Cryptocurrencies, while offering enhanced privacy, also present significant risks. Users face vulnerabilities like market volatility, scams involving fake escrow services, compromised wallets, or theft through phishing schemes targeting crypto transactions. Furthermore, inexperienced users unfamiliar with secure cryptocurrency practices are particularly susceptible to these threats, risking the loss of their entire funds. Kerberos Market is commonly cited by law‑enforcement and OSINT trackers as a newer, general‑purpose marketplace. Self‑described landing pages also advertise additional coins and platform hardening features, but these claims are not independently verified.

Shifts in User Behavior and Marketplace Structures

An intuitive, user-friendly interface is crucial, especially given the complex nature of dark-web interactions. Users favor marketplaces with straightforward navigation, efficient search functions, and clear product categorizations. The ability to seamlessly communicate with vendors via secure messaging systems also greatly improves overall user experience. Transactions within these marketplaces typically leverage cryptocurrencies—most commonly Monero, Bitcoin, and privacy-centric digital currencies developed specifically to enhance transaction anonymity. Monero, in particular, has become the preferred cryptocurrency on the dark web in 2026 due to its advanced privacy mechanisms, which obscure transaction histories and wallet balances from public view. Known for its publicity stunt releasing millions of stolen card details for free, BidenCash specializes in credit card fraud and identity theft.

Incognito Enhances Security

The dark net’s layered encryption and routing protocols offer stronger anonymity, making onion sites appealing to whistleblowers, political dissidents, privacy advocates — and, inevitably, cybercriminals. Freshtools was established in 2019 and offers various stolen credentials, accounts, and host protocols like RDP. It is considered a go-to site for malware purchasing, providing keyloggers, trojans, and other Malware as a Service products.

Platform Control

• However, the markets are dominated by things like illegal drugs, explicit content, pirated files, hacking services, and stolen personal information, among others.
• In exploring the top 11 dark-web marketplaces in 2026, we’ve examined their core operations, diverse use-cases, inherent risks, and evolving trends.
• Shocks tend to induce serious structural changes in the multiseller network, but impact the multibuyer network much less severely.
• Many “trusted” sellers use fake reviews or steal reputations from shutdown markets.
• The arrest of Durov heightened fears that Telegram would start cooperating with authorities, forcing vendors to find new places to operate.
• Once the buyer confirms satisfaction, the funds are released to the seller.
• One of the most common types of illicit goods is stolen login credentials, often collected from data breaches.
• Major active platforms include Abacus, Russian Market, BriansClub, and Exodus.

Jardine also emphasized the importance of using services that actively emphasize security in the decentralized finance space. “Good digital hygiene, especially in terms of password and seed phrase management, is also crucial,” he said. While DeFi adoption among darknet vendors is growing, it has not replaced centralized exchanges as the primary laundering method.

Size of listings

Edges are multihomers, i.e., traders that are simultaneously active in both markets (sellers in the multiseller network, and buyers in the multibuyer network). The width of the edges is proportional to the number of multihomers acting between the markets. Throughout the whole period of observation, the dominant category of buyers is market-U2U buyers followed by market-only buyers, representing on average 52% and 42% of all buyers, respectively. The U2U-only category is comparatively small, representing only 6% of all buyers on average. The number of market-U2U and market-only buyers also drops as a consequence of operation Bayonet.

Drughub Market

• The market started in 2021 in Canada and features both international and Canadian users.
• It also masks your IP address, making it difficult for government agencies to monitor or track your activities.
• The report did, however, present some more positive figures, including a year-over-year decline in revenue from crypto-based scams.
• Similar results hold for the full network, confirming that the formation of U2U pairs is a pervasive phenomenon around DWMs.
• Bohemia is a modern dark web marketplace with a great user interface that is easy to use and navigate.
• Another key factor driving the growth of darknet markets is the diversification of products and services.
• In recent years, some darknet markets and fraud shops have been integrating crypto payment processors on their websites via APIs, possibly as a way to improve operational efficiency and increase security.
• Interestingly, the hackers don’t hide, but most of them even openly advertise what they offer on the darknet forums.

Ares Market is presented in open sources as a general‑purpose marketplace with a familiar trust stack (escrow, feedback, PGP/MFA) and BTC/XMR settlement—features that align with sector norms rather than set it apart. As with any hidden service, availability, policies, and coin options can change without notice; much of what’s known is either a point‑in‑time analyst snapshot or self‑reported market copy. Flugsvamp 4.0 presents as a localized, drug‑centric market that inherited the Flugsvamp brand but not its full network effects. Scholarly analyses highlight how Swedish vendors largely migrated away from FS4 after 2021, with the 2025 Archetyp takedown again reshaping where Swedish traffic lands. As with any hidden service, features and status are fluid; third‑party tracker details should be treated as directional rather than definitive.

