Many online shops employ enforcers, known as “sportsmen”, to find and punish kladmen with bad reviews from buyers who could not find their drugs, or those who are suspected of stealing. The poorer couriers are easily traced because those who could not afford the deposit needed to get the job have to provide an ID card. “Everyone above the age of 14 in Russia knows about kladmen and dead drops,” said a Russian lawyer specialising in the drug world.
While Markets Get Seized: Pedophiles Launch A Crowdfunding Site
Yellow Brick is an anonymous marketplace, for vendors to sell (almost) anything they want, whilst simultaneously allowing customers to purchase products they seek without having to put their identity or person information at risk. It also designated the Sinbad, Tornado Cash, and Blender.io cryptocurrency mixing services for their use as money-laundering tools by the North Korean Lazarus hacking group. Hydra also offered stolen databases, forged documents, and hacking-for-hire services. In April 2022, the German police seized Hydra Market’s servers in a joint action with the United States and 543 bitcoins from its profits (currently worth roughly $38.5 million).
The vast majority of drug stores identified by TRM Labs appear to be run by Russian-speaking vendors mostly targeting tourists. Given that these stores often operate under new names, it is difficult to assess with absolute certainty whether they were present on Hydra or just planting the reviews for publicity. However, Flashpoint’s cryptocurrency analysis performed in September 2022 found that some of the exchanges that received funds from Hydra (e.g. Bitzlato, MINE exchange, Bitpapa,) were also receiving funds from OMG! TRM Labs adds that eight of the top 10 mainstream exchanges that received funds from Hydra before its shutdown also received funds from its successor entities over the subsequent year. Hydra, which had a long-standing review system and significant entry barriers for potential sellers, provided a useful platform for vendors, including crypto launderers, to prove that they were trustworthy. The trust Hydra commanded among users is obvious from how Kraken Market, which claims to be a project of former Hydra administrators, even designed its logo to make it similar to Hydra’s.
- Tens of thousands of fresh logs are uploaded every week, keeping the inventory current and attractive to cybercriminals.
- Background research tasks included learning from past drug lords, researching legal matters, studying law enforcement agency tactics and obtaining legal representation.
- It’s affecting Russian youth heavily, leading to violence, criminalization, and increased synthetic drug dependence.
- In addition to its emphasis on stolen credentials, 2easy Market offers a variety of cybercrime tools, such as hacking services, exploit kits, and other resources for conducting cyberattacks.
- However, it did skew more heavily towards streaming overall compared with other darknet markets, with 47% of its listings in this category.
- For example, after the closure of the AlphaBay marketplace, other marketplaces, namely Hansa and Dream Market, experienced an abnormal spike in activity.
In 2022, for example, BidenCash was linked to the breach of over 1.2 million credit card records. Since its inception, the market has catered to criminals looking for high-quality counterfeit items, such as fake IDs, passports, and branded luxury goods. Transactions are conducted through Bitcoin and Monero which provides anonymity for both buyers and sellers. Bohemia accepts Monero and Bitcoin as payment methods and places a strong emphasis on protecting user anonymity through PGP encryption. Mega Market, established in 2016, experienced a surge in popularity following the takedown of the Hydra market. And beware—while many explore out of curiosity or for research purposes, it’s important to remember that engaging with these platforms, even as an observer, can lead to serious legal and ethical consequences.
Unmasking The Dark Web Economy: Key Hubs And Cybersecurity Implications
Here we discuss cryptoasset compliance, blockchain analysis, financial crime, sanctions regulation, and how Elliptic supports our crypto business and financial services customers with solutions. Killnet and Infinity – a dark forum recently launched by Killnet – have been largely silent about the takeover, instead focusing on an apparent Killnet hack of the US Internal Revenue Service (IRS). Meanwhile, many Kraken-affiliated vendor groups on the WayAway Forum have been vying to recruit former Solaris vendors of illicit goods and services. Solaris users attempting to access the market on January 13th were met with a redirect to Kraken, with a notice announcing that it had successfully taken over Solaris’ cyber infrastructure, GitLab repository and project sources. The takeover was confirmed by a recently-launched Telegram group affiliated with Kraken. This year’s first “Friday the 13th” proved to be unlucky for some in the dark web ecosystem.
