Blog

The following month RuTor retaliated, hacking WayAway and posting screenshots of the breach, arguing that WayAway’s security was too weak to be trusted. Days later RuTor was targeted for another round of cyber attacks, this time by Killnet. Amid the cyber warfare between those vying to succeed Hydra, Russia’s drug trade, most of it orchestrated via darknet marketplaces continues almost in plain sight. The Hidden Wiki is a longstanding directory of dark web sites that offers a way to browse onion services. It’s been around for many years and helps users navigate the dark web by curating links to various resources.

🛡️ How Axis Intelligence Strengthens Cybersecurity

Unfortunately, many dark web websites are devoted to the illegal trade of leaked personal information. If you’ve ever experienced an uptick in phishing attacks and spam after a data leak or breach, it may be because your personal information has been posted to the dark web. Policing involves targeting specific activities of the private web deemed illegal or subject to internet censorship.

Cloned Credit Cards and Cardholder Data

This indicates that hacking such accounts still remains extremely profitable. As in the previous 3 years, we conducted research into the supply and prices of various goods and services sold by cybercriminals on the dark web. As far as financial recourse for victims, some banks and insurance companies have provided payouts and will include those funds as damages in lawsuits against Genesis Market cybercriminals. As for Genesis Market cybercriminals located in the Netherlands, three have already been convicted and received prison sentences considered severe for that jurisdiction. The third convicted cybercriminal — the biggest Dutch user and the number 10 user worldwide — received a four-year sentence.

• Specializing in the sale of Personally Identifiable Information (PII), CVV, RDP, Stealer Logs, and various fraud-related items, the Russian Market has carved out a niche for itself since its inception in February 2019.
• In this article, you’ll discover the key players in 2025, how they operate, their histories, and the risks involved.
• Developers introduced advanced techniques, advertising subscriptions ranging from $100 to $20,000.
• In total, darknet markets and fraud shops received $1.7 billion last year, a rebound from 2022 — the year that saw the sizable Hydra Marketplace close.
• The darknet is a mysterious and often misunderstood part of the internet, attracting both intrigue and concern.
• Its impressive anti-DDoS protection feature and easy-to-use interface make this marketplace stand out among the others.
• Facebook’s onion mirror allows people to access it in countries that block the platform, allowing people to connect across digital borders.

AI Supercharges Attacks in Cybercrime’s New ‘Fifth Wave’

It offers numerous categories of products, most of which feature illegal products. Just like Alpha Bay, Drugs and Chemicals is one of the most popular product categories in the Empire Market. Nearly half of the marketplaces launched in 2024 accepted only Monero, representing a sharp increase from just over one-third in 2023, signaling a growing preference for enhanced privacy and anti-surveillance capabilities. Between June 1 and June 27, 2025, average daily deposits to Abacus totaled USD 230,000 across 1,400 transactions, but this plummeted to just USD 13,000 across 100 deposits from June 28 to July 10, 2025. Ransomware groups are anticipated to split into smaller, independent units, making them harder to track.

Regional websites

These marketplaces facilitate the exchange of everything from stolen credentials and drugs to weapons and hacking tools. The anonymity and encryption provided in dark markets create a haven for cybercriminals and nation-state actors to buy and sell dangerous assets while evading detection. The darknet market ecosystem has undergone significant changes over the years, evolving from the days of Silk Road to the diverse and sophisticated platforms we see today. From Abacus Market to WeTheNorth, the leading markets of 2025 offer a wide range of illicit goods and services, each with unique features and transaction methods.

Anonymity Through Tor

Dark web markets have exploded in scale and reach in 2025, becoming the most dangerous hubs for trading drugs, stolen data, and hacking tools. These anonymous marketplaces—operating mainly on the Tor network—are now a primary threat vector for businesses and cybersecurity professionals. One of the key factors contributing to the growth of darknet markets is their ability to adapt to changing technological landscapes. The use of Tor networks and encrypted communication ensures that users can operate with a high degree of anonymity. Additionally, the development of user-friendly interfaces has made these platforms more accessible, attracting a broader audience.

What happens if your data is sold on the dark web?