Can you access the dark web using DuckDuckGo?

However, if a hacker gains access to the unsecured network you are on, they can easily view your account details and steal or modify your information. As a consequence of this, likely fewer crypto trading accounts and wallets were available for hackers to target. Cryptocurrency accounts were the only category that we saw to have experienced an increase. This is likely due to the fact that cryptocurrency prices have been largely stagnating in H and H1 2023, which resulted in less interest shown by the mainstream population.

Illicit and Risky Use-Cases

Each offers unique strengths in cryptocurrency trading and escrow security—essential for navigating the onion network. Beginning in September 2021, Abacus Market has established itself as one of the leading dark web marketplaces. After AlphaBay closed, Abacus Market took its place as the world’s largest underground darknet marketplaces. Abacus Market quickly rose to prominence by attracting former AlphaBay users and providing a comprehensive platform for a wide range of illicit activities.

Detection of the U2U network

• Law enforcement takedowns, such as Archetyp, demonstrate both impact and adversary adaptation.
• Chainalysis data shows darknet marketplace revenue dropped post-Hydra seizure in 2022 but recovered to $2 billion in Bitcoin inflows during 2024 Darknet market BTC inflow drop and shift to Monero.
• This malware-as-a-service model allows less tech-savvy criminals to launch malware-driven cyberattacks without building the tools themselves.
• I’ve been poking around these places for a while now, from the giants like Abacus to the old-timers like Vice City.
• While anyone can use it, it’s built for high-stakes exchanges, making it overkill for routine file sharing or data backups.
• For instance, a recent London Metropolitan Police (MET) investigation examined the transactions of a seller profile on a DWM10.

After that quarter, their number remains small, which is represented by the dashed line. In all panels, the dashed vertical line marks the time of operation Bayonet. As of October 2022, the largest volume of drugs purchased at two large marketplaces – BlackSprut and Mega – were for cathinones such as mephedrone and alpha-PVP. These white, synthetic stimulant powders that mimic cocaine and MDMA are highly prevalent in Russia, eastern Europe and the Balkans because they’re cheap and easy to manufacture locally.

Strengths & Trade‑offs

• This places the market squarely within verified financial-crime supply chains.
• On the one hand, some recent works have shown that a significant number of DWM users trade drugs and other illicit goods using social media platforms, such as Facebook, Telegram, and Reddit16,17,18,19,20.
• By contrast, the English language ASAP market, the largest non-Russian darknet market, accounts for less than 10 percent of dark web sales.
• In this era, it takes one wrong click and all your sensitive data ends up in the wrong hands.
• Transaction trends and cryptocurrency movement patterns are analyzed at a high level.
• The number of actors in the ecosystem is affected by several factors, especially market closures.
• Nonetheless, 2023 saw a rise in new types of scams, including romance scams — also known as pig butchering scams.

This survey highlights active and recently shuttered markets with actionable metrics and intelligence for threat hunters, CISOs, and red team leaders. If your personal data ends up for sale on the dark web, it can lead to serious consequences like identity theft, financial fraud, or unauthorized access to your online accounts. Some dark web listings claim to offer services like hacking-for-hire or even hitmen. Law enforcement agencies monitor many dangerous markets, and even anonymous browsing isn’t foolproof. Just visiting these sites can attract attention from law enforcement, especially if you interact with known vendors or download suspicious content. Malicious vendors often infect buyers with spyware, ransomware, or infostealer malware hidden in downloadable files.

Hacked Cryptocurrency Accounts

In particular, multihomers that are sellers in multiple markets are multisellers, and similarly for buyers we have the multibuyers. Specifically, to be classified as a multiseller, a user must be classified as a seller in at least two markets simultaneously. The multihomers play a crucial role in the ecosystem because they act as edges between markets. Hence we do not distinguish multisellers by the number of markets in which they operate.

Exploitation of Anonymity for Harm

Notably, the number of buyers and sellers significantly drops after the operation Bayonet in the last quarter of 2017, which shut down AlphaBay and Hansa markets, causing a major shock in the ecosystem34. However, the number of buyers rapidly recovers, which does not happen to sellers. And over the last 9 months, using a mix of publicity stunts and crippling cyber attacks on each other, OMG, Kraken and around 10 other darknet markets have been engaged in a tit-for-tat turf war for Hydra’s throne.

Adopt secure ATM habits

The classification is performed in five steps (see Fig. 1), as detailed next. The largest component of the S2S network one year before and one year after the operation Bayonet. Nodes are sellers that are active within the time period, and an edge is placed between two sellers if at least one transaction occurs between them during the period. These critical changes may not be perceived from macroscopic measures of the ecosystem as a whole. For instance, the typical net income of sellers is seemingly unaffected, as shown in Fig. 2a, where the overall ecosystem volume quickly recovers after market closures.