Torzon Market
Staying ahead means assuming compromise is possible, and preparing like it’s inevitable. A study by Secureworks highlighted a 670% increase in Russian Market activity following the takedown of Genesis Market, one of its major competitors. Russian Market quickly filled the vacuum, becoming one of the top destinations for infostealer logs.
Ransomware: Russian-speaking Ransomware Groups Account For 69% Of All Ransomware Proceeds
Its interface is easy to navigate, and it has a reliable escrow system, as well as allowing payments with Bitcoin and Monero. Vendors today are choosing to establish vendor shops and engage in direct deals through a diverse array of encrypted communication applications and email. These platforms allow vendors to reach customers who are less technologically savvy, whilst also mitigating against market turbulence caused by darknet market exit scams or law enforcement takedowns. In this respect, the use of encrypted communication apps like Telegram and Signal have reduced the barriers to access for drug buyers to purchase products online, whilst also reducing fees that vendors pay to darknet markets for sales. This migration is further bolstered by the fact that the majority of new Western DNMs launched in 2024 have been characterized by poor design features or security issues. The following table shows the 20 cryptocurrency platforms whose hacked account credentials were most frequently listed for sale on the darknet markets.
Kraken Market (Dominant Russian-Language Platform)
It allows vendors to sell without registration, which provides an added layer of anonymity, making it one of the more flexible and user-friendly markets on the dark web. In this post, we’ll walk you through the top 10 dark web marketplaces that you need to watch for potential threats to your organization. Although some of these markets prohibit certain extreme content such as violence or exploitation, most operate with very few rules beyond ensuring the security and anonymity of their users. This article reveals the top 10 dark web markets dominating in 2025, their unique characteristics, and the critical implications for enterprise cybersecurity. Over the last year, “Alex,” the drug dealer from Moscow, said a new genre of content has been growing on Russian Telegram profiles. However in December last year a Ukrainian-born hacker broke into the Solaris market’s crypto-wallets and donated $25,000 to a charity for Ukrainian refugees.
- Online shopping accounts were highly concentrated in the Nemesis darknet market (56% of all listings) and to a lesser extent Bohemia (24%).
- Hydra Market enabled vendors of a wide range of drugs — including heroin, other opioids, cocaine, methamphetamine and LSD — to connect with customers of those narcotics, who could rate sellers on a five-star system, according to U.S. prosecutors.
- The high volume of listings for hacked credentials for Russian streaming services were limited to Russian markets, which explains the lower prices (60% less on average).
- Amongst the most notable was the first merger and acquisition between two marketplaces on the darknet — whereby the struggling SuperMarket was absorbed by the now-Superlisted DrugHub in an operation that lasted around one month.
- Research on the collective dynamics of dark web marketplaces shows that after the unexpected closure of a darknet marketplace, it takes on average about 5 days for trading volumes to recover, which suggests that users may move to other dark marketplaces.
The market even offers a “transaction chat” platform to communicate securely about the order. This approach theoretically reduces the likelihood of scamming and law enforcement operations. TRM research shows that darknet markets (DNMs) have bounced back following the shutdown of Hydra, the world’s largest such marketplace, by German law enforcement in April 2022. The dark net is famous for being a hub of black market websites for buying and selling products and services. If you purchase something from such shops and make payment through conventional payment methods like your bank transfer, credit/debit card, or PayPal, you can be caught easily and face legal consequences. The Torrez market is one of the biggest dark net marketplaces, also called a community-driven marketplace.
