ICIJ also found that some of the biggest blockchain analytics firms, which position themselves as industry watchdogs, are hesitant to publicly name mainstream cryptocurrency exchanges in relation to dirty money. Automated swapping services that let users switch cryptocurrencies without any due diligence can also help obscure the origins of coins or tokens before they reach the exchanges. But police often struggle to act on illicit cryptocurrency movements because the assets frequently pass through numerous anonymous wallets. The industry claims cryptocurrency is easier to monitor than standard currency because transactions are recorded on a blockchain. Funds from a notorious ring of Chinese traffickers of fentanyl and other drugs flowed to various accounts at OKX, and a Russian money launderer specializing in moving cryptocurrency for North Korea’s weapons program maintained an account at HTX, ICIJ learned.
AlphaBay & Hansa 2014 2017 Operation Bayonet
The number of actors in the ecosystem is affected by several factors, especially market closures. In panels (f, g), we show the PDF of the total money received by each seller and the total money sent by each buyer, respectively. In panel (a), we show the total quarterly trading volume in USD. Although it shows fluctuations, including those caused by external shocks, the ecosystem exhibits a positive growth trend in terms of trading volume. The total quarterly trading volume is shown in Fig.
Cyble Titan Endpoint Security
- The dark net is famous for being a hub of black market websites for buying and selling products and services.
- It specialized in narcotics fentanyl, heroin, cocaine, stolen financial data, fake documents, and even in house money laundering/mixing services.
- By aggregating verified links and providing up-to-date information, these lists reduce the time users spend searching for reliable markets.
- Although Bitcoin transactions are not inherently private, darknet users have found ways to enhance anonymity through coin mixing services and privacy-focused wallets.
With constant updates and new providers entering the market, Exodus is positioning itself as a major player in the digital underworld of credential theft. It also has a rating system for sellers and automatic payments.However, in 2019, it suffered a major leak of more than 26 million records, which was a serious blow to its reputation. You won't find drugs here, but you will find tons of credentials, RDP access, CVVs, and records stolen using malware.The platform works with data collected by well-known malware such as Lumma, RedLine, Raccoon, Vidar, and Aurora.
As a consequence, our method returns generally fewer sellers than other estimates25,26,27,28,29,30,31,32,33. It is worth noting that parameters were set conservatively in order to avoid false positives in the classification of sellers. The five steps of the classification of entities as buyer and sellers.
Dark web markets are like hidden online stores, except instead of selling clothes or technology, they specialize in illegal products and services. Bitcoin, designed to enable peer-to-peer financial transactions without intermediaries, would catalyze more than financial freedom; it would become the lifeblood of an Internet underworld. When it comes to making transactions on the darknet, one of the most commonly accepted forms of payment is Bitcoin.
AlphaBay Market
Millions in crypto were recovered, and top Russian vendors and buyers were exposed to investigators. Servers were seized in Germany and cryptocurrency wallets frozen 543 BTC, €23M. Unlike Western markets, Hydra was Russian language only and became the dominant hub for Eastern European and global cybercrime.
The empty point on the multiseller median income line demarcates the quarter with only two multisellers. (b) The number of buyers for each category and multibuyers per quarter. (a) The number of sellers for each category and multisellers per quarter. From the last quarter of 2013, U2U-only sellers become the largest category of sellers and remains as the largest throughout the rest of the observation period. Although Hydra is not a single dominant market as Silk Road was, its dominance is marked by a high market share, consistently staying above 80% in the last two years. To corroborate this switch of trend, first, we compute the Pearson correlation coefficient between the seller and buyer time series of the monthly median net income before and after each month.
Some marketplaces explicitly ban the trade of fentanyl, while others claim to prohibit it but fail to enforce the rule. While this figure may seem substantial, it is dwarfed by the total volume of cryptocurrency transactions worldwide. According to Chainalysis data, only 0.14% of total crypto transactions—equivalent to approximately $50 billion—are linked to illegal activities. Eric Jardine, a cybercrime research lead at Chainalysis, noted a substantial increase in Bitcoin inflows into these marketplaces since Monero’s delisting. The BidenCash marketplace domains will no longer be operational and will be redirected to a U.S. law enforcement-controlled server, preventing future criminal activity on these sites.
