Darknet markets generate millions in revenue selling stolen personal data

Dutch police discovered the true location in 2016.[4] Law enforcement quickly began monitoring all actions on the site. Administrators soon moved the site to another unknown host, but law enforcement got another break in April 2017, which allowed them to identify the new hosting company, in Lithuania. The Dutch National Police successfully located and seized the server infrastructure hosting Archetyp Market at a data center in the Netherlands, effectively terminating the platform’s operations. Norton VPN fortifies your internet connection with ultra-secure AES-256 encryption, masks your IP, and never logs your activity. And, with an automatic kill switch that guards against unexpected exposure if the connection drops, you can enjoy powerful privacy protection as you navigate even the darker corners of the web.

• To make seller reputations more portable, TorZon supports imported, PGP‑signed reviews, and it accepts both Bitcoin and Monero.
• Cybersecurity companies and researchers monitoring darknet markets face legal and ethical restrictions.
• These advancements are expected to further enhance the reliability and accessibility of these platforms, solidifying their position as a cornerstone of the digital underground economy.
• The marketplace sold a variety of content, including drugs, stolen data, and counterfeit consumer goods, all using cryptocurrency.
• Historically, as law enforcement closed each dominant marketplace, a new leader emerged.
• Both Agartha and Cartel earned enough revenue within the 35-week period we tracked them to be characterized as midsize companies, earning $91.6 million and $32.3 million, respectively.
• It offers numerous categories of products, most of which feature illegal products.

CISA releases Secure Connectivity Principles Checklist for Operational Technology Networks Connectivity

If the address is in one of the cybercrime datasets, the person will receive an email that includes personalized instructions on how to clean up their computer and make it safe again. In the first 24 hours of launching Check your hack, two million people took advantage of the service. So far, five million people have used the tool, and over 13,000 victims have been notified that their computer was infected, and received instructions to help them make their device safe again. Fentanyl and fentanyl-laced drugs also arrive in the United States through Latin America based cartels.

EU Unveils Cybersecurity Overhaul with Proposed Update to Cybersecurity Act

One of the most notable developments is the integration of cryptocurrencies as the primary medium of exchange. Bitcoin, Monero, and other privacy-focused coins have become indispensable for users seeking to conduct transactions without leaving a trace. The decentralized nature of these currencies ensures that financial activities remain untraceable, fostering trust among participants.

What’s the benefit of escrow security?

• In all panels, the dashed vertical line marks the time of operation Bayonet.
• This article reveals the top 10 dark web markets dominating in 2025, their unique characteristics, and the critical implications for enterprise cybersecurity.
• Finally, our coverage of DWMs, albeit extensive, may lack information on other trading forums where users could have met.

Finally, we observe that COVID-19 only had a temporary impact on the evolution of stable U2U pairs, which continued to increase their trading volume throughout 2020. Overall, our study provides a first step towards a better microscopic characterisation of the DWM ecosystem, indicating a direction of investigation that may be of interest to both researchers and law enforcement agencies. The results further support the recent efforts of law enforcement agencies to focus on individual sellers43,44,45, as well as, more recently, also buyers46,47. Since the beginning of DWMs’ activity, there has been a shift in the law enforcement approach from focusing on market admins towards sellers and buyers9,13.

Print & Digital

Nonetheless, 2023 saw a rise in new types of scams, including romance scams — also known as pig butchering scams. These types of scams more than doubled in revenue year-over-year, with data indicating a growth of 85x since 2020. In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content. Please note that our Terms and Conditions, Privacy Policy, and Disclaimers have been updated.

Abacus Dark Web Market Possible Exit Scam with the Bitcoin Payments They Hold

The surge stems from weak local enforcement, widespread use of streamlined crypto payments, and a digital space valuing privacy. These factors allow vendors to avoid typical oversight while operating covertly online. These marketplaces accounted for over 97% of illicit revenue generated through Bitcoin and TRON transactions.

🛡️ How Axis Intelligence Strengthens Cybersecurity

U.S. customers predominantly purchase drugs from these groups that are known to have used crypto to source fentanyl precursor chemicals from labs based in China. The cartels then use those chemicals to manufacture fentanyl that is later sold in the U.S. U.S.-based drug vendors on Abacus Market advertising a synthetic opioid called China White, which its customers can purchase using Bitcoin or Monero. On a smaller scale, Mega Darknet Market placed a few ads with QR codes in public places like Moscow subway trains.

Supporting illegal activities unknowingly

Unfortunately, the increasing availability of personal information on the Dark Web results in lower costs—and consequently, a higher likelihood—that your accounts will be compromised. There is no shortage of methods to get hacked, but there are just as many ways to defend against it. By following these suggestions, you can deter unwanted intruders from accessing your accounts at home or work. The DDoS attacks listed below are characterized by their target, number of access requests, quality, speed, and duration.

