One particularly revealing moment came in February 2024, when Incognito users reported that BTC withdrawals were disabled—likely part of a deliberate “exit scam.” Lin, or others acting on his behalf, threatened to leak vendor identities to law enforcement unless paid. That extortion threat, combined with increased tracing and investigative pressure, led many users to flee the platform, dramatically reducing deposits and facilitating law enforcement’s final takedown. Designed to resemble a legitimate e-commerce platform, Incognito offered a slick user experience with branding, advertising, and customer support.
Underground Opioid Trading
Co-occurrence of the same opioid suppliers across different anonymous marketplaces. We observed the same listings posted in different marketplaces and illustrate the dependency of the same opioid listings among different marketplaces. Note that we determined if 2 listings are identical by matching the same elements (ie, listing’s title and description information and the vendor’s name) in 2 listings. We observed that the marketplaces of Agora and Evolution shared 530 opioid listings from 290 unique supplier IDs. The opioid commodity with most listings across different marketplaces was #4 White Vietnamese Heroin, which can be found in the marketplaces Agora, Evolution, Hydra, and Pandora. Scammers may request payment for their services or claim that certain fees need to be paid to resolve the issue.
How Tor Worked
“This is so fucked up man, we have the right to do whatever we want to our bodies.” “During Operation SaboTor, our law enforcement partners spoke with over 100 Darknet drug buyers. Approximately 61 Darknet drug traffickers were arrested, 51 firearms were seized, almost 300 kilograms of drugs, and over $7 million in cash and cryptocurrency were seized,” FBI Special Agent Maggie Blanton with the High-Tech Organized Crime Unit said in the video. However, the widespread use of the Russian template internationally allows authorities to anticipate many of the features of dead drop activity and leverage the expertise of blockchain intelligence companies with experience tracking Russian-language DNMs. Increased social awareness of the dead drop phenomenon and close cooperation between law enforcement and their private sector partners can help counter this rising threat. In the UK, the “Breaking Bad” drugs forum launched its own dead drop initiative with a video advertisement.
Top 10 Dark Web Markets
Combining opioid jargon with known opioid product names 25-27, we generated an opioid keyword data set consisting of 311 opioid keywords with 13 categories. We manually validated all keywords and the corresponding categories to guarantee their correctness. We consider our estimate as the minimum, or “floor,” for the volume of illicit cryptocurrency. Michael Gilbert, an independent researcher who has studied darknet drug markets, said that not only do individual users buy drugs on the darknet, so do dealers who go on to resell the drug in their local area. “A lot of people have used drugs that have flowed through cryptomarkets without knowing what cryptomarkets are,” he said.
We developed Lunar to monitor the deep and dark web, including dark web marketplace sites. To the UNODC, this suggests “an increase in wholesale activities” on the dark web—though this could also reflect consumers who buy smaller quantities shifting from the dark net to the clear net and encrypted messaging apps. Some dealers these days are even brazen enough to boost their posts and pay for sponsored advertising. “Mushrooms and marijuana used to be hard to get and now they’re being marketed to me in beautiful packaging on Instagram,” says one 34-year-old in Austin, Texas, whom WIRED spoke to. Behrouz Parsarad (Parsarad), residing in Iran, was the sole administrator of Nemesis. In this capacity, Parsarad established Nemesis and held full control over the marketplace and its virtual currency wallets.
Silk Road Operations
The inherent transparency of public blockchain networks enables institutions to have increased visibility into the behavior and performance of digital assets — insight that is critical for managing liquidity and counterparty risk. A scammer may send a “wrong number” or “accidental” message — either to a personal cell phone number or through a dating or social media app — which they use as a way to engage in a relationship with or befriend the victim. Once a relationship is cemented, the scammer will draw the victim’s attention to false crypto investment opportunities or ask for monetary assistance for falsified personal struggles. Particularly following the Hamas attacks on Israel in October 2023, the use of cryptocurrency by international terrorist groups has taken on renewed urgency among governments, policymakers and researchers. Binance and Tether froze accounts belonging to Hamas and pro-Hamas fundraising campaigns following the October attacks.
