The dark web is only accessible through specific software like Tor (The Onion Router). Also, while this huge portion of the internet has a reputation as home to nefarious activities like hacking and drug trafficking, it also harbors legitimate activities like journalists and whistleblowers. The U2U network is formed by the entire set of interacting users (black and gray arrows with their respective users). Using the evolving activity-driven model31, U2U pairs are divided in either stable (black arrows and respective users) or non-stable (gray arrows and respective users). Plotted lines indicate the median value while bands represent the 95% confidence interval. Negative and positive numbers indicate the days prior and after the closure, respectively.

• Mega clearly dominated the realm of wholesale drug purchases, capturing 51.9% of that segment.
• These digital currencies provide a degree of anonymity, as transactions are recorded on a public ledger but do not directly link users to their real-world identities.
• Just like traditional e-commerce sites, darknet markets provide a platform for vendors to connect with potential buyers to facilitate transactions.
• This is likely due to the fact that cryptocurrency prices have been largely stagnating in H and H1 2023, which resulted in less interest shown by the mainstream population.
• Vendors often build up reputations through ratings and reviews, just like sellers on mainstream platforms.
• While these marketplaces continue to serve legitimate purposes, such as enabling secure communication and privacy protection, they also remain hotspots for illicit activities and cybercrime.

Cryptocurrency Trading

To study the performance of sellers, we analyse the quarterly median income, i.e., the quarterly median of the money received by each seller, for each category and multisellers, as shown in Fig. We find that multisellers have the largest median income throughout the period of observation—except in the last quarter of 2017 and 2018, when they have the second largest median income. They are followed by market-U2U sellers, then market-only sellers, and lastly U2U-only sellers. Therefore, although larger in number, U2U-only sellers typically make the smallest income. This suggests that sellers with more diverse sources of income, such as multisellers and market-U2U sellers, are able to produce a higher income. Additionally, we observe that, except for U2U-only sellers, the median income of the other types of sellers drops after the major shock caused by operation Bayonet (see Supplementary Information Section S4).

The dangers of darknet marketplaces

• Some of these sites have turned to influencers to boost their publicity campaigns.
• Edges are multihomers, i.e., traders that are simultaneously active in both markets (sellers in the multiseller network, and buyers in the multibuyer network).
• Darknet marketplaces emerged around 2011, with Silk Road setting the standard for how these platforms operate.
• Therefore, given the nature of anonymity and privacy of the dark web, several stores keep on emerging in the dark despite a continuous crackdown on several others.
• Abacus Market stands out with 35,000+ listings and $5 million in monthly cryptocurrency trades via Bitcoin (BTC) and Monero (XMR).
• You can find featured listings on the homepage and browse the products of your choice.
• We found several thousand vendors selling tens of thousands of stolen data products on 30 darknet markets.

The results of that investigation were published in a report called Technical analysis of the Genesis Market. Though Genesis Market domains and servers were seized and antivirus programs have been updated, cybercriminals have already rebuilt illicit services like these. Mega Darknet Market is the dominant drug supply source for drug vendors on other darknet sites, holding a 63.4% share of that market.

Essential Privacy Tools

• The use of escrow systems and reputation-based feedback mechanisms has fostered trust among users, ensuring a smooth trading experience.
• Then, during 2017 and 2018, it shows the structural change due to operation Bayonet, when it shrinks.
• It has gained a reputation for being a reliable source of high-quality data for cybercriminals.
• Once users suspect a platform is compromised or dishonest, activity drops quickly and the marketplace either migrates, rebrands, or disappears entirely.
• As of September 2025, public trackers mark it closed, underscoring the sector’s churn amid phishing/DDoS and sustained law‑enforcement pressure.
• Open‑source snapshots describe a broad vendor mix spanning drugs, fraud/financial items, counterfeits, and digital tools—the standard DNM catalog.
• Constant uncertainty, fear of scams, and enforcement pressure create sustained stress.

The stolen data supply chain begins with producers—hackers who exploit vulnerable systems and steal sensitive information such as credit card numbers, bank account information, and Social Security numbers. Next, the stolen data is advertised by wholesalers and distributors who sell the data. Finally, the data is purchased by consumers who use it to commit various forms of fraud, including fraudulent credit card transactions, identity theft, and phishing attacks. It is common to hear news reports about large data breaches, but what happens once your personal data is stolen?

