Cybercrime enablement represents flows from ransomware, stolen funds, malware, or fraud shops to darknet markets. Torzon market made its debut in September 2022, and ever since, it has been on an upward trajectory. In fact, it now features more than 11,600 illegal items, which include hacking tools, hard drugs, and all types of cybercrime services.
Prices of hacked cryptocurrency accounts still remain overall the highest among all hacked online accounts. This indicates that hacking such accounts still remains extremely profitable. As in the previous 3 years, we conducted research into the supply and prices of various goods and services sold by cybercriminals on the dark web. The chart above shows that ASAP and Mega Darknet markets led the large retail and wholesale segments respectively. Looking closer at ASAP Market inflows, it won some share of revenue across all drug purchase types, receiving 37.1% of social supply, 35.7% of large retail, 16.5% of small retail, and 13.5% of wholesale purchases.
Drughub Market specializes in pharmaceuticals, offering 15,000+ listings and $2 million monthly via BTC. With 8,000+ users and 600+ vendors, it commands a 10% share of darknet drug trades—a rising star since 2023. Archetyp Market delivers 28,000+ listings and $3.5 million in monthly trades using BTC and XMR, securing a 6% market share.
I’ve used it a handful of times; deliveries landed smooth via DeadDrops—plain packaging, no fuss. It’s not the biggest player like Abacus, but it’s got a loyal crew and uptime that rarely blinks. If you’re into a darknet market that feels cutting-edge and keeps your coins safe, ASAP Darknet Market’s a gem—just don’t expect a massive catalog yet; it’s more about precision than sprawl.
Also, previously, the Tor browser was vulnerable to JavaScript attacks as it provided hackers a pathway to track your activities by using the session details. Therefore, for security reasons, disable JavaScript on the Tor browser and enjoy an anonymous browsing experience on the dark net. You can find featured listings on the homepage and browse the products of your choice.
Cartels reportedly used USDT to fund operations, sometimes profiting from price gaps across different crypto markets. The ongoing move toward decentralized platforms suggests the crypto drug ecosystem will remain fluid, creating new enforcement challenges. Last darknet markets 2026 month, blockchain analytics firm Chainalysis uncovered direct financial ties between Mexican drug cartels and Chinese suppliers of fentanyl precursors through crypto transactions. With a FlareScore of 64/100, the website presents a warning level of risk.
Our analysis focuses on Bitcoin – the most popular cryptocurrency both on DWMs27,28 and in the regulated economy29,30. We focus on two kinds of transactions, occurring (i) between the user and a DWM and (ii) between two users of the same DWM. The result is 40 distinct marketplace ego networks containing user-DWM and U2U transactions, whose typical structure is depicted in Fig. In each network, links are directed and the arrows point at the receiver of Bitcoin. Since users often migrate from one DWM to another12 and become users of multiple DWMs, the 40 ego networks are not isolated but can be combined to form one full network, as shown in Fig. “Over the years some markets … developed a robust catalog of illicit services like money laundering, fiat offramping, and products that enable cyber-criminal activities like ransomware and malware attacks.
The market offers things like malware, fake documents, and financial fraud services. This market is not open to the general public and is subject to a thorough vetting process to ensure its security. In fact, WeTheNorth is more of a private club than an open market – something its operators want.
In Grand Theft Auto Online, players who purchase warehouses and garages for illicit cargo and stolen cars can buy/steal and sell them through trade on the “SecuroServ” syndicate website. We reviewed dark web marketplaces by analyzing publicly available cybersecurity reports, threat-intelligence research, and historical records. This approach allows evaluation without direct interaction or participation. Darknet marketplaces in 2025 illustrate a resilient and evolving underground economy. Major active platforms include Abacus, Russian Market, BriansClub, and Exodus.
Our work unveils sophisticated patterns of trade emerging in the dark web and highlights the importance of investigating user behaviour beyond the immediate buyer-seller network on a single marketplace. Today, darknets are populated by a vast array of users, ranging from privacy-conscious individuals to cybercriminals, hacktivists, and nation-state actors. These hidden networks provide a platform for illegal activities that include the sale of stolen data, hacking tools, weapons, counterfeit currency, and narcotics. Dark markets, often accessed through specialized marketplaces within darknets, are breeding grounds for underground economies, where users can engage in transactions while evading law enforcement and ethical oversight. The goods on sale range from stolen credit card data and forged documents to illegal drugs, weapons, malware as a service, and hacking tools.
Interestingly, the S2S network shows an intermediate level of resilience, which suggests that the S2S network might play the role of a supply chain network on the dark web. Furthermore, after a shock, the activity of buyers is resumed almost immediately, while the activity of sellers recovers more slowly. These different regimes suggest that the ecosystem’s resilience is mainly supported by the high demand of buyers rather than the response of the sellers.
