Although CEXs remain a stable destination in the DNM ecosystem, the pattern of sending funds to them shifted in 2024, as illustrated in the chart below. Last year, DNM vendors sent a significantly higher portion of their funds to DeFi than they did historically. Throughout 2024, DNM vendors also sent far more value to personal wallets and stored funds on-chain. Retail vendors appear to be holding a greater portion of their proceeds on-chain than wholesale vendors, while wholesale vendors (those who distribute drugs in large quantities) are making greater use of DeFi. As international authorities have disrupted DNMs large and small in the last few years, cybercriminals and drug dealers have learned firsthand the consequences of running BTC-accepting DNMs given the currency’s inherent transparency. Many operators have since moved to accepting only Monero (XMR), a privacy coin with features designed to boost anonymity and reduce traceability.
‘Cutting Off A Major Supply Line’
For detailed information on the process to submit a request for removal from an OFAC sanctions list, please click here. OFAC’s Economic Sanctions Enforcement Guidelines provide more information regarding OFAC’s enforcement of U.S. sanctions, including the factors that OFAC generally considers when determining an appropriate response to an apparent violation. The market’s takedown came after years of effort from Germany, Netherlands, Romania, Spain, Sweden and the United States. Drug Enforcement Administration and Internal Revenue Service Criminal Investigation, the statement said. The charges in the superseding indictment are punishable by a maximum sentence of life in federal prison. Today the Justice Department announced criminal charges against five high-ranking members of the United Cartels.
Investigators said the seizure of Archetyp Market followed years of forensic work to trace financial flows, analyze digital evidence and map the platform’s architecture. A seizure notice now appears on the marketplace’s homepage, along with a Cyberpunk-style warning video dramatizing the police operation. Launched in 2020, Archetyp was Europe’s longest-serving drug market at the time of its takedown last week, and authorities today confirmed a number of key arrests. For example, after law enforcement took down the website of the notorious ransomware gang LockBit, the group attempted to relaunch its cyber extortion operation. LockbitSupp, the group’s administrator, opened a new website and claimed that the takedown didn’t affect his business but rather gave him additional publicity.
Dark Web Drug Busts Lead To 150 Arrests
- Nemesis was founded in 2021 and has been growing rapidly since then, according to the BKA.
- While Mega’s inflows declined by more than 50% year-over-year (YoY), Kraken DNM’s rose nearly 68% YoY.
- Past operations against cybercrime markets suggest that even though Nemesis’s infrastructure was shut down, the criminals might retain the ability to restart their operations somewhere else.
- Officials announced they recovered over two metric tons of drugs, a haul that included a hefty 144 kilograms of fentanyl or fentanyl-laced substances, alongside some 180 firearms.
- Nemesis was established in 2021 and operated as a criminal marketplace on the darknet, an encrypted network within the Internet that can only be accessed with special anonymity-enhancing browsers.
- “These people don’t just operate on one market, they cover the full spectrum of the dark web,” says Europol’s Georges.
This increase may be due in part to the closures of top DNMs, the shift to the exclusive acceptance of XMR by other active markets, and delistings of XMR by popular centralized exchanges. The below graph shows an increase in Abacus sales (in BTC) following the closure of ASAP Market in July 2023, and a further increase following some CEXs delisting XMR. Historically, DNMs have been known for the illicit drug trade, but in recent years have differentiated themselves with unique service offerings. Since last year’s Crypto Crime Report, the top performing Russia-based DNMs have held steady, but Kraken DNM overtook Mega as the leading DNM by annual revenue in 2024.
In September 2024, the US Secret Service’s Cyber Investigative Section, Netherlands Police, and the Dutch Fiscal Intelligence and Investigation Service (FIOD) seized web domains and infrastructure linked to UAPS, PM2BTC, and Cryptex. In addition to various benzodiazepines, stimulants, and psychedelics, one longstanding China-based research chemical manufacturer also sells nitazenes. The vendor’s listing of a protonitazene analog boldly states that the compound has a potency 20x greater than that of fentanyl, as seen below. Once received by the buyer, the compound could be pressed into counterfeit pills, like M30s, and further distributed to end consumers. They also sell PMK and BMK, which are precursors to MDMA and methamphetamine, respectively.
Marketplace As Big As Silk Road Had More Than 600k Users And Turnover Of ‘at Least’ €250M
- Operation SpecTor was a coordinated international effort spanning three continents to disrupt fentanyl and opioid trafficking on the darknet, or dark web.
- What current policing strategies neglect is that dark web markets are not isolated to the storefronts that are the popular target of crackdowns.
- During the investigation, law enforcement seized cryptocurrency valued at $75 million at the time of the seizures, as well as cash and precious metals.
- Historically, DNMs have been known for the illicit drug trade, but in recent years have differentiated themselves with unique service offerings.
PCMag.com is a leading authority on technology, delivering lab-based, independent reviews of the latest products and services. Our expert industry analysis and practical solutions help you make better buying decisions and get more from technology. On Monday, Europol announced it had dismantled Archetyp Market, which had been around since 2020, making it one of the “most enduring” dark web drug providers, the agency said. In the US, the arrests fell under the DOJ’s Joint Criminal Opioid and Darknet Enforcement team, which includes investigators from FBI and the United States Postal Service. J-CODE’s most recent operation, called Sabotor, resulted in 61 arrests announced in March 2019.