Research Report
Russian Market (also known as Russian Markat) is a dark web marketplace that emerged in 2019, specializing in the sale of stolen digital credentials such as usernames, passwords, session tokens, browser fingerprints, and other Personally Identifiable Information (PII). It has gained significant traction due to its focus on high-quality stolen data and its streamlined, user-friendly interface. Retail vendors are storing more crypto on-chain, while wholesale vendors are leaning heavily on DeFi. This results in a more fragmented and harder-to-trace web of darknet market transactions. Utilizing a bulletin board format similar to Wayaway, RuTor has established sections for Vendor Shop Fronts, Security, and News. The cryptomarket portion of RuTor is tightly controlled by the site administrator who must be contacted before submitting a deposit in a user’s market wallet.
However, BBC research earlier this year revealed the most common way for darknet sites to close is via so-called ‘exit scams’ where the administrators voluntarily shut down the sites but steal their customer’s funds in the process. “Russian (and Ukrainian) hackers, crypto, and online tech experts have always been ahead of the curve in this realm, and so it takes a huge effort from police to take down these kinds of shops and platforms” — says Daly. “When people in the West think of Russia, they think of everything being old fashioned and broken” — says Daly — “but their drug trade shows how ahead of the West Russia is on online tech.” Ten years later, in 2023, TRM labs (where Breaking Klad co-author Shortis works) calculated the combined income of all Russian drug markets at $1.5 billion US dollars, with the top 5 Russian online drug markets controlling 93% of incoming revenue.
While the five most popular cryptocurrency platforms may account for almost half (44%) of all listings in this category, no single platform dominated. Screenshot of listings for streaming account credentials on Nemesis darknet market. Last updated to expand the research to include data from two additional Russian darknet markets.
TRM Labs calculated that in the eight months since Hydra had been shut down, the new cluster of darknet markets had amassed $820 million in crypto currency deposits. It said Russian-language darknet markets, which chiefly trade in Russia and countries of the former Soviet Union, accounted for 80 percent of the global market. By contrast, the English language ASAP market, the largest non-Russian darknet market, accounts for less than 10 percent of dark web sales. Blockchain analytics firm Chainalysis has reported a 15% decline in global cryptocurrency sales across darknet markets in 2024, according to a data-driven blog post on May 16.
See Why DarkOwl Is The Leader In Darknet Data
The collapse of Hydra in 2022 fractured Russia’s underground economy, but many of its affiliates regrouped under new platforms, fueling Kraken’s growth. Get the latest updates on privacy, plus expert tips, and security guides to up your digital protection game. The Russian Market may feel distant and abstract, but the threats it enables are very real. From stolen logins to full account takeovers, the fallout from infostealer logs can spread fast and wide.
Mega Investment Fraud Schemes Pervasive Despite ‘Crypto Winter’
Teams of ‘droppers’ employed by the online shops are paid to secrete drug packages, rather than hand them over in person. This method was seen as less risky for buyers and sellers fearful of the heavy prison sentences handed out in Russia for drug crimes. Even so, opioids such as black market methadone are still being bought outside of darknet markets, predominantly either hand-to-hand or via the many human and automated drug dealers selling their wares on the encrypted messaging platform Telegram.
Therefore, you must know how to access dark web marketplaces safely (covered later in this article). But darknet marketplaces entered the spotlight at the start of the COVID-19 pandemic, when the combination of a public health emergency, an economic crisis, and disinformation panic pushed some merchants and customers into the shadow economy. In North America, Western Europe, and Australia, drugs bought on DNMs are generally mailed to customers. By contrast, Russian-language DNMs serving the post-Soviet states use dead drops as part of the zakladka or “stash” system — bringing together networks of couriers, wholesalers, drug producers, DNM management teams, and even customer service operatives. The darknet markets also act as hubs for the sharing of precursor chemicals, lab equipment and video tutorials that have created a vast network of amateur chemists churning out mephedrone nationwide. The evolving landscape of crypto crime in 2024 highlights a complex interplay between advancing security measures and increasingly adaptive illicit actors.
