Russian Language Marketplaces Remain Drivers of Crypto Drug Sales: TRM Labs Report

Kaspersky report states, Last year, the underground market for cryptors—tools used by cybercriminals to obfuscate malicious code and evade detection—grew significantly. Developers introduced advanced techniques, advertising subscriptions ranging from $100 to $20,000. After shut down, the site displayed a seizure notice and directed users to their hidden service[9] to find more information about the operation. Law enforcement seized substantial evidence, including 47 smartphones, 45 computers and notebooks, eight mobile phones, four computers, and 34 data storage devices from the primary suspect’s locations.

Seller-to-seller network

Exploring the dark web can be eye-opening, but it’s also risky without the right protection. While the Tor browser boosts privacy, pairing it with a VPN adds a critical layer of security. Use Norton VPN to encrypt the data you send and receive and surf more anonymously. Administrator and prolific vendor Gal Vallerius was arrested in August 2017. According to a 2024 report citing unsealed court documents, USDT was widely available in Mexico at a discount, allowing resellers to profit in countries like Colombia.

Set Up Tor Browser

• Launched in February 2018; the Empire market is heavily inspired by Alphabay, with LTC, BTC, XMR, PGP 2FA, and MultiSig features.
• Cartels reportedly used USDT to fund operations, sometimes profiting from price gaps across different crypto markets.
• The anonymity and encryption provided in dark markets create a haven for cybercriminals and nation-state actors to buy and sell dangerous assets while evading detection.
• This malware-as-a-service model allows less tech-savvy criminals to launch malware-driven cyberattacks without building the tools themselves.
• The nodes of the S2S network are active sellers (i.e., sellers that are trading at the time) and two sellers are connected by an edge if at least one transaction was made between them during the considered snapshot period.
• Nevertheless, by analysing the income of each multiseller, we observe that the median income still reflects their high income, as shown in Fig.
• To purchase illicit goods or services, users deposit cryptocurrency into an escrow system or directly to the seller, and the cryptocurrency is held until the buyer confirms the satisfaction of the transaction.

In contrast to the other types of sellers, the median income of U2U-only sellers increases after operation Bayonet. Moreover, we observe a trend of increase in their median income relative to the value before operation Bayonet—an increase of almost six times by the end of the period of observation (see Supplementary Information S4). Further supporting this interpretation, we observe that the trading volume of the U2U network increases after Bayonet, while the trading volume of markets decreases (see Supplementary Information Section S4). The evolution of the ecosystem of all buyers and sellers obtained from the considered markets and the U2U network is shown in Fig. Although it shows fluctuations, including those caused by external shocks, the ecosystem exhibits a positive growth trend in terms of trading volume. Dark markets provide a one-stop-shop for cybercriminals, offering a wide range of services such as hacking tools, stolen data, ransomware, and Distributed-Denial-of-Service (DDoS) attacks for hire.

Drugs

• Administrators soon moved the site to another unknown host, but law enforcement got another break in April 2017, which allowed them to identify the new hosting company, in Lithuania.
• Word’s out they’re going decentralized in 2025—less downtime, more trust, right in line with where things are headed.
• Our results also support recent recommendations of paying attention to individual sellers rather than entire DWMs40.
• Previous studies have shown that, although the number of users and transactions is larger in markets, the trading volume in the U2U network is larger than that of markets13.
• Darknets and dark markets present a multifaceted challenge to businesses and society as a whole.

The most important thing is to ensure that you never click on links that you’re not sure of their source. Also, it should be common knowledge not to share personal information online. Latest updates from the darknet trading world as of February 2025—key shifts and developments. Over the years, dozens of large DNMs have been established and eventually shut down by law enforcement, including AlphaBay, Dream Market, Wall Street, and, most recently, Hydra. DNMs are located on the “darknet,” which is unreachable on standard internet browsers like Chrome, Firefox, or Safari because the darknet is unindexed. There are certain sites on the darknet (and on clearnet) which attempt to manually track and publish sites on the darknet, but common browsers do not link directly to darknet.

Stay anonymous while you browse

Reputation scores and user feedback guide buyer decisions darknet markets 2026 in the absence of real-world verification.

Hacking groups and services

There is no shortage of methods to get hacked, but there are just as many ways to defend against it. By following these suggestions, you can deter unwanted intruders from accessing your accounts at home or work. Prices are, however, expected to fall in case of a new cryptocurrency upturn, as this would lead to increased interest and hype from the general public. The average cost of credit card information varies from $10 (in countries such as the U.S., Canada, and Australia) to $240 each (with a card balance).

