The number remained high since, suggesting that the conversation (and offers) merely shifted from one type of platform to another. The advertising and discussion of cryptocurrency cashout services and mixers also increased significantly on Telegram, especially in late summer 2022 when the “war of marketplaces” seemed to peak. Archetyp Market had operated for over five years, amassing more than 600,000 registered users and processing at least EUR 250 million in transactions. The site’s infrastructure, hosted in the Netherlands, was taken offline during the operation. Authorities arrested the alleged administrator, a 30-year-old German national, in Barcelona, while enforcement actions in Germany and Sweden targeted one of the site’s moderators and six of its highest-volume vendors. In addition to counterfeit merchandise, MGM Grand Market offers access to stolen credit card information, compromised bank accounts, and other financial fraud-related services.
US Government Shared Services
Drawing from his background in economics, Jimmy has monitored blockchain development for years, firmly believing in its power to democratise finance. Beyond offering commentary on the latest crypto developments, he also spends his time analysing open-source codes of promising projects on GitHub. In Arizona, lawmakers passed a Bitcoin reserve law, enabling seized crypto to be held as public reserves.
Dark Web Drug Markets
The market is especially well-known for providing access to freshly compromised data, often obtained from recent breaches and stealer logs. In 2022, for example, BidenCash was linked to the breach of over 1.2 million credit card records. Its user base is primarily English-speaking, and it appeals to more sophisticated cybercriminals. Here’s a look at the top 10 dark web markets currently dominating this underground space.
- It uses PGP encryption, two-factor authentication, and OPTP authentication to ensure users’ security.
- This shift in focus from major darknet markets and mixers to individual actors and groups marks a strategic realignment in combating crypto-linked criminal activities.
- Widespread password re-use across multiple accounts means hackers only need one set of login details to run a credential stuffing attack 1 and instantly gain access to many more.
- A substantial portion of illicit transaction volumes, amounting to 61.5% or $14.9 billion, was directed towards entities and jurisdictions under sanctions.
- Monero, in particular, has become the preferred cryptocurrency on the dark web in 2025 due to its advanced privacy mechanisms, which obscure transaction histories and wallet balances from public view.
Darknet Market Vendors Turn To DeFi
- It only accepts Monero as a form of payment, which helps to protect the anonymity of its users.
- At its peak, Hydra Market was the single largest darknet market as well as the largest marketplace for online narcotics in countries of the former Soviet Union.
- Sanctioning the various actors in the global cryptocurrency laundering and cashout ecosystem has caused disruptions for these services.
- “Last year, DNM vendors sent a significantly higher portion of their funds to DeFi than they did historically,” the report read.
- During our tests for the research, we were able to register with a bogus email and a random username.
Back in 2020, this Russian-speaking marketplace was the world’s biggest darknet market. Worse yet, it was the largest marketplace for illegal drugs in all the countries of the former USSR. In April 2022, local authorities took down Hydra’s Germany-based servers and seized $25 million in Bitcoin. The investigation revealed that Hydra had more than 19,000 sellers and a total of 17 million customers during its two years of activity.
This was no more visible than with the rise of the Silk Road marketplace in the early 2010s. Founded by Ross Ulbricht (aka Dread Pirate Roberts), the Silk Road sold a large variety of items, but was an infamous drug marketplace – with drugs accounting for 70% of the drugs sold in spring 2013. Silk Road was eventually shut down by the FBI in October 2013, following the arrest of Ross Ulbricht. BreachForums, an underground forum that has seen multiple iterations and changes in ownership, continues to be one of the most well-regarded English language forums serving cybercriminals across the world – in spite of a rocky year. The forum is frequented by initial access brokers, database vendors, malware developers, spammers, programmers looking to learn new techniques, and everything in between.
Of People Worldwide Don’t Understand How The Dark Web Works
Finally, as with most online accounts, fraudsters bank on the fact that many people still reuse passwords across multiple accounts, especially those they use often like Facebook. Fraudsters in possession of a hacked PayPal account can also try to double their money by using the account funds to run various well-established chargeback scams on merchants who accept PayPal. Log-ins for everyday services like Netflix and Spotify primarily offer a route into potential identity theft, since it remains so common for people to reuse their passwords. Our personal information has real value on the dark web because it can be used fraudulently in such a wide variety of ways to make a profit at your expense. Some of the more common scams are listed below, organized by type of hacked account. In addition to the above measures, frequently checking your credit/debit card activity can allow you to quickly notice fraud.