Securing M365 Data and Identity Systems Against Modern Adversaries

Renowned for its extensive inventory of financial data and sophisticated operating methods, Brian’s Club is a key player in the underground economy of financial cybercrime. Darknets and dark markets have fueled the growth of cybercrime, provided a marketplace for cyber threats, and expanded the attack surface for malicious actors. At KELA, we help you identify and mitigate risks by providing actionable intelligence from the darknet. Our solutions empower you to monitor illicit darknet marketplaces and track emerging threats, ensuring you can take proactive measures to protect your organization and reputation. Darknet marketplaces emerged around 2011, with Silk Road setting the standard for how these platforms operate. Built on Tor, these sites mask IP addresses by routing traffic through encrypted relays, ensuring anonymity for both buyers and sellers.

Search engines

Cybercrime enablement represents flows from ransomware, stolen funds, malware, or fraud shops to darknet markets. Torzon market made its debut in September 2022, and ever since, darknet markets it has been on an upward trajectory. In fact, it now features more than 11,600 illegal items, which include hacking tools, hard drugs, and all types of cybercrime services.

The most affected are multisellers, with a drop of 78% in the median income, followed by market-U2U and market-only sellers, with a drop of 59% and 47%, respectively. Although these three types of sellers are significantly affected, they recover and surpass the median income value they had before Bayonet (see Fig. 4c; Supplementary Information Section S4). Our classification shows that the number of sellers is significantly smaller than the number of buyers, as shown in Figs. The number of actors in the ecosystem is affected by several factors, especially market closures.

Dark web websites: 10 Onion sites to explore

Ideal marketplaces support anonymous browsing through networks like Tor and I2P, utilize privacy-focused cryptocurrencies such as Monero, and implement measures to prevent tracking and transaction tracing. Platforms that provide clear guidelines for maintaining operational security (OpSec) and offer built-in tools for data obfuscation are especially favored. Its look, design, options, and interface are exactly the exact copy of its competitor, but everything else, including buyers, vendors, and servers, is different.

At CloudSEK, we combine the power of Cyber Intelligence, Brand Monitoring, Attack Surface Monitoring, Infrastructure Monitoring and Supply Chain Intelligence to give context to our customers’ digital risks. Dark web marketplaces discussed in 2026 are best understood as temporary systems shaped by pressure, not permanence. Their repeated rise and collapse reflect enforcement advances, trust failures, and structural weaknesses rather than innovation or stability. Government of Canada reporting confirms that traffickers use both the surface web and dark web to sell drugs delivered by mail or courier. The same reports highlight gaps in the national ability to measure the full scale of this activity.

APT Hackers Attacking Indian Government Using GOGITTER Tool and GITSHELLPAD Malware

Monero’s ring signatures, stealth addresses, and RingCT obfuscate transaction details—enhancing privacy and hindering traceability The Rise of Monero. Sites such as Abacus and Russian Market accept both currencies to broaden their appeal. Journalists use the dark web to communicate with sources anonymously, and whistleblowers rely on it to share sensitive information without fear of retaliation. By adopting a few straightforward rules and habits, you can make it more difficult for hackers to access your data and remove yourself from their line of sight.

• Independent verification remains limited due to the market’s relatively recent appearance.
• They’ve got 2FA and encryption that’s tighter than a drum, which I’ve tested against crash-prone sites and found solid.
• When one goes down, two more emerge with new ideas, better technology, and greater difficulty to track.
• Awazon Market is a top-tier dark web marketplace with claims to revolutionize secure anonymous commerce.
• Additionally, we observe that, except for U2U-only sellers, the median income of the other types of sellers drops after the major shock caused by operation Bayonet (see Supplementary Information Section S4).
• However, it has a sneak peek, easy guide steps, and/or a quick list providing quick in-page navigations and easily-found answers if desired.

The site aims to direct users to the actual Torzon Market, presumably a darknet marketplace. Freshtools is a unique marketplace in that it does not only provide the stolen data, but it allows criminals to purchase MaaS which can cause further damage to the victims. It is one of the most active and up to date markets and always provides new and updated malware and data. It is a hub for financial cybercrime and offers a wide range of illicit services and stolen data that cater to sophisticated cybercriminals.

Cryptocurrency Trading

• By analysing the temporal evolution of stable pairs, we unveil that DWMs acted as meeting points for 37,192 users (out of around 16 million), whose trading volume is estimated to be $417 million.
• BidenCash became known for regularly leaking huge amounts of stolen credit card data and personal information — often for free.
• By eliminating centralized control, these systems promise greater resilience and adaptability, ensuring the continued growth and evolution of the darknet economy.
• Given the explosive growth of these markets, organizations must prioritize proactive threat monitoring.
• They are used to trade illegal goods and services while keeping user identities concealed.
• An award-winning cybercrime threat intelligence firm, KELA’s mission is to provide 100% real, actionable intelligence on threats emerging from the cybercrime underground, to support the prevention of digital crimes.

Another key distinction is that access to darknet markets requires the use of special software such as the Onion Router, or TOR, which provides security and anonymity. Dark markets, on the other hand, are platforms within darknets where illicit transactions occur. These marketplaces facilitate the exchange of everything from stolen credentials and drugs to weapons and hacking tools.