Authorities estimate the total volume of transactions handled by the platform exceeded $224 million. While DNM and fraud shop revenues declined in 2024 following years of concerted international law enforcement efforts, these platforms have managed to sustain their operations by adopting new tactics. Fraud shops are vendors that typically operate on the dark web and facilitate the sale of stolen data and personally identifiable information (PII), which cybercriminals abuse in illicit activities like scamming, identity theft, and ransomware. One fraud shop that provided services like these, Genesis Market, saw its end last April after a coordinated, international law enforcement effort called Operation Cookie Monster closed it down, and OFAC sanctioned it.
Empowering Law Enforcement To Reduce Fentanyl Sales
To unmask his identity, agents cross-referenced this WhatsApp number with Indian visa records, which tied the number to Murarka’s real-world identity and his role as CEO of an Indian geospatial firm. From there, they identified an Apple ID linked to the same number and obtained a sealed search warrant for Murarka’s iCloud account. Data extracted included messages from Telegram, WhatsApp, and Wickr detailing cash exchange logistics, screenshots of receipts, and location data placing him at the scene of key operations. Apple records confirmed he was using multiple iOS devices to run the laundering network.
Dark Web Markets Compete For The Drug Trafficking And Illegal Pharmacy Monopoly
In addition to these tools, the market offers access to compromised accounts, VPN services, and digital identities, making it a hub for individuals involved in illegal activities like hacking, identity theft, and other forms of cybercrime. This marketplace focuses on selling stolen financial data, such as BINs (Bank Identification Numbers), RDP/VDS access, and verified crypto accounts for money laundering. This marketplace has originally appeared from an underground community (forum) which connects buyers and sellers of illicit drugs. Other reputable sellers who joined Kraken include “Shiva” operating at least since 2014 in Dark Web. Both services have extremely sophisticated network of couriers with wide inventory of illegal drugs. There is however a steep drop-off in activity between the top sellers who have done over 10,000 sales compared to the others.
- Fraud shops are services found mainly on the dark web that sell stolen data and personally identifiable information (PII), which cybercriminals use for scams, identity theft, and ransomware attacks.
- Nitazenes are a type of synthetic opioid with a similar potency to fentanyl.
- Previous studies have shown that, although the number of users and transactions is larger in markets, the trading volume in the U2U network is larger than that of markets13.
- The marketplace has a well-established team including Administrator (Professor), Vice-Administrator(-s), Cybersecurity Team, Customer Support, and multiple moderators.
- Other than the Silk Road 2.0, similar marketplaces also emerged, but they all went down sooner or later.
US Treasury Sanctions Iranian National For Operating Darknet Market Nemesis
However, trading behaviour in DWM closely resembles what is observed on regulated online platforms despite their significant differences in operational and legal nature14. Nevertheless, due to their unregulated nature, DWMs exhibit behaviours not observed in regulated marketplaces. They offer anonymity to their users by using and developing specialized tools. DWMs are accessed through darknet browsers supporting the onion routing protocol (e.g., Tor), which provides anonymous communication connections35.
Agentic AI-Powered, Intelligence-Driven Unified Cybersecurity Platform
Peijnenburg’s wallet received inflows of more than $25 million, whereas Grimm’s wallet received nearly $5.5 million. Additionally, where non-compliant cash out points are facilitating the movement of illicit funds from DNMs, regulators and law enforcement may take action to disrupt activity at the cash out point itself. For example, concurrent with the takedown of Hydra was the sanctioning of Garantex, the Moscow-based exchange that made multiple transactions with Hydra-linked addresses. Mega provides an automated exchange service and a built-in wallet to process cryptocurrencies. To further attract buyers of drugs from other underground communities, the actors behind the Mega frequently organize “Black Friday” discounts to stimulate the sellers, by doing so offering lower commission rates from their sales.
Darknet Market Revenues Rise In 2023 As Markets Develop Role Specialization
- For operations security he suggests avoiding storing conversation logs, varying writing styles, avoiding mobile phone-based tracking and leaking false personal details to further obfuscate one’s identity.