Dark Markets Darknet Market Links in 2026

A thriving category of illicit goods and services sold on dark web markets is that of scans of personal documents. As with our previous reports, we gather data by scanning Dark Web marketplaces, forums, and websites. This information is then processed to generate an index of average prices for a broad range of specific products.

Market operations

• Darknet marketplaces may look like regular online stores, but using or even browsing them comes with serious risks.
• The number of malicious tools, or “drainers,” designed to steal cryptocurrency assets like tokens and NFTs saw a substantial rise.
• The reasons for the differential impact of COVID-19 on U2U trading vs. DWM trading are difficult to pin down.
• Vice City Market runs 18,000+ listings and $2.5 million monthly trades on BTC and XMR, with a 5% share.
• The availability of counterfeit goods on these platforms underscores the challenges faced by legitimate businesses in protecting their brands and products from being counterfeited.
• In many places, including the U.S., the UK, and the EU, accessing the dark web is legal for legitimate purposes.
• (b) Trading volume in dollars sent to a DWM compared with the total trading volume in its surrounding U2U transactions.
• These signals help identify laundering activity and operational stress without engaging directly.

Lawmakers and platforms alike will need to decide what responsibility they’re willing to accept. These aren’t distant problems—they are immediate, and they affect public safety, financial systems, and global cooperation. TRM Labs reported that TRON accounted for 58% of illicit crypto activity in 2024, followed by Ethereum at 24% and Bitcoin at 12%. By utilizing crypto transactions, these cartels can efficiently fund and facilitate the production of fentanyl, which is then trafficked into the United States, contributing to the ongoing opioid crisis.

Top 10 Darknet Markets 2025

You can legally browse darknet sites for legitimate purposes like research or privacy protection. However, engaging in illegal activities on the darknet is against the law and can result in serious criminal charges. If you access illegal content or participate in criminal transactions, you face legal consequences. The legality depends on your activities and your country’s specific laws regarding darknet use. In this system, cryptocurrency is held by a trusted third party until the buyer receives the product or service as described. Once the buyer confirms satisfaction, the funds are released to the seller.

Risks and Challenges for Users

• Looking ahead, the focus will likely shift toward decentralized autonomous organizations (DAOs), which could revolutionize governance and decision-making within darknet platforms.
• This has led to the emergence of specialized markets that focus on niche products, further diversifying the ecosystem.
• The categories are well organized, ranging from drugs and fraud to digital products, guides, and malware.What really sets it apart is its focus on security and usability.
• In fact, the Guardian referred to darknet markets as “the eBay of drug dealing,” and rightly so, illegal drugs are found in almost all the shops on the dark web.
• On average, marketplaces had 26,342 sales and generated $5,847,417 in revenue.
• By contrast, the English language ASAP market, the largest non-Russian darknet market, accounts for less than 10 percent of dark web sales.

Law enforcement agencies monitor many dangerous markets, and even anonymous browsing isn’t foolproof. Just visiting these sites can attract attention from law enforcement, especially if you interact with known vendors or download suspicious content. Malicious vendors often infect buyers with spyware, ransomware, or infostealer malware hidden in downloadable files. Some listings are nothing more than scams designed to trick people into sending cryptocurrency without delivering anything in return. Many listings involve stolen personal information, including credit card data, Social Security details, and full identity profiles.

Negative and positive numbers indicate the days prior and after the closure, respectively. Only the 33 DWMs that closed during our time period are considered in the analysis. The first major darknet market pioneered BTC trading, processing $1.2 billion before its 2013 shutdown.

Darknet market crypto crimes on the rise in 2023, $1.7B revenue — Chainalysis

• What makes this market popular is the fact that it’s less expensive compared to the rest.
• The evolving activity-driven model is an appropriate methodology for large temporal networks32 and it is implemented in the Python 3 pip library TemporalBackbone45, where default parameter values have been used.
• Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
• These advancements have not only enhanced accessibility but also improved the overall user experience, making secure online trade more efficient and reliable.
• The growth of darknet markets is deeply intertwined with the emergence of cryptocurrencies, which have revolutionized secure and anonymous online transactions.
• From digital goods to pharmaceuticals, these markets cater to diverse needs, all while maintaining a high standard of security and anonymity.
• Cypher Marketplace’s extensive product listings and secure transaction methods have made it a popular destination for dark web users.