Why Is It Critical To Monitor Dark Web Marketplaces?
Authorities from multiple countries, including Germany, the Netherlands, Spain, Sweden and the United States, worked together to investigate and take down a major online criminal marketplace, demonstrating the need for cross-border efforts to combat cyber-enabled crime. The dark web is a collection of sites that are not indexed by search engines and can only be viewed with specialized web browsers designed to provide privacy and anonymity. Many sites specialize in selling illegal goods that are not readily available on the public internet.
All of this has made it one of the most reliable markets still active in 2025. The shift to digital trade was accelerated by the COVID-19 pandemic, as lockdowns pushed many consumers and vendors towards online platforms. As these transactions are more insular and anonymous than in-person trade, it is more difficult to track user behaviour. However, new local patterns have emerged, along with unique risks that are less common in offline markets, such as exposure to cyber fraud or health concerns caused by the use of unregulated substances by unpractised users. Despite these risks, digital drug markets are often seen as a safer alternative to street dealing, attracting new users who might have avoided traditional markets due to fear of violence or law enforcement. Vendors today are choosing to establish vendor shops and engage in direct deals through a diverse array of encrypted communication applications and email.
Scams And Fraud
- While it received a relatively small share of large retail purchases as shown in the previous chart, Abacus Market is one such example.
- The name was an acronym for The Onion Routerreferring to the layers of encryption that were added and then peeled away as a message passed through the system.
- OFAC’s Economic Sanctions Enforcement Guidelines provide more information regarding OFAC’s enforcement of U.S. sanctions, including the factors that OFAC generally considers when determining an appropriate response to an apparent violation.
- To view a site like the now-defunct Evolution Marketplace, for example, an Internet user went to the Tor system, looked in a directory of hidden services, and found a list of relays for initiating contact with the service.
The pathway of the data collection, cleaning, transforming, classifying by drug type, and disaggregating by the regions is presented in Figure 1. For all of the money spent by police in these investigations, it’s fair to say that the net result from a user’s perspective is simply the inconvenience of a few searches, followed by registration at a new service. The dark web model endures because it offers great efficiencies to dealers and users. The Administrators of Solaris also highlighted strong connection to KillNet responsible for multiple DDOS attacks against the U.S., NATO and various EU-based government resources – who may assist Solaris in fighting against their competitors and enemies.
Another darknet market known for facilitating fentanyl sales to the United States was Canada-based AlphaBay. A once-sizable illicit enterprise that began in 2014, AlphaBay was closed by authorities in 2017 and then reopened in 2021. The last version of the market operated until February of 2023, and a month after that closure, a former AlphaBay vendor pled guilty to distributing fentanyl that caused fatal overdoses in Oregon. Customer reviews found on the Abacus site indicate that some of its American vendors sell drug products laced with fentanyl. Throughout the history of the darknet market ecosystem, at different turns one marketplace has typically played the dominant role. The last several years’ examples include Silk Road, AlphaBay, Wall Street Market, and Hydra, most recently.
Inspector General Sites
Genesis Market extensively used a payment processor called UAPS, so much that the processor’s average inflows fell by 25.7% after Genesis closed last April. Regardless, UAPS remains a key provider of payment infrastructure to top fraud shops. Fentanyl and fentanyl-laced drugs also arrive in the United States through Latin America based cartels. U.S. customers predominantly purchase drugs from these groups that are known to have used crypto to source fentanyl precursor chemicals from labs based in China.
It is not clear if this group may be state-supported or solely driven by their ideological motivation, or perhaps artificially created by foreign governments considering ongoing geopolitical tensions. It is worth mentioning, another actor with the alias Wazawaka was presumably responsible for a similar attack against the now closed Hydra marketplace back in 2018. In our study, we found that 23.78% (9896/41,614) listings and traces were identified with the help of 58 opioid jargons (Table 2).