One of the most notable developments is the integration of cryptocurrencies as the primary medium of exchange. Bitcoin, Monero, and other privacy-focused coins have become indispensable for users seeking to conduct transactions without leaving a trace. The decentralized nature of these currencies ensures that financial activities remain untraceable, fostering trust among participants.
According to Dark.fail, recently, the darknet marketplace’s head moderator “Se7en” sharply criticized the phishers, LE cooperators, and doxxers of the community, and this event could be a consequence of that. Abacus Market operated as a central deposit wallet, multisignature darknet marketplace supporting both Bitcoin and Monero cryptocurrencies. Abacus Market, the largest Bitcoin-enabled Western darknet marketplace, has likely executed an exit scam after going offline in early July 2025, according to blockchain intelligence firm TRM Labs. Even though DuckDuckGo is the Tor browser’s default search engine, it doesn’t index dark web websites, which means you won’t be able to find .onion sites with it. Riseup is a volunteer-run collective that offers secure chat and email services primarily used by progressive activists and social justice communities. It’s maintained by an independent organization committed to digital privacy and security.
Launched after the takedown of AlphaBay in 2021, Abacus Market has rapidly risen to prominence. It features over 40,000 listings including narcotics, counterfeit items, hacking tools, and stolen data. The marketplace is well-known for its bug bounty programs and robust security mechanisms, including mandatory 2FA. Nemesis Market is a relatively new wallet-less shop on the dark web where you don’t need to deposit any amount in your wallet before buying products from here. The platform allows buyers to review the vendor’s products and services, so it’s easy for them to decide if the vendor is reputable or just scamming them.
Geopolitical tensions will likely fuel the rise of hacktivism and ransomware in the Middle East. Hacktivist attacks have already evolved from denial-of-service operations to data leaks and critical compromises, a trend expected to grow. In 2025, this trend is expected to continue, pushing cybercriminals to adopt more sophisticated and anonymous operating models, such as closed, invitation-only forums. As the world navigated an evolving cybersecurity landscape in 2024, trends in malware, ransomware, and dark web activities highlighted the increasing sophistication of cybercriminal tactics. This privacy-focused digital currency has become increasingly popular among darknet operators seeking to evade traditional financial monitoring systems. To access them, copy and paste the hyperlinks provided into the Tor browser.
The total trading volume users sent to DWMs was $3.8 billion, volume received from DWMs was $3.7 billion, while the volume exchanged through U2U pairs reached $30 billion. In Figure S3, we illustrate the number of transactions, trading volume, and lifespan of U2U pairs. (a) Total number of users interacting with a DWM against the total number of users forming U2U transactions. (b) Trading volume in dollars sent to a DWM compared with the total trading volume in its surrounding U2U transactions. The dashed line is the bisector and allows to easily compare the two trading volumes. (c) Total monthly trading volume sent to all DWMs and exchanged in all unique U2U pairs.
Another key distinction is that access to darknet markets requires the use of special software such as the Onion Router, or TOR, which provides security and anonymity. Dark markets, on the other hand, are platforms within darknets where illicit transactions occur. These marketplaces facilitate the exchange of everything from stolen credentials and drugs to weapons and hacking tools.
To answer this question, we consider the impact that the COVID-19 pandemic has had on the evolution of stable U2U pairs. Previous studies reported that COVID-19 had a strong impact on DWMs due to delays and damage to the shipping infrastructure caused by border closures37,38. We start by investigating the number of new stable U2U pairs and their trading volume during the COVID-19 period. Users in stable pairs meeting both inside and outside DWMs have been growing over the last two years, since the shutdown of AlphaBay9, the largest DWM at the time. In 2020, a total of 6778 pairs of users in stable pairs met inside a DWM, corresponding to 192% of the 2019 level and to 255% of the 2018 level, see Fig. Pairs of users in stable pairs meeting inside a DWM traded for a total of $145 million in 2020, which corresponds to 252% of the 2019 level, and to 593% of the 2018 level, see Fig.
BriansClub remains a long-standing credit card data shop since at least 2014. Despite a 2019 breach that exposed over 26 million credit cards, it continues to operate, indicating sustained trust in its data pipelines. Hacked social media accounts are evidence that cybercriminals have a diverse appetite for Dark Web data products.
Criminals can use this data to impersonate people on the internet and even open online accounts in their names. The main reason why people purchase these accounts is to access content that is not available on their own accounts. The hacked accounts may belong to a country that has a larger selection of streaming sites than their own.