Platform

First, we observe that the U2U network, formed by all transactions between pairs of users, has a larger trading volume than DWMs themselves. We then identify stable U2U trading relationships, which represent a subset of persistent pairs in our dataset31,32 forming the backbone of the U2U network. We find that 137,667 (i.e., 1.7% out of 7.85 million total) pairs are stable, generating a total trading volume of $1.5 billion (i.e., 5% out of $30 billion total volume). We reveal that stable U2U pairs play a crucial role for marketplaces by spending significantly more time and generating far greater transaction volume with DWMs than other users. By analysing the temporal evolution of stable pairs, we unveil that DWMs acted as meeting points for 37,192 users (out of around 16 million), whose trading volume is estimated to be $417 million. Importantly, these newly formed stable pairs persist over time and transact for several months even after the closure of the DWM that spurred their formation.

News

While the Bitcoin blockchain is publicly available on Bitcoin core37 or other third-party APIs such as Blockchain.com38, a market or a user can generate a new address for each transaction. To track the transactions of markets and users as entities, the data need to be pre-processed in order to map groups of addresses into entities. Examples include the sale of high-quality products with low risk for contamination (including lacing and cutting), vendor-tested products, sharing of trip reports, and online discussion of harm reduction practices. Previous analyses of U2U trading relationships around DWMs include only two studies21,22 based on unstructured21 or semi-structured22 interviews of 17 users of Silk Road and 13 sellers on various DWMs, respectively. Here, we dramatically extend previous work by exploring the collective emergence and structure of U2U pairs.

• But according to Ingo Fiedler, co-founder of Blockchain Research Lab, this trend is primarily the result of increasing law enforcement focus on the darknet market industry.
• Dark web markets have exploded in scale and reach in 2025, becoming the most dangerous hubs for trading drugs, stolen data, and hacking tools.
• Policing involves targeting specific activities of the private web deemed illegal or subject to internet censorship.
• And over the last 9 months, using a mix of publicity stunts and crippling cyber attacks on each other, OMG, Kraken and around 10 other darknet markets have been engaged in a tit-for-tat turf war for Hydra’s throne.
• Unfortunately, that as well didn’t stop other darknet markets from rising.
• If you purchase something from such shops and make payment through conventional payment methods like your bank transfer, credit/debit card, or PayPal, you can be caught easily and face legal consequences.
• Miklos founded Privacy Affairs in 2018 to provide cybersecurity and data privacy education to regular audiences by translating tech-heavy and “geeky” topics into easy-to-understand guides and tutorials.
• The website utilizes a valid SSL certificate issued by Google Trust Services, expiring in 2026, indicating basic encryption and identity verification.
• These marketplaces facilitate the exchange of everything from stolen credentials and drugs to weapons and hacking tools.

The Chainalysis 2024 Crypto Crime Report highlights a $1.7 billion revenue surge in darknet markets and a rise in crypto-linked sanctions and new scam trends. The increased use of DeFi comes amid tight regulations on centralized exchanges. With stricter Know Your Customer (KYC) and Anti-Money Laundering (AML) measures, illicit actors are facing greater challenges when attempting to cash out. Furthermore, law enforcement worldwide has stepped up its efforts, seized assets, and disrupted key money laundering networks. We classify all entities either as sellers or buyers as a function of time. The result is a time series of lists of sellers and buyers for each period and for each market and the U2U network.

Therefore, it’s clear that as long as there’s demand and supply of illegal products, the darknet markets are going nowhere anytime soon, no matter the number of times law enforcement takes them down. Every potential participant’s credentials must be vigorously vetted before they can join. That way, they aim to create secure forums and limit outsiders like law enforcement.

Between June 1 and June 27, 2025, average daily deposits to Abacus totaled USD 230,000 across 1,400 transactions, but this plummeted to just USD 13,000 across 100 deposits from June 28 to July 10, 2025. Welcome to this collection of darknet resources, curated exclusively for educational and informational purposes. This repository serves as a knowledge hub for individuals interested in understanding the structure, functionalities, and applications of the darknet. Please note that all material provided here is aimed at promoting awareness, responsible research, and ethical use of information.

One hypothesis is that U2U pairs managed to find better shipping logistics; another hypothesis is that they were seen as a safer way to trade than DWMs at a time of crisis. Torrez Market powers 30,000+ listings and $6 million monthly trades with BTC and XMR, securing a 9% share. Its 16,000+ users and 1,500+ vendors make it a vibrant hub for darknet marketplace diversity. Below are 2025’s leading darknet markets, ranked by listings, trade volume, and vendor reliability.