This helps build a picture of marketplace activity without interacting with the platforms themselves. Agencies like the Federal Bureau of Investigation and Europol monitor marketplaces over long periods rather than acting immediately. This allows them to map infrastructure, track financial flows, and identify administrators and vendors. Each marketplace was assessed based on visibility over time, reported activity levels, and documented events such as shutdowns, scams, or seizures.

Securing M365 Data and Identity Systems Against Modern Adversaries

In successful cases, law enforcement can combine this intelligence with other investigative techniques to seize the online infrastructure and residual virtual currency, like in the case of the Silk Road seizure. The availability of counterfeit goods on these platforms underscores the challenges faced by legitimate businesses in protecting their brands and products from being counterfeited. The trade in fake luxury items and identification documents continues to thrive, driven by the demand for high-quality knockoffs and fraudulent credentials. Specializing in the sale of Personally Identifiable Information (PII), CVV, RDP, Stealer Logs, and various fraud-related items, the Russian Market has carved out a niche for itself since its inception in February 2019. The market accepts Bitcoin, Litecoin, and Ethereum as payment methods, catering to a wide range of users.

• Jardine also emphasized the importance of using services that actively emphasize security in the decentralized finance space.
• Dark markets often employ end-to-end encryption for communication between buyers and sellers, enhancing security and privacy.
• Using the evolving activity-driven model31, U2U pairs are divided in either stable (black arrows and respective users) or non-stable (gray arrows and respective users).
• As privacy technologies continue to evolve and cryptocurrencies gain wider acceptance, the darknet is poised for further expansion.
• It supports PGP encryption, two-factor authentication (2FA), alerts against fake sites (antiphishing), and a verification system for sellers.
• The first thing on the minds of many users when it comes to the dark web environment is illegal drugs.
• To remain anonymous about your purchases on the dark web, always use cryptocurrency as your mode of payment.

Abacus Market appeared on the scene in 2021 and quickly became one of the heavyweights among English-speaking markets on the dark web. The categories are well organized, ranging from drugs and fraud to digital products, guides, and malware.What really sets it apart is its focus on security and usability. It supports PGP encryption, two-factor authentication (2FA), alerts against fake sites (antiphishing), and a verification system for sellers. Its interface is easy to navigate, and it has a reliable escrow system, as well as allowing payments with Bitcoin and Monero. All of this has made it one of the most reliable markets still active in 2025.

Law Firm Investigates Coupang Security Failures Ahead of Class Action Deadline

A Distributed Denial of Service (DDoS) attack is designed to disrupt access to websites and other internet resources. This is achieved by overwhelming the targeted website’s server with thousands of connection requests, causing it to crash. Criminals can use this data to impersonate people on the internet and even open online accounts in their names. The main reason why people purchase these accounts is to access content that is not available on their own accounts.

Our research shows that, like most legal commodities, stolen data products flow through a supply chain consisting of producers, wholesalers, and consumers. But this supply chain involves the interconnection of multiple criminal organizations operating in illicit underground marketplaces. With law enforcement agencies improving their ability to track Bitcoin (BTC) transactions, darknet market operators and vendors are moving to Monero (XMR) as their cryptocurrency of choice. In order to investigate the role of direct transactions between market participants, we now analyse the evolution of the S2S network, i.e., the network of the U2U transactions involving only sellers. The nodes of the S2S network are active sellers (i.e., sellers that are trading at the time) and two sellers are connected by an edge if at least one transaction was made between them during the considered snapshot period.

“Last year, DNM vendors sent a significantly higher portion of their funds to DeFi than they did historically,” the report read. In 2024, DeFi played an increasing role in storing, transferring, and obfuscating illicit crypto proceeds. Fifth, we consider the lifetime of each entity i at time t, defined as the time interval between the first and the last transaction performed by the entity until time t, denoted by \(\ell _i(t)\). This feature is satisfied when \(\ell _i(t) \ge L\), where L is the fixed value of minimum lifetime. Some, such as Julia Finess, have become popular and also made a name for themselves on TikTok. “They show an affluent lifestyle with expensive apartments, luxury brands, but with a touch of illicit intrigue.” Many of Telegram’s Russian drug bloggers are most likely sponsored by new darknet drug shops.