Operational Trends
In addition to that activity, markets like these host vendors that advertise their own cashout or swapping services, resulting in tens of millions of dollars in laundered funds. Stolen credit and debit card data, along with bank and online payment account details, have long been the most popular items for sale on the darknet markets. The lure of high account balances to cash out and access to new lines of credit understandably allows these items to always command the highest prices. The Silk Road was a famous dark web marketplace where users could buy and sell goods and services anonymously. All the payments were made through cryptocurrency, further enhancing marketplace anonymity.
Contact your financial institution as soon as you suspect fraudulent activities are happening on your account. Wherever possible, set up email or text alerts to notify you of suspicious activity such as unexpected orders for a new bank card or if a threshold transaction amount has been reached. Where possible, remove your personal information from any websites that don’t require it. If your social media accounts are no longer important to you, you should delete them. Old social media accounts or store accounts used once years ago don’t offer any value to you, but are useful attack vectors for hackers and other bad actors.
Get Antivirus And Malware Protection Software
Established in 2022, WizardShop is one of the biggest data stores on the dark web, focusing mainly on carding and financial data. While Tor and similar browsers provide anonymity, some activity may still be visible to your ISP. Experts recommend using a good VPN to encrypt your whole traffic and have an extra layer of security while surfing the Dark Web.
Threat actors can use encrypted apps like Telegram, to communicate en masse and share with their hacker network the location of new forums and marketplaces. Just as Incognito built on the playbook of its predecessors, future markets will learn from RapTor. But with blockchain intelligence advancing and global partnerships strengthening, law enforcement is better positioned than ever to detect, disrupt, and dismantle these operations. Designed to resemble a legitimate e-commerce platform, Incognito offered a slick user experience with branding, advertising, and customer support.
Marketplaces that maintain strict moderation policies—banning excessively harmful or exploitative products—also gain popularity among more ethically minded users. Users must look for platforms employing robust encryption protocols, secure escrow services, and advanced anti-phishing measures. Additional layers, such as two-factor authentication (2FA), encrypted PGP messaging, and built-in wallet security, significantly enhance protection against theft and hacking. Dark-web marketplaces operate through encrypted networks, primarily utilizing anonymity-enhancing technologies such as Tor (The Onion Router) and I2P (Invisible Internet Project). These technologies obscure users’ identities and locations by routing their internet traffic through multiple volunteer-operated servers worldwide, making it extremely difficult to trace activities back to individuals. Tor remains the most prevalent method due to its ease of use and robust anonymity features, but the popularity of I2P is steadily growing due to its increased resistance to surveillance and censorship.
Cases like Nemesis Market and Monopoly Market indicate that law enforcement agencies now prefer to take down DNMs without announcing it publicly — and potentially alerting vendors under investigation. This allows them to compile intelligence and make arrests at optimal moments. In the interim, many in the DNM community will assume the marketplace performed an exit scam and continue their activity on other platforms. Bayonet/GraveSac, and has become the preferred method for disrupting the ecosystem. Monitoring active marketplaces offers early access to malware kits, credential dumps, and fraud tools.
Valued at approximately $15 million, Abacus Market is one of the most lucrative platforms in the dark web ecosystem. In 2024, the platform grew significantly in popularity, partly because of its strategic acquisition of users from a number of recently shut-down marketplaces, such as AlphaBay and Incognito Market, which had recently closed their doors. One of the many creepy Dark Web facts is that marketplaces don’t just sell forged and stolen documents and credentials — they also sell malicious software hackers can use to infect their targets.
The ability to seamlessly communicate with vendors via secure messaging systems also greatly improves overall user experience. Overall, dark-web marketplaces in 2025 are more sophisticated, secure, and resilient than ever before, evolving rapidly in response to both technological advancements and intensified scrutiny from global law enforcement agencies. Previous DNM admins who either voluntarily exited, such as ASAP Market, Agora Market, and WhiteHouseMarket, or conducted exit scams, such as Evolution Market, while at the top of the ecosystem have yet to be apprehended by law enforcement.