A series of law enforcement takedowns in the last few years have shaped the 2024 drug and fraud ecosystems. While 2024 was likely a record year for crypto crime revenue overall, darknet market (DNM) and fraud shop inflows fell, with DNMs receiving just over $2 billion in BTC on-chain, and fraud shops $225 million. The operation allowed law enforcement to secretly track drug sales and payments made on the marketplace, as well as analyze communications between the market’s operator and vendors.
Des Plaines Man Allegedly Held Delivery Driver Hostage Over Missing Item
The dismantling of Archetyp Market, one of the longest-running and largest dark web drug marketplaces, highlights international law enforcement’s coordinated efforts to combat the global illegal drug trade and address the distribution of dangerous substances such as fentanyl. As darknet markets grow more fragmented and boutique, traditional law enforcement methods are becoming increasingly ineffective. The shift toward specialized platforms with heightened security measures makes tracking illicit activity even more challenging, requiring innovative approaches and advanced tools. CACI’s DarkBlue Intelligence Suite is designed to address these exact challenges, offering comprehensive monitoring and analysis of the dark web’s most secure and decentralized spaces. With AI-enhanced threat detection, real-time dark web access through DarkPursuit, and detailed insights into evolving criminal networks, DarkBlue provides the intelligence needed to stay one step ahead in this rapidly changing environment.
Crimes Of The Times: Introducing Pandora’s Box: The Fall Of LA’s Sheriff
However, a combination of law enforcement crackdowns, increasing instability from new users flooding the dark web from Telegram, and infighting among the larger markets has triggered a shift. Many of these big markets are now engaged in cyber warfare, with vendors and operators attacking each other to assert dominance, often leading to disruptions and shutdowns. This “market cannibalization” has further destabilized the landscape, pushing vendors and buyers to seek refuge in smaller, more secure spaces.
CISA Strengthens Software Procurement Security With New Tool
Along with its listings for large pill press machines, the vendor does not hide the sale of Oxycontin and Xanax TDP die kits, which are used to press counterfeit pills. The vendor accepts BTC and XMR, and analyzing its on-chain exposure to regional CEXs and DNMs reveals that it serves customers worldwide, including in the United States, Canada, Sweden, and Russia. The Reactor graph below shows this vendor’s connection with drug vendors on Abacus Market. As reported last year, some drug shops have been outsourcing services like website hosting and payment processing. IKlad.biz and Klad.cc, shown in the chart above, are examples of those infrastructure providers. While these outfits are not traditional DNMs, their success highlights how drug vendors are scaling their operations throughout Russian-speaking countries.
Last week, two men, both in custody, were charged in federal court in Chicago with operating “Empire Market,” a dark web marketplace that enabled users to buy and sell more than $430 million in illegal goods and services around the world. On March 20, 2024, U.S., German, and Lithuanian law enforcement agencies seized Nemesis’ servers in a joint operation. Since the takedown of Nemesis, Parsarad has discussed setting up a new darknet marketplace to take the place of Nemesis with vendors that were once active on the marketplace. The investigators identified the suspects (many behind thousands of sales on illicit online marketplaces) using intelligence collected following takedowns of multiple dark web markets, including Nemesis, Bohemia, Tor2Door, and Kingdom Market. Historically, the darknet drug trade has been dominated by large, multi-purpose platforms like AlphaBay and DrugHub.
On the Reddit-style dark web forum known as “Dread,” users are trying to determine which vendors were compromised by the operation, Straight Arrow News found. The dark web is a collection of sites that are not indexed by search engines and can only be viewed with specialized web browsers designed to provide privacy and anonymity. Many sites specialize in selling illegal goods that are not readily available on the public internet. Just this week, Telegram shut down Haowang Guarantee, a sprawling black market linked to over $27 billion in illicit transactions across Asia’s cyber scam economy.
Germany’s Federal Criminal Police Office Takes Down Hydra Darknet Marketplace
Thousands of vendors advertised goods and services on Empire Market, including controlled substances, compromised and stolen account credentials, stolen and counterfeit credit card information, and counterfeit currency. The controlled substances sold by vendors on Empire Market included heroin, methamphetamine, cocaine, LSD, opioids, and others. The shutdown of Archetyp, a major dark web drug market, demonstrates that law enforcement takedowns have only short-term effects, as such markets quickly re-emerge and adapt. Persistent trade and resilient user communities limit the long-term impact of these interventions. Focusing solely on dark web markets may overlook broader digital harms occurring on mainstream platforms.
Operations
The platform’s endurance, scale and reputation within the criminal community place it alongside now-defunct darknet markets such as Dream Market and Silk Road, both notorious for their role in facilitating online drug trafficking. Archetyp Market arrived online in 2020 and grew into a significant hub for online drug trafficking. Until this month, it had evaded the law enforcement operations that took down other major dark web marketplaces. Archetyp facilitated the sale of cocaine, MDMA, amphetamines, and highly potent synthetic opioids such as fentanyl. Today (June 16, 2025), Europol announced the successful dismantling of Archetyp Market, the longest-running darknet drug marketplace, following a sweeping international operation coordinated across six countries. From June 11 to 13, 2025, law enforcement authorities in Germany, the Netherlands, Romania, Spain, Sweden, and the United States executed a series of synchronized actions targeting the platform’s administrator, moderators, top vendors, and core infrastructure.
Srinivasan also used the encrypted messaging application Wickr to communicate with and sell drugs to customers. Srinivasan received virtual currency as payment for the drugs and then routed that virtual currency through cryptocurrency exchanges. ‘This operation led by the German authorities marks the end of a criminal service that enabled the anonymous trade in high volumes of illicit drugs, including cocaine, MDMA, amphetamines, and synthetic opioids’, the statement said.