What Happened to The Silk Road?

They used “free data dumps” and emotional marketing to build trust before vanishing—an enduring lesson in the risks of social engineering. Russian Market has operated since 2019, specialising in stolen credentials, stealer logs, and remote desktop access. Threat reports consistently rank it among the top ten darknet sites Top 10 Dark Web Markets. The dark web hosts a variety of illegal activities, many of which fuel cybercrime and real-world harm. Miklos founded Privacy Affairs in 2018 to provide cybersecurity and data privacy education to regular audiences by translating tech-heavy and „geeky“ topics into easy-to-understand guides and tutorials.

• They’ve got 2FA and encryption that’s tighter than a drum, which I’ve tested against crash-prone sites and found solid.
• When one goes down, two more emerge with new ideas, better technology, and greater difficulty to track.
• Independent verification remains limited due to the market’s relatively recent appearance.
• Awazon Market is a top-tier dark web marketplace with claims to revolutionize secure anonymous commerce.
• Marketplaces recorded 632,207 sales across these markets, which generated $140,337,999 in total revenue.
• Additionally, we observe that, except for U2U-only sellers, the median income of the other types of sellers drops after the major shock caused by operation Bayonet (see Supplementary Information Section S4).
• However, it has a sneak peek, easy guide steps, and/or a quick list providing quick in-page navigations and easily-found answers if desired.
• The most affected are multisellers, with a drop of 78% in the median income, followed by market-U2U and market-only sellers, with a drop of 59% and 47%, respectively.
• Community trackers place its launch in late 2023 and note a focus on stability, moderation, and a familiar “escrow + vendor‑reputation” model typical of modern DNMs.

Large number of U2U transactions

The site aims to direct users to the actual Torzon Market, presumably a darknet marketplace. Freshtools is a unique marketplace in that it does not only provide the stolen data, but it allows criminals to purchase MaaS which can cause further damage to the victims. It is one of the most active and up to date markets and always provides new and updated malware and data. It is a hub for financial cybercrime and offers a wide range of illicit services and stolen data that cater to sophisticated cybercriminals.

Darknet markets generate millions in revenue selling stolen personal data

• However, the success of law enforcement is just one possible explanation for this decline.
• It’s not established yet how the drugs were brought to occupied Ukraine but the dealing network likely has some connection with Russian soldiers or non-combat staff.
• Law enforcement agencies actively monitor these markets and can track users despite anonymity measures.
• Tor2door’s been a standout since 2020—over 20,000 listings and a custom-built site that’s not some cookie-cutter junk.
• To keep a closer eye on your personal information, you can use services like NordStellar’s dark web monitoring.
• A Distributed Denial of Service (DDoS) attack is designed to disrupt access to websites and other internet resources.
• New websites and forums were created nearly overnight and very quickly filled the gap left by the sites taken down by authorities.

Businesses should be aware of the potential for data leaks and invest in data loss prevention measures. As of September 2025, public trackers mark it closed, underscoring the sector’s churn amid phishing/DDoS and sustained law‑enforcement pressure. And beware—while many explore out of curiosity or for research purposes, it’s important to remember that engaging with these platforms, even as an observer, can lead to serious legal and ethical consequences. Having JavaScript enabled on the dark web can cause havoc because it can reveal your IP address to your website.

SSL & Security

The top performers in darknet marketplaces for 2025, excelling in trade volume, vendor ratings, and market influence. Next, we extracted information about stolen data products from the markets on a weekly basis for eight months, from September 1, 2020, through April 30, 2021. We then used this darkweb marketplaces information to determine the number of vendors selling stolen data products, the number of stolen data products advertised, the number of products sold, and the amount of revenue generated. Silk Road, which emerged in 2011, combined TOR and bitcoin to become the first known darknet market.

