And these days, the fastest way out of Russian prison is heading straight to the front with Ukraine (where the report details soldiers can now have drugs delivered). “In the UK and America, it’s very easy to get hold of drugs at the moment; there is less jeopardy involved in buying drugs in public than in places like Russia, Georgia, or South Korea — so there is less need of such an anonymous system” — explains Daly. He repeats instructions to himself from The Kladmen’s Bible, an ebook that instructs couriers how to make a living stashing drugs others bought online in clever spots to be picked up. The operation resulted in the seizure of 50.8 million euros ($53.4 million) — in cash and virtual currencies, nearly 1,900 pounds of drugs and 117 firearms in a series of raids in several countries. It’s unrealistic to expect postal services to be equipped with on site mini-labs that can test the chemical composition of every package that might look suspicious and that is labelled as dog worming tablets, homeopathic medicine, herbal tea and so on.
The darknet is a part of the internet that can be accessed only through special software. Our research collected product listings and forum posts from 10 anonymous online market places and 6 forums. Our study determined the underground marketplace and forum list based on darknet site search engines and previous research works 20. More specifically, we used darknet site search engines (such as Recon, Darknet live, Dark Eye, dark.fail, and DNStats 21,22) to search underground marketplaces and forums and then manually validated their activeness.
STYX Market
It may take anywhere from 15 seconds to several minutes for a page to load, depending on network and site demand. The .onion top-level domain (TLD) name is the dark web’s version of “.com” or “.net”. Unlike traditional TLDs, servers using the onion TLD are more difficult to locate.
Europol-coordinated Global Operation Takes Down Pro-Russian Cybercrime Network
They engage in financial crime and sell other people’s stolen personal information, since they’re under the veil of anonymity. Still, even with these crackdowns and better defenses, dark web markets just keep coming back. As long as people want to buy and sell illegal stuff online, be it stolen data, narcotics, drugs, or malware, these markets will keep resurfacing, no matter how many times authorities take them down. The platform’s interface is a trader’s dream, with advanced filters, real-time tracking, and vendor ratings averaging 4.8/5 across 50,000+ reviews. Vendors like “ShadowChem” and “CyberForge” maintain 99% ratings, offering reliable goods with 95% shipping success.
Chain Data
The DHS Cyber Crimes Center (C3) combats cybercrime, online child sexual exploitation, and criminal exploitation of the internet with state-of-the-art forensic technology. The Center investigates large-scale cybercrime threats and provides expertise on cybercrime investigations to the field. It also uses global law enforcement networks, like Europol, to combat cybercrime threats. Broken or outdated links can be a major frustration when navigating darknet markets. Many markets go offline without warning leaving users and vendors clueless to what is happening. All darknet markets use escrow this basically means the buyer’s payment is held in escrow until the buyer confirms they’ve received the product which gives a piece of mind to the buyer.
However, in June 2025, BidenCash’s relevant domains (around 145) were seized by the US Department of Justice. You can even find things such as BIN checkers and PayPal cookie converters. Another reason the Russian Market is so popular is that it’s pretty inexpensive compared to other dark web marketplaces. It brings in vendor reviews from other places and verifies them using PGP signatures, so buyers can feel a bit more confident about who they’re dealing with. And when it comes to paying, the site sticks to Bitcoin (BTC) and Monero (XMR) to keep transactions private.
Federal Financial Data
Use hardware wallets like Ledger or Trezor for BTC/XMR—software wallets were hacked in 10% of 2024 cases. Generate fresh addresses per trade, encrypt backups with PGP, and avoid online storage, ensuring funds are safe on markets like ASAP. Monero (XMR) offers untraceable transactions, cutting tracking risks—BTC’s blockchain exposed 10% of trades in 2024, dropping its use from 80% to 60% in 2025. XMR’s 40% adoption (e.g., Incognito) reflects this shift, though BTC’s speed suits fast trades on Bohemia. Tor2door’s 85% trades in minutes set a trend—50% of top 10 optimize for speed in 2025, up from 30% in 2023. This cuts shipping times to 3–5 days vs. 5–7, enhancing user satisfaction by 20%.