As Hydra did, many of these markets have continued the tradition of including drug harm reduction information for drug buyers, such as providing drug testing and medical advice. “The RuTor forum has launched a series of webinars on medical topics, including first aid and overdose scenarios,” said Aleksey Lakhov, of St. Petersburg-based drug project Drugmap.ru. But Russians fleeing the country since the war have still been able to buy drugs on the dark web. In Georgia, on its southern border, where more than 100,000 Russians have fled, there is Matanga, a local Russian-speaking darknet market offering the same “treasure hunt” buying system as back home. The report said Solaris, a platform which has since been hijacked by Kraken, had sent KillNet $50,000. On New Year’s Eve people in Moscow spotted what looked like an up-and-coming tech startup projecting its logo onto the sides of various buildings.

Table of contents

By contrast, the English language ASAP market, the largest non-Russian darknet market, accounts for less than 10 percent of dark web sales. The marketplace’s operators appear to have disappeared with users’ cryptocurrency funds, marking another significant blow to the Western darknet ecosystem following the law enforcement seizure of Archetyp Market in June 2025. While not an onion site, Tor Metrics can provide a fascinating peek “under darknet markets the hood” of the dark web. It tracks Tor user activity by region, showing trends in access and adoption without collecting personal data. These insights help researchers and privacy advocates understand where Tor is most relied upon, often highlighting global patterns in censorship, surveillance, and the demand for online anonymity. DuckDuckGo is a privacy-focused search engine that works as Tor browser’s primary search engine.

– Silk Road Launch

To analyse the connectivity of the whole ecosystem, i.e., how markets are connected with each other, we consider sellers and buyers that are simultaneously active on multiple platforms. In particular, multihomers that are sellers in multiple markets are multisellers, and similarly for buyers we have the multibuyers. Specifically, to be classified as a multiseller, a user must be classified as a seller in at least two markets simultaneously. The multihomers play a crucial role in the ecosystem because they act as edges between markets. While there may occasionally be multihomers who are active in several markets simultaneously (see Supplementary Information Section S3), multihomers predominantly operate in at most two markets throughout the period of observation. Hence we do not distinguish multisellers by the number of markets in which they operate.

How Law Enforcement Impacts Marketplace Stability

• When looking at darknet drug markets serving Russia-based customers, Kraken Market captured 30.9% of market share, with Blacksprut and Mega Darknet markets closely following.
• Dark markets continually adapt and evolve to stay ahead of law enforcement and security measures.
• After a major external shock in 2017, the S2S network shrinks but, unlike the multiseller network, recovers, and grows again (though slower than the multibuyer network).
• Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products.

Bitcoin, Monero, and other privacy-focused coins have become indispensable for users seeking to conduct transactions without leaving a trace. The decentralized nature of these currencies ensures that financial activities remain untraceable, fostering trust among participants. In 2019, the FBI started its investigation into Genesis Market and enlisted other government agencies and law enforcement organizations across the world, working towards the market’s closure on April 4, 2023. As part of the investigation, the Dutch National Police took the lead on cybercrime prevention, and Van Well shared his insight on the sophistication of the fraud shop’s operation. Customer reviews found on the Abacus site indicate that some of its American vendors sell drug products laced with fentanyl.

Is accessing the dark web illegal?

These lists are regularly updated to reflect the latest trends, ensuring that traders can access the most secure and innovative markets. The emphasis on transparency and community feedback has further solidified the reputation of these platforms. Throughout the history of the darknet market ecosystem, at different turns one marketplace has typically played the dominant role. The last several years’ examples include Silk Road, AlphaBay, Wall Street Market, and Hydra, most recently. Historically, as law enforcement closed each dominant marketplace, a new leader emerged. We can see this pattern on the chart below, which shows the level of market share controlled by the dominant market of each epoch.

Then, after operation Bayonet, the number of sellers in all categories and multisellers significantly drops, as shown in Fig. Notably, the number of multisellers suffers the largest drop of \(-99\%\) by the end of the first quarter of 2018. Interestingly, while the other categories of sellers show signs of recovery relative to their previous levels, the number of multisellers remains low after that shock (see Supplementary Information Section S4). He said the proceeds from ransomware attacks, as well as investment schemes, violent extremism and child sexual abuse material, are also being laundered through Russian darknet markets. Empire is one of the two biggest darknet markets globally, the other being Russia’s Hydra market. Launched in February 2018; the Empire market is heavily inspired by Alphabay, with LTC, BTC, XMR, PGP 2FA, and MultiSig features.