Financial Indicators

These platforms offer comprehensive guides, verified vendor lists, and up-to-date URLs, ensuring seamless access for users navigating this complex ecosystem. The evolution of darknet markets has been marked by significant advancements in technology and user experience, transforming them into sophisticated platforms for secure online trade. Over the years, these markets have adapted to the growing demand for privacy, anonymity, and efficiency, leveraging cutting-edge tools to ensure seamless transactions. DWM users display complex trading patterns within the marketplace environment. For example, users migrate to alternative DWMs when a DWM that they trade on closes12,13. Such migration of users is aided by communication via online forums and chats on the dark web14,15.

One Identity Unveils Major Upgrade to Identity Manager, Strengthening Enterprise Identity Security

In contrast to the other types of sellers, the median income of U2U-only sellers increases after operation Bayonet. Moreover, we observe a trend of increase in their median income relative to the value before operation Bayonet—an increase of almost six times by the end of the period of observation (see Supplementary Information S4). Further supporting this interpretation, we observe that the trading volume of the U2U network increases after Bayonet, while the trading volume of markets decreases (see Supplementary Information Section S4). The evolution of the ecosystem of all buyers and sellers obtained from the considered markets and the U2U network is shown in Fig. Although it shows fluctuations, including those caused by external shocks, the ecosystem exhibits a positive growth trend in terms of trading volume. The following month RuTor retaliated, hacking WayAway and posting screenshots of the breach, arguing that WayAway’s security was too weak to be trusted.

Logs are easy to deploy, making the platform attractive to low-skill actors. Once users suspect a platform is compromised or dishonest, activity drops quickly and the marketplace either migrates, rebrands, or disappears entirely. Funds are held temporarily by the platform until a transaction is completed or disputed.

Red Team vs Blue Team Operations : How Does it Works?

While tactics like these may have helped boost revenue for both markets, again, they have yet to match Hydra’s sizable financial success. Also, set up two-factor authentication (2FA) to add an extra layer of protection in case someone manages to figure out your password. Moreover, if you must use public Wi-Fi, ensure that you use a VPN to mask your browsing activity and keep yourself secure. 85% of top markets now use escrow security, up from 60% in 2023—see Alphabay.

However, according to Chainalysis, the driving force of this revenue is a combination of increased competition and efforts by law enforcement to crack down on the markets themselves. According to Chainalysis’ 2025 Crypto Crime Report, darknet market (DNM) vendors are adapting their money laundering tactics. While centralized exchanges (CEXs) remain the dominant cash-out method, a notable shift has been toward decentralized finance (DeFi) protocols. The largest component of the S2S network of U2U transactions between sellers for each year with the respective number of nodes (N). The nodes are sellers that are active in that year, and an edge is placed between two sellers if at least one transaction occurs between them during that year. The network is mostly populated by U2U-only sellers, followed by market-only sellers.

Edges are multihomers, i.e., traders that are simultaneously active in both markets (sellers in the multiseller network, and buyers in the multibuyer network). The width of the edges is proportional to the number of multihomers acting between the markets. Throughout the whole period of observation, the dominant category of buyers is market-U2U buyers followed by market-only buyers, representing on average 52% and 42% of all buyers, respectively. The U2U-only category is comparatively small, representing only 6% of all buyers on average. The number of market-U2U and market-only buyers also drops as a consequence of operation Bayonet.

In particular, these studies are based on user reviews which carry many inaccuracies, for instance, with respect to the time and value of the transaction19, that further compound error in other measures. Moreover, data scraped from the DWMs cannot assess the U2U transactions which account for the largest fraction of the total trading volume of the ecosystem13. The Dark Web is a concealed segment of the internet that can be accessed only through specialized software such as Tor. In 2026, it remains an increasingly influential part of the digital landscape. It offers impressive features, including PGP-signed addresses, payment via Monera, sticky and featured listings, and auto shops. In 2017, the website went offline following a law enforcement action taken by the American, Canadian, and Thai authorities, but since August 2021, it’s been operational again.

Secure Tor Access

BriansClub remains a long-standing credit card data shop since at least 2014. Despite a 2019 breach that exposed over 26 million credit cards, it continues to operate, indicating sustained trust in its data pipelines. Hacked social media accounts are evidence that cybercriminals have a diverse appetite for Dark Web data products.