It’s a natural place for an uncensored drugs marketplace, as it is for whistleblower websites and political dissidents, which also use the same techniques to keep their visitors hidden. Over its five years of activity, the marketplace amassed over 612,000 users with a total transaction volume of over €250 million (approximately $289 million) in Monero cryptocurrency transactions. Co-occurrence of the same opioid suppliers across different anonymous marketplaces. We compared our method with the state-of-the-art topic modeling method Machine Learning for Language Toolkit (MALLET) 30 and our model without transfer learning stage (baseline). Our experiment evaluated MALLET on our annotated anonymous marketplace and forum data set (Table 3) using 3 classification algorithms in the document classification tool (package cc.mallet.classify class in MALLET’s JavaDoc API Application Programming Interface). In particular, MALLET is retrained and evaluated via 10-fold cross-validation.
- JCODE has worked with every FBI field office in the country to facilitate outreach to households that have purchased individual amounts of opioids from the darknet.
- “While one person can register infrastructure or oversee a platform’s setup, a darknet marketplace of Nemesis’s size typically requires a broader operational team,” according to Ari Redbord, TRM’s Global Head of Policy when asked by Decrypt if Parsarad likely acted alone.
- We trained the semantic comparison model using the traces of Reddit as the benign corpora and the traces of the anonymous marketplaces/forums as the underground corpora.
- Recent years have witnessed the trend of studying opioid use disorders using anonymous marketplaces and forums data 5,8,10 and public social media data (eg, Twitter and Instagram) 11-14.
When interpreted by professionals, our initial results demonstrate useful findings and may be used downstream by law enforcement and public policy makers for impactful structural interventions to the opioid crisis. Although a large body of current research is focused on pathways for treatment of opioid use disorder and analyzing deaths per treatment capacity of substance use providers, these research areas are limited to the demand side of the opioid epidemic 40,41. We believe that the findings and pattern analyses presented here, which place concentration on the supply side, might suggest a new direction to focus and will serve as a useful complement to current research conducted within the domain of addiction medicine.
Meet Our Team Cyble
Archetyp Market emerged in 2020 as a major player in the darknet’s illicit drug trade, quickly gaining notoriety for its vast inventory and user base. Over five years, it became a bustling hub where over 3,200 vendors sold more than 17,000 drug listings, spanning cocaine, heroin, cannabis, MDMA, amphetamines, and highly dangerous synthetic opioids like fentanyl. With a staggering 612,000 users, the platform processed over €250 million (approximately \$289 million) in transactions, primarily in the privacy-focused Monero cryptocurrency.
Activities
Common tricks include creating fake accounts from which to post positive feedback; writing bad reviews of competitors; and even paying others to give favourable write-ups. One Archetyp Market moderator and six of the marketplace’s highest vendors were also arrested in Germany and Sweden. Our modification of the semantic comparison model will generate comparable word embeddings for opioid jargon words in legitimate documents (ie, benign corpora embedding) and in underground corpora (ie, underground corpora embedding). Specifically, our modification used a series of opioid keywords collected to generate their benign corpora embeddings and then searched for words whose underground corpora embeddings were close to the opioid keywords’ benign corpora embeddings. We output the top 100 proper nouns in the underground corpora in our implementation, whose embeddings showed the closest cosine distance to the known opioid keywords.
Federal Financial Data
Specifically, we first conducted a whole-site crawl of anonymous online marketplaces and forums to solicit data. We then developed a suite of opioid domain–specific text mining techniques (eg, opioid jargon detection and opioid trading information retrieval) to recognize information relevant to opioid trading activities (eg, commodities, price, shipping information, and suppliers). Subsequently, we conducted a comprehensive, large-scale, longitudinal study to demystify opioid trading activities in anonymous markets and forums. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Iran-based Behrouz Parsarad (Parsarad), the sole administrator of Nemesis, an online darknet marketplace, which was subject of an international law enforcement operation and was taken down in 2024.
Budget, Financial Reporting, Planning And Performance
The expanding use of cryptocurrencies by terrorist organizations and state-sponsored actors illustrates the dual-edged nature of technological innovations — providing both opportunity and risk. Ransomware actors and fraudsters are leveraging technological advancements, including cross-chain bridges and artificial intelligence, to bypass detection and scale their operations. A key theme throughout the year has been the resilience and adaptability of illicit networks. Sanctioned entities, terrorist organizations, and ransomware groups have shifted tactics in response to global crackdowns, embracing new technologies and methods to obscure their activities. This adaptability underscores the need for constant evolution in enforcement strategies and international cooperation.
