the growth of cybercrime, provided a marketplace for cyber threats, and expanded the attack surface for malicious actors.
• Historically, as law enforcement closed each dominant marketplace, a new leader emerged.
• In another recent incident, a hacker stole a massive trove of databases from a breach notification site DataViper and ended up selling it online.
• Negative and positive numbers indicate the days prior and after the closure, respectively.
• While market dynamics may have shifted since, the cited data illustrates how cartels had previously exploited crypto ecosystems.
• Its continued growth and prominence in the darknet market ecosystem highlight its importance in 2025.

Emergence and structure of decentralised trade networks around dark web marketplaces

According to the report, in 2023, crypto-linked OFAC sanctions shifted toward groups and individual actors and away from major darknet markets like Garantex and Hydra, as well as mixers like Tornado Cash. The crypto industry continues to suffer from cybercrimes, with darknet markets being one of the two categories showing an increase in revenue in 2023, according to the latest report from blockchain analysis firm Chainalysis. The increased use of DeFi comes amid tight regulations on centralized exchanges. With stricter Know Your Customer (KYC) and Anti-Money Laundering (AML) measures, illicit actors are facing greater challenges when attempting to cash out. Furthermore, law enforcement worldwide has stepped up its efforts, seized assets, and disrupted key money laundering networks.

Market features

The future of darknet trade looks promising, with ongoing advancements poised to further enhance the user experience. The starting point for this paper is the identification of U2U networks around DWMs. We analyse 40 DWMs for the time period spanning from June 18, 2011 to January 31, 2021. Our dataset covers all major DWMs that have ever existed, as identified by the European Monitoring Centre, Europol, the World Health Organization, and independent researchers24,25,26. Our analysis focuses on Bitcoin – the most popular cryptocurrency both on DWMs27,28 and in the regulated economy29,30.

– Hydra Collapse

The users on this site could review and rate the products that promote reliable and fraudster vendors. Of course, not all activity on the dark web is criminal, but such marketplaces are where a lot of illegal trade and money laundering happens. By relying on encryption, pseudo-anonymous currencies, and network-level anonymity, they create a false sense of safety, drawing in both buyers and sellers. A dark web market is a hidden online platform where users can anonymously buy, sell, and trade illegal or sensitive items. Such markets are typically accessible through the Tor network, which anonymizes traffic by routing it through multiple relays and encrypting each layer. This encryption makes attribution and tracking more difficult for authorities and cybersecurity professionals.

Defined as illegal, unregulated commercial websites, these dark markets constantly adapt to law enforcement pressures, evolving in complexity and sophistication. In March 2015, the marketplace fell victim to an exit scam, with its administrators absconding with approximately $12 million in bitcoins. Unlike many other platforms, Evolution allowed for the wholesale trading of stolen credit card information, further diversifying the types of illicit goods available.

• DWMs are also communication platforms, where users can meet and chat with other users either directly—using Whatsapp, phone, or email—or through specialised forums.
• Journalists and activists use it to communicate securely in oppressive regimes.
• This not only helps protect your identity but also contributes to your overall cybersecurity in the digital age.
• This data enables account takeover attacks across email, social media, and corporate tools.
• Dark markets provide a one-stop-shop for cybercriminals, offering a wide range of services such as hacking tools, stolen data, ransomware, and Distributed-Denial-of-Service (DDoS) attacks for hire.
• The variety of products and services available on darknet platforms has grown exponentially, addressing a broad spectrum of consumer demands.
• Features such as advanced search filters, customer reviews, and escrow services have further enhanced the reliability and trustworthiness of these platforms.
• These platforms, accessible through darknet websites and onion links, provide users with secure and anonymous transactions, primarily facilitated by cryptocurrencies like Bitcoin.

Stolen data ecosystem

Dark web marketplaces have been a significant outlet for illicit trade, serving millions of users worldwide for over a decade. First, we propose an algorithm that categorizes users either as buyers or sellers, and show that a large fraction of the trading volume is concentrated in a small group of elite market participants. We find that the dominance of markets is reflected in trading properties of buyers and sellers. Then, we investigate both market star-graphs and user-to-user networks, and highlight the importance of a new class of users, namely ‘multihomers’, who operate on multiple marketplaces concurrently.

Dark web marketplaces expose users to multiple layers of risk that extend beyond financial loss and affect legal standing, personal safety, and long-term consequences. Its catalog includes physical narcotics, digital goods, stolen accounts, and subscription bypass tools. The broad category mix positions Vortex as an entry-level market for general illicit trade.

Negative and positive numbers indicate the days prior and after the closure, respectively. Only the 33 DWMs that closed during our time period are darknet markets active considered in the analysis. The first major darknet market pioneered BTC trading, processing $1.2 billion before its 2013 shutdown.

As a consequence of this, likely fewer crypto trading accounts and wallets were available for hackers to target. Cryptocurrency accounts were the only category that we saw to have experienced an increase. This is likely due to the fact that cryptocurrency prices have been largely stagnating in H and H1 2023, which resulted in less interest shown by the mainstream population. Our price index grew with the addition of nine payment processing services.

Jardine also emphasized the importance of using services that actively emphasize security in the decentralized finance space. “Good digital hygiene, especially in terms of password and seed phrase management, is also crucial,” he said. As Hydra did, many of these markets have continued the tradition of including drug harm reduction information for drug buyers, such as providing drug testing and medical advice. “The RuTor forum has launched a series of webinars on medical topics, including first aid and overdose scenarios,” said Aleksey Lakhov, of St. Petersburg-based drug project Drugmap.ru. But Russians fleeing the country since the war have still been able to buy drugs on the dark web.

Dark web markets work much like regular e-commerce websites but with extra layers of anonymity and encryption. Buyers browse listings, place orders, and pay with cryptocurrency — typically Bitcoin or Monero — to obscure transaction trails. During the second half of 2022, law enforcement cracked down on a large number of darknet markets, temporarily disrupting the supply of such illicit goods. One of the most notable developments is the integration of cryptocurrencies as the primary medium of exchange. Bitcoin, Monero, and other privacy-focused coins have become indispensable for users seeking to conduct transactions without leaving a trace. The decentralized nature of these currencies ensures that financial activities remain untraceable, fostering trust among participants.

The rise of darknet markets has redefined the landscape of secure and anonymous online transactions, providing users with unparalleled privacy and convenience. These platforms have emerged as a significant force in the digital economy, allowing individuals to conduct business outside the limitations of conventional financial systems. Central to this transformation are onion addresses, which serve as secure entry points to these marketplaces, ensuring both anonymity and accessibility. However, trading behaviour in DWM closely resembles what is observed on regulated online platforms despite their significant differences in operational and legal nature14. Nevertheless, due to their unregulated nature, DWMs exhibit behaviours not observed in regulated marketplaces. They offer anonymity to their users by using and developing specialized tools.