We found several thousand vendors selling tens of thousands of stolen data products on 30 darknet markets. These vendors had more than $140 million in revenue over an eight-month period. ASAP is a tech nerd’s playground—accepting BTC, LTC, ZCash, and Monero, it’s got options for days.

However, in April 2022, this site went offline after American and German federal government law enforcement agencies seized the website servers. It’s recommended not to use new alternative links, as they could just be planned exit scams. The vendors aren’t required to register or apply for a vendor account while using this platform. It ensures the buyer’s identity is kept hidden and accepts payments through cryptocurrencies, including Bitcoin, Litecoin, Ethereum, and Monero. Moreover, the layers of encryption and the bounce of your data from node to node effectively mask your IP address, enabling online anonymity.

Author & Researcher services

• Darknet markets typically incorporate anonymous access through the Tor network, further enhancing user privacy.
• The resulting data set includes for each transaction the source and destination entities, the time, and the value of the transaction.
• KEY TAKEAWAYS If you’re in a hurry, here’s a quick list of darknet search engines of 2026 list…
• Transactions within these marketplaces typically leverage cryptocurrencies—most commonly Monero, Bitcoin, and privacy-centric digital currencies developed specifically to enhance transaction anonymity.
• Jardine emphasized that illicit cryptocurrency transactions represent only a minor share of total crypto activity.
• This is when you will develop a crucial sense of cybersecurity both online and in everyday life.
• Multiple markets emerged to fill the void and, in doing so, created a thriving ecosystem profiting from stolen personal data.

As cryptors, loaders, and stealers become more sophisticated, and underground markets remain resilient, organizations must prioritize robust cybersecurity measures in 2025. Hansa was an online darknet market which operated on a hidden service of the Tor network. Archetyp Market functioned as a Tor-based hidden service, accessible only through specialized darknet browsers that utilize onion routing protocols to anonymize user traffic and location data. In many places, including the U.S., the UK, and the EU, accessing the dark web is legal for legitimate purposes. However, many sites on the dark web host illegal content or activities, and engaging with those can lead to serious legal consequences. In some countries, like Russia or China, dark web access itself may be blocked or penalized.

• These efforts demonstrate a robust approach to tackling illegal activities online.
• The pursuit of privacy and security will remain at the forefront, driving the evolution of these clandestine platforms.
• One of the key factors contributing to the growth of darknet markets is their ability to adapt to changing technological landscapes.
• Both Agartha and Cartel earned enough revenue within the 35-week period we tracked them to be characterized as midsize companies, earning $91.6 million and $32.3 million, respectively.
• It doesn’t use JavaScript, meaning the website won’t track your activities or exploit vulnerabilities.
• At CloudSEK, we combine the power of Cyber Intelligence, Brand Monitoring, Attack Surface Monitoring, Infrastructure Monitoring and Supply Chain Intelligence to give context to our customers’ digital risks.
• In the first 24 hours of launching Check your hack, two million people took advantage of the service.

With 25,000+ users and 3,000+ vendors, it’s the gold standard for escrow security and scale. The main types of goods and services on darknet markets include illicit drugs, stolen data, hacking tools, and counterfeit items. Marketplaces like Cypher specialize in selling fraudulent documents and stolen credit card data, while platforms like BidenCash draw in potential buyers by releasing stolen data for free. This strategy not only advertises their services but also fuels further criminal activities by providing the raw materials for identity theft and financial fraud.

What types of marketplaces can you find on the dark web?

This structural change is reflected in the median net income of sellers and buyers, as shown in Fig. While the curves for the seller and buyer median net income were negatively correlated before Silk Road’s shutdown, after that moment they became positively correlated. Specifically, sellers show a trend of increase and buyers a trend of decrease in their median net income before the shutdown.

From identity theft to law enforcement surveillance, the dangers are real — and often underestimated. Dark web markets work much like regular e-commerce websites but with extra layers of anonymity and encryption. Buyers browse listings, place orders, and pay with cryptocurrency — typically Bitcoin or Monero — to obscure transaction trails. During the second half of 2022, law enforcement cracked down on a large number of darknet markets, temporarily disrupting the supply of such illicit goods. In 2023, Chainalysis discovered that some popular fraud shops rely on payment processors as a way to reduce their own costs, add efficiency to their operations, and perhaps add a layer of security to transactions.