International Law Enforcement Cooperation
This operation was about protecting innocent people from predatory criminals who profit from violence, addiction, and fear. Our commitment is unwavering,” said Chief Postal Inspector Gary Barksdale, United States Postal Inspection Service. Immigration and Customs Enforcement, in collaboration with Europol, the Joint Criminal Opioid and Darknet Enforcement Team, and various national and international partners, announced the results of Operation RapTOR May 22.
National Debt
“You have to be essentially on a list, get invited to the list, to view it at a certain time and place, because obviously it’s the most tracked by law enforcement,” Lott said. Jacob Lott is the long-time owner of Tampa Computer Doctors and has served as a “white-hat hacker,” who legally hacks systems to find vulnerabilities and improve cybersecurity for businesses. Despite efforts by law enforcement to take down bad actors who lurk there, many continue to thrive. Spotlight on America National Investigative Correspondent Angie Moreschi takes a closer look at why it’s so hard to stop them.
Category Deep-dive: Illicit Drug Sales Grew And Expanded Outside Of Darknet Marketplaces In 2024
- Listings included a complete boxset of The Sopranos; a hundred-dollar Marine Depot Aquarium Supplies voucher, and fake UK birth certificates.
- The marketplace is well-known for its bug bounty programs and robust security mechanisms, including mandatory 2FA.
- Finally, in the model refining stage, the model is trained for other 2 iterations using the same objective function.
- Background research tasks included learning from past drug lords, researching legal matters, studying law enforcement agency tactics and obtaining legal representation.
- It marks the most significant JCODE operation to date, building on years of enforcement actions and marketplace takedowns, including Kingdom Market, Tor2Door, Bohemia, and Nemesis.
- Postal Inspection Service (USPIS) and the Palm Beach County Sheriff’s Office investigated the case.
Others, particularly those based in Russia, focus solely on info stealer hacking tools and brokering stolen data. Behrouz Parsarad (Parsarad), residing in Iran, was the sole administrator of Nemesis. In this capacity, Parsarad established Nemesis and held full control over the marketplace and its virtual currency wallets.
Catching Criminals On The Dark Web
Others are looking for stolen data, hacking services, or even banned books and political content. In 2019, there were approximately 8,400 active sites on the dark web, selling thousands of products and services daily. Once you’re in, though, you also find an online marketplace filled with offers for many illegal goods and services.
The second category consists of data stores, which specialize in stolen information. In 2023, the dark web attracted an average of 2.7 million daily users, with Germany now leading as the country with the highest number of Tor users, surpassing the United States for the first time in years. If you’ve ever been a victim of a financial scam, Henderson urges you to report it to federal authorities because you might hold the key to help them follow the trail to the bad guy. They want to use these hard-earned dollars of theirs that they got committing financial crimes, and they want to go lounge on a beach somewhere while we’re waiting for them,” Henderson said. It targeted opioid sales on the dark net and led to five arrests in California.
Axis Intelligence provides dark web surveillance solutions that help businesses identify leaked credentials, fraud attempts, and malware risks before they escalate. This article reveals the top 10 dark web markets dominating in 2025, their unique characteristics, and the critical implications for enterprise cybersecurity. Encryption technologies allow vendors to communicate with customers and receive payments anonymously. The drugs are delivered in the post, so vendor and customer never have to meet in person.
We found that 182 opioid supplier IDs appeared in both the marketplaces Evolution and Agora from January 2014 to July 2015. In particular, we observed that 84 opioid supplier IDs synchronized similar product listings in both marketplaces at the same time. This might be because the suppliers tend to promote their products across various marketplaces and to increase sales. Our goal here was to identify anonymous forum posts with the topics of opioid commodity promotion (eg, listing promotion) and review (eg, report fake opioid vendors). We then analyzed these forum posts to profile underground opioid trading behaviors.
The Shift Toward Smaller, More Niche Markets
A moderator and six prominent vendors were arrested simultaneously in other countries, and officers seized assets worth about $9 million. Dark web markets have exploded in scale and reach in 2025, becoming the most dangerous hubs for trading drugs, stolen data, and hacking tools. These anonymous marketplaces—operating mainly on the Tor network—are now a primary threat vector for businesses and cybersecurity professionals. On May 12, 2022, a federal grand jury returned a two-count indictment charging Holly Adams, 31, and Devlin Hosner, of Indio, California, with conspiracy to distribute and possess with intent to distribute fentanyl and methamphetamine, and with conspiracy to launder money. Adams and Hosner shipped these fentanyl pills to buyers throughout the United States, using the USPS, UPS, and other means of delivery. In the course of their conspiracy, Adams and Hosner finalized over 1,100 transactions of narcotics and other contraband and received more than $800,000 in cryptocurrency.