Alphabay Market Vendors
- It supports operations in multiple languages and operates on both clearnet and Tor.
- Such manuals are written by seasoned users and often include learning outcomes derived from successful law enforcement actions, package interception, controlled delivery stories and so on.
- The months and years after Silk Road’s closure were marked by a greatly increased number of shorter-lived markets as well as semi-regular law enforcement takedowns, hacks, scams and voluntary closures.
- Fraudsters create fake versions of popular darknet sites to trick users into entering login details or personal data.
“I do not endorse sites and I do not take payment in exchange for anything. Many listings involve stolen personal information, including credit card data, Social Security details, and full identity profiles. This article reveals the top 10 dark web markets dominating in 2025, their unique characteristics, and the critical implications for enterprise cybersecurity. While not all are pictured above, in total, we found 16 vendors either selling or sourcing drug material from Abacus and purchasing production supplies from this China-based vendor. Below is a screenshot from the Abacus Market website showing the range of items it sells, with drugs and chemicals representing the overwhelming majority of its products.
China-based Vendors And Novel Synthetic Opioids
- Roman pleaded guilty on May 30, 2024, and was sentenced on Nov. 14, 2024, to 10 years in prison.
- Fill out the form to speak with our team about investigative professional services.
- Hence, we also gathered snapshots of 5 underground marketplaces and 6 forums collected by the anonymous marketplace archives programs and previous research projects 20.
- Currency use shows its wide appeal—BTC runs 65% of trades for speed and ease, while XMR’s privacy jumped to 35% in 2025 from 25% in 2024, boosted by a 20% rise in privacy-focused users since late 2024.
The indictment alleges that Parsarad founded Nemesis in March 2021, and that the marketplace grew to serve more than 150,000 users and register around 1,100 vendor accounts worldwide. The agency said the cartels on the darknet are rated on the scale of 1 to 5 levels based on the potency of the drug sold, and their “customer service”. The Russia-only market Hydra is also expanding, creating a new global drug bazaar called Eternos, which is launching in September. Hydra admins announced that the new market would feature IronRat, an artificial intelligence software agent for automated dispute resolution, making the sites even more user-friendly. In May, the EMCDDA reported that drug supplies had stayed steady across the continent, and that the market remained profitable.
For all of the money spent by police in these investigations, it’s fair to say that the net result from a user’s perspective is simply the inconvenience of a few searches, followed by registration at a new service. The dark web model endures because it offers great efficiencies to dealers and users. But it is hackers demanding ransom money, not police, that’s the main worry for those operating DNMs, says Patrick Shortis. “The biggest source of disruption to markets is currently coming from the ongoing distributed denial of service DDOS attacks that have knocked markets and forums offline intermittently over the last few months,” he says.
Topic Modeling Of Forum Posts
Supporting BTC (60%) and XMR (40%), Torrez’s interface offers advanced filters and fast trades—90% complete within minutes—keeping prices 5–10% below premium markets. Vendors like “TorrezRx” and “HackElite” boast 98% ratings, with 94% shipping reliability. Launched in 2021, Torrez surged post-Hydra, growing vendors by 200+ in 2025, and survived a 2024 DDoS attack with enhanced defenses. Its top-tier rank reflects its vendor scale and trade strength, despite slight uptime and turnover challenges.
Supporting Illegal Activities Unknowingly
In a nearly unanimous decision, everybody on the dark web agrees that domestic shipping is easier and less risky than the international one. There are a number of manuals available on the dark web that concentrate on “operational security” or “opsec” when it comes to sending and receiving packages (examples mentioned here). They can be found with a bit of effort and I have gained access to some of them for research purposes.