Crypto Money Laundering Tactics
“For a decade, Sterlingov managed a cryptocurrency mixer that criminals used to launder millions of dollars linked to cybercrimes, narcotics sales, and child exploitation,” said Assistant Director in Charge David Sundberg. Today, a jury returned guilty verdicts on all counts — showing that no matter where you operate, if your cryptocurrency service reaches the United States, you must abide by U.S. law.” Investigators obtained records of Sterlingov’s true-name accounts at several cryptocurrency exchanges. Based on Bitcoin Fog’s transaction activity over time, Sterlingov made millions in commissions from Bitcoin Fog transactions. Over the course of its decade-long operation, which stopped only when Sterlingov was arrested and detained, Bitcoin Fog moved well over 1.2 million Bitcoin (BTC) – valued at approximately nearly $400 million at the time of the transactions. “Through his illicit money laundering operation, Sterlingov helped criminals launder proceeds of drug trafficking, computer crime, identity theft, and the sexual exploitation of children.
Multiseller Network
The market owners set up a phishing website to get the attacker's password, and subsequently revealed collaboration between the attacker and the administrator of Mr Nice Guy's market who was also planning to scam his users. From late 2013 through to 2014, new markets started launching with regularity, such as the Silk Road 2.0, run by the former Silk Road site administrators, as well as the Agora marketplace. In October 2013, Project Black Flag closed and stole their users' bitcoins in the panic shortly after Silk Road's shut down. The months and years after Silk Road's closure were marked by a greatly increased number of shorter-lived markets as well as semi-regular law enforcement takedowns, hacks, scams and voluntary closures.
JPMorgan Rumored To Short MicroStrategy, Igniting Crypto Frenzy
This change persists until the end of the observed period of the data set (also see Supplementary Information S4). Then, between 2017 and 2018, there is a drastic structural change in the multiseller network structure due to operation Bayonet, after which the connections almost vanished. During 2016 and 2017, the edges are polarized by AlphaBay, the dominant market (see Fig. 3). Until 2012, there is only one active market, namely Silk Road market, and hence no multihomer activity. The evolution of the multiseller network is shown in Fig. 2a, where the overall ecosystem volume quickly recovers after market closures.
WhiteBIT, a Lithuanian exchange, sent at least $8 million more directly into Magomedov’s wallet, which sent an additional $5 million to accounts at HTX, then called Huobi, according to data that ChainArgos compiled for ICIJ. In response to questions from ICIJ about this account, a Kraken spokesperson said it cooperates “with law enforcement authorities globally, including on matters such as” the Treasury Department’s sanctioning of the wallet address in question. Authorities also said the two networks were funding ransomware groups and “Russian espionage operations.”
In particular, do stable pairs need the DWMs to survive? But are DWMs and the U2U network truly interdependent? Having mapped the behaviour of stable pairs, we now consider their temporal evolution. When we look at the trading volume with DWMs, we find qualitatively similar results.
- The finding that multisellers and, in specific cases, multibuyers play a central role in connecting the ecosystem, thus contributing to its resilience, may illuminate how to better target future law enforcement operations.
- These ancient whales can come from several backgrounds, like early crypto miners or unlaundered stolen assets.
- Don’t have Elliptic backing up your crypto AML transaction monitoring or compliance operations already?
- Silk Road’s demise proved that even Tor hidden sites could be penetrated by good detective work, prompting many users to flee to successor markets.
- In late June 2025, users began reporting withdrawal issues with Abacus Market, which typically indicates an impending exit scam.
Check out our article on the 10 best browsers for surfing the dark web and find out which one is the safest, fastest, and most reliable for maintaining your privacy.These markets have come a long way since the days of Silk Road and AlphaBay, which were the first major pioneers of anonymous commerce on the darknet. Additionally, Bitcoin offers a certain level of anonymity for users making transactions on the dark web. While not based in Australia, Abacus Market gained strong traction with local darknet users by embracing cultural references, supporting Australian vendors, and featuring a dedicated moderator from the region.
To track the transactions of markets and users as entities, the data need to be pre-processed in order to map groups of addresses into entities. In particular, we analyse networks of ‘multihomers’, defined as users that are simultaneously trading in multiple markets. This ecosystem, composed of the dark web marketplaces (DWMs) and the network of user-to-user (U2U) transactions11,12,13, has proven to be sensitive to changes in demand for goods and services and resilient against external shocks5,7,14,15.
Blockchain analytics tools were in their infancy and crypto transactions were assumed to be anonymous. Real-time insights on global crypto regulation, straight from Elliptic’s experts Detect hidden crypto exposure in fiat transactions. Real-time crypto blocklists for exchange protection