This underlines the economic importance of U2U transactions in the Bitcoin ecosystem relative to DWMs. Essential advice for navigating darknet marketplaces safely and effectively in 2025. However, the success of law enforcement is just one possible explanation for this decline. This theory is supported by the fact the number of active darknet markets themselves are also on the decline. Darknet market vendors have suffered—as legitimate vendors have—through a strained postage and shipping network on account of COVID-19.
I’ve been poking around these places for a while now, from the giants like Abacus to the old-timers like Vice City. This isn’t just a quick list; it’s the full scoop on what they offer, how they keep things tight, and why they’re worth your time—or not. Whether you’re new to the dark web or a vet who’s seen it all, you’ll find something here to chew on. Below, I’m breaking down each market with everything I’ve picked up—listings, quirks, the works. Each marketplace is a star-graph where the central node is the marketplace, and the leaf nodes, i.e., the first-neighbors, are the marketplace users. Therefore, all transactions involving the market have the market either as a source or as a destination node.
We deliver contextualized, actionable intelligence through our dedicated platform or API integration, ensuring that you can respond effectively to darknet threats. Notably, Abacus explicitly forbids highly dangerous goods, including weapons, explosives, and exploitative material, which has helped maintain a relatively favorable reputation among its user base. While this topic may seem distant for most people, understanding how these spaces operate is crucial.
Its builders created it from the ground up to offer a “cleaner” and more organized shopping experience than most. Operating more like a legit e-commerce platform (surprisingly), the market operates a 14-day escrow system, but it lets you opt for Finalize Early (FE) if you trust a vendor. Moreover, the layers of encryption and the bounce of your data from node to node effectively mask your IP address, enabling online anonymity. It allows access to the .onion sites on the dark web that you won’t find using a regular browser. For a local machine configuration, he recommends a computer purchased for cash running Linux, using a local Tor transparent proxy. For operations security he suggests avoiding storing conversation logs, varying writing styles, avoiding mobile phone-based tracking and leaking false personal details to further obfuscate one’s identity.
Likewise, law enforcement agencies each day continue to fine-tune their strategies to get past these networks. The first thing on the minds of many users when it comes to the dark web environment is illegal drugs. In fact, the Guardian referred to darknet markets as “the eBay of drug dealing,” and rightly so, illegal drugs are found in almost all the shops on the dark web. The raw dataset consists in transactions between Bitcoin addresses, which is initially preprocessed by Chainalysis Inc. (see Section S2). The resulting dataset consists in transactions between entities, that group together clusters of Bitcoin addresses.
It runs an onion site to help like-minded people mobilize more securely and anonymously. SecureDrop is an anonymous file-sharing platform designed for secure communication between whistleblowers and journalists. While anyone can use it, it’s built for high-stakes exchanges, making it overkill for routine file sharing or data backups.
However, unlike the multiseller network, the S2S network recovers during 2019 and 2020, but slower than the multibuyer network recovery. Therefore, the S2S network appears to be more resilient than the multiseller network but less than the multibuyer network. The same pattern is observed in the whole S2S network (see Supplementary Information Section S5). Nevertheless, by analysing the income of each multiseller, we observe that the median income still reflects their high income, as shown in Fig. Individually, they are able to yield significant high incomes compared to other types of sellers.
Nexus Market is widely described as a second‑generation, general‑purpose dark‑web marketplace that gained traction through 2024–2025. Community trackers place its launch in late 2023 and note a focus on stability, moderation, and a familiar “escrow + vendor‑reputation” model typical of modern DNMs. Public sources also indicate support for both Bitcoin and privacy‑centric coins, aligning with broader ecosystem trends. To remain anonymous about your purchases on the dark web, always use cryptocurrency as your mode of payment. If a seller encourages you to opt for other well-known and commonly used payment methods, then the person is likely to be a scammer, and you must not make any deal with them. Despite using a VPN, there’s always a risk of the VPN leaking your IP address through DNS or WebRTC leaks or misconfigurations when on a dark web forum or marketplace.
Cybersecurity companies and researchers monitoring darknet markets face legal and ethical restrictions. Legally, they are limited to observing publicly accessible areas using tools like the Tor browser, without engaging in unauthorized access or illegal transactions. Brian’s Club has been around since 2014 and remains one of the most well-known credit card shops on the dark web.
Our study indicates that a much higher number of highly active DWM users, on the order of tens of thousands, is involved in transactions with other DWM users. Moreover, our analysis paves the way to a deeper understanding of U2U transactions in online marketplaces. Recent results have shown that transaction networks and activity on DWMs and regulated online marketplaces share several robust macroscopic properties43. One might therefore hypothesise that U2U trading is also a prevalent feature on regulated online marketplaces. We have shown that the U2U network is resilient to abrupt external shocks, such as marketplace closures, and does not need the centralised structure of DWMs to survive.
No comments found.
Leave a Reply