- Whether focused on fraud, hacking, or trafficking, all face increased scrutiny.
- Some are looking for illegal stuff they can’t buy elsewhere, like drugs or counterfeit documents.
- Prior to its takedown by law enforcement, narcotics traffickers and cybercriminals openly traded in illegal drugs and services on Nemesis, which was designed with built-in money laundering features.
A VPN hides the fact that you’re using Tor, which is blocked in some countries and always raises doubts because of its criminal reputation. Get the latest crypto news, insights and market analysis straight to your inbox. This shift, initially more common in Western regions, is now accelerating across Russian-speaking networks. This practice has helped maintain a level of trust within their communities, unlike their Western counterparts, which have been marred by takedowns and fraudulent closures that have shattered user confidence. Immigration and Customs Enforcement, in collaboration with Europol, the Joint Criminal Opioid and Darknet Enforcement Team, and various national and international partners, announced the results of Operation RapTOR May 22. This historic takedown, led by Europol, resulted in the highest number of seizures in JCODE’s history.
Challenges For Law Enforcement
And by focusing so heavily on these hidden platforms, authorities are neglecting the growing digital harms in the spaces we all use. Given the explosive growth of these markets, organizations must prioritize proactive threat monitoring. Axis Intelligence provides dark web surveillance solutions that help businesses identify leaked credentials, fraud attempts, and malware risks before they escalate.
The Advantages Of Buying Drugs On Darknet Markets
While centralized exchanges (CEXs) remain the dominant cash-out method, a notable shift has been toward decentralized finance (DeFi) protocols. The expanding use of cryptocurrencies by terrorist organizations and state-sponsored actors illustrates the dual-edged nature of technological innovations — providing both opportunity and risk. Ransomware actors and fraudsters are leveraging technological advancements, including cross-chain bridges and artificial intelligence, to bypass detection and scale their operations.
According to a new report by blockchain intelligence firm TRM Labs, this is a 1% increase from 2023. The data shows that Bitcoin and Tron remain the cryptocurrencies of choice for these markets. This comes as overall cryptocurrency-enabled online sales of illicit drugs grew by over 19% between 2023 and 2024. One of the key factors driving this shift is the increased focus on security. Boutique dark markets are implementing stricter security measures, including better encryption and multi-layered protections, to safeguard transactions. Buyers and sellers are often subject to vetting processes that reduce fraud and scam risks, making these platforms more reliable and secure for customers.
When looking at darknet drug markets serving Russia-based customers, Kraken Market captured 30.9% of market share, with Blacksprut and Mega Darknet markets closely following. As for drug markets serving Western customers, ASAP Market held a 25.0% share, followed by Mega and Incognito. Western drug flows in particular come from US-domiciled exchanges and trace flows from those to darknet markets. The entity “DNM Aggregator” that appears within each category refers to a service we’ve identified as being in control of multiple, disparate darknet markets. Throughout the history of the darknet market ecosystem, at different turns one marketplace has typically played the dominant role.
Law enforcement will likely continue to shift toward data-centric operations and partnerships with crypto-forensics firms to keep pace. Expect another wave of takedowns targeting emerging platforms in the next 12 to 18 months. The success of this mission draws heavily on data harvested from the takedowns of prior darknet markets. By preserving and cross-referencing seized data — such as user account details, blockchain forensics, and communications — law enforcement can map wider networks and plan future stings with precision. Archetyp Market quietly emerged on the dark web in May 2020 and quickly became a dominant force in illegal narcotics distribution. Through an extensive network of over 3,200 registered vendors, the platform listed more than 17,000 drug-related products.
These operations also serve as a warning shot to other cybercriminal networks. Whether focused on fraud, hacking, or trafficking, all face increased scrutiny. The dark web is no longer an untouchable sanctuary, and even privacy-centric cryptocurrencies can’t fully shield operations from discovery. The use of Monero, a privacy-focused cryptocurrency, was a significant obstacle.