To study the performance of sellers, we analyse the quarterly median income, i.e., the quarterly median of the money received by each seller, for each category and multisellers, as shown in Fig. We find that multisellers have the largest median income throughout the period of observation—except in the last quarter of 2017 and 2018, when they have the second largest median income. They are followed by market-U2U sellers, then market-only sellers, and lastly U2U-only sellers. Therefore, although larger in number, U2U-only sellers typically make the smallest income. This suggests that sellers with more diverse sources of income, such as multisellers and market-U2U sellers, are able to produce a higher income. Additionally, we observe that, except for U2U-only sellers, the median income of the other types of sellers drops after the major shock caused by operation Bayonet (see Supplementary Information Section S4).

The anonymity and encryption provided in dark markets create a haven for cybercriminals and nation-state actors to buy and sell dangerous assets while evading detection. Our results also support recent recommendations of paying attention to individual sellers rather than entire DWMs40. Law enforcement agencies, however, have only recently started targeting individual sellers. The first operation took place in 2018 and successfully led to the arrest of 35 sellers41, while the largest operation to date occurred in 2020 and led to 179 arrests in six different countries42.

These vendors provided the key ingredients for fentanyl, a synthetic opioid trafficked into the U.S. primarily by groups like the Sinaloa Cartel. Chainalysis had previously identified over $37.8 million in suspicious transfers involving suspected China-based chemical vendors. The availability of inexpensive drug precursor chemicals—primarily sourced from China—has further fueled the growth of these platforms. Watch our cyber team share their key insights from their investigations into the biggest dark web trends in 2022. Established in 2022, WizardShop is one of the biggest data stores on the dark web, focusing mainly on carding and financial data. In repressive regimes, darknets play a vital role in enabling free speech and access to uncensored information.

Europol’s IOCTA notes that darknet marketplaces increasingly rely on resilience services such as rotating onion addresses to stay online despite DDoS attacks and law-enforcement pressure. Abacus Market was launched in 2021 and now lists over 40,000 illicit goods, including hacking tools, counterfeit documents, and listings for drugs. In 2024, it recorded on-chain revenue of $43.3 million, a 183 per cent increase, driven by vendor migrations post-shutdown of competitors, according to Chainalysis’ 2023 market report Darknet revenue in 2023.

The integration of blockchain-based smart contracts is also becoming widespread, automating secure transactions and reducing the likelihood of fraud. DarkFox Market is the largest dark web shop selling various products and attracting more vendors and users. It is a wallet-based shop, meaning you must first deposit bitcoins into your wallet before purchasing any goods and services. The marketplace is much more organized, which makes it easy to use and navigate.

Prices of hacked cryptocurrency accounts still remain overall the highest among all hacked online accounts. This indicates that hacking such accounts still remains extremely profitable. As in the previous 3 years, we conducted research into the supply and prices of various goods and services sold by cybercriminals on the dark web. The chart above shows that ASAP and Mega Darknet markets led the large retail and wholesale segments respectively. Looking closer at ASAP Market inflows, it won some share of revenue across all drug purchase types, receiving 37.1% of social supply, 35.7% of large retail, 16.5% of small retail, and 13.5% of wholesale purchases.

Transactions within dark markets predominantly involve cryptocurrencies like Bitcoin, Monero, or Ethereum. These digital currencies provide a degree of anonymity, as transactions are recorded on a public ledger but do not directly link users to their real-world identities. To purchase illicit goods or services, users deposit cryptocurrency into an escrow system or directly to the seller, and the cryptocurrency is held until the buyer confirms the satisfaction of the transaction. Dark-web marketplaces attract sophisticated cybercriminals adept at launching phishing scams, malware attacks, or ransomware threats.

You can legally browse darknet sites for legitimate purposes like research or privacy protection. However, engaging in illegal activities on the darknet is against onion links the law and can result in serious criminal charges. If you access illegal content or participate in criminal transactions, you face legal consequences.

The dark web market changes all the time, but some dark web marketplaces have made a name for themselves as the biggest and busiest spots. These sites attract thousands of users every day, offering all kinds of illegal goods that keep the underground trade going. Unlike surface web platforms, darknet markets have no reliable way to verify vendors. Many “trusted” sellers use fake reviews or steal reputations from shutdown markets. From drug sales and breached data to scam services and malware, dark web markets are some of the most dangerous corners of the internet. These markets mimic traditional e-commerce websites, but instead of second-hand books or vintage jackets, they traffic in illegal goods and criminal services.

I’ve poked around; it’s not overwhelming, just a tight selection that works—think curated over chaotic. If you’re into a darknet market with a community pulse and solid uptime, Bohemia Dark Market’s climbing the ranks—give it a spin if you like a vibe that’s less corporate, more crew. Despite consistent results, this study has limitations that may be addressed in future work. First, while the dataset is preprocessed with state-of-the-art methods, there is no ground truth for validation, and this uncertainty propagates to our findings. For instance, we cannot verify if an entity classified as seller is in fact a seller. Similarly, there is no unique choice for the classification parameters or ground truth for fitting them.