Since last year’s Crypto Crime Report, the top performing Russia-based DNMs have held steady, but Kraken DNM overtook Mega as the leading DNM by annual revenue in 2024. In Washington, Europol deputy director of operations said those arrested were “among the most prolific or sensitive actors on the dark web.” Investigators received leads from local police departments investigating overdose deaths, including that of a 19-year-old man in Colorado who loved learning languages and building his own computers, according to FBI Deputy Director Paul Abbate. However, as we’ve seen in the past with big takedowns like AlphaBay, the lure of buying drugs and other illegal items on the internet means there will always be a market. So, the police operation comes at a time when many people may already be questioning their shopping habits.
In terms of individual market success, Mega Darknet Market led the pack with over half a billion in crypto inflows, and Kraken Market (not to be confused with the popular cryptocurrency exchange Kraken) in particular gained prominence among Russian darknet markets, as shown below. The Justice Department announced today the seizure of Hydra Market (Hydra), the world’s largest and longest-running darknet market. In 2021, Hydra accounted for an estimated 80% of all darknet market-related cryptocurrency transactions, and since 2015, the marketplace has received approximately $5.2 billion in cryptocurrency. The German police have seized infrastructure for the darknet Nemesis Market cybercrime marketplace in Germany and Lithuania, disrupting the site’s operation. Last week, two men, both in custody, were charged in federal court in Chicago with operating “Empire Market,” a dark web marketplace that enabled users to buy and sell more than $430 million in illegal goods and services around the world. Fraud shops are services found mainly on the dark web that sell stolen data and personally identifiable information (PII), which cybercriminals use for scams, identity theft, and ransomware attacks.
Silk Road 20
But he sees it as a way to both make AlphaBay invulnerable to future law enforcement takedowns and to pay back the dark web’s users for the millions they lost when the original AlphaBay server was seized. “When it comes to the money making this is investment in the future of AlphaBay,” DeSnake writes. “When it comes to ideology I think that is pretty clear. The reason is to make good to the AlphaBay name … this is our way to reimburse the darknet scene for what has happened.” DeSnake now claims, however, that he and others involved in the original AlphaBay do in fact remain beyond the reach of Western law enforcement. “You do not shit where you sleep,” he writes of AlphaBay’s rule against selling the stolen data of ex-Soviet citizens.
Two Charged With Operating $430 Million Darknet Market Empire In Investigation Led By HSI New York
The cycle Christin describes—law enforcement takedowns followed by a slow but robust recovery—has played out on the dark web again and again, repeating roughly every year or two. After the late 2013 takedown of the Silk Road, the first real dark-web drug market, more than a dozen replacements rose up to fill the demand for anonymous online narcotics sales. A massive crackdown called Operation Onymous followed in late 2014, seizing a broad swath of the dark web and arresting 17 people by exploiting a vulnerability in the anonymity software Tor, which serves as the dark web’s fundamental cloaking tool. A 10-month investigation following the closure of the dark web’s largest illegal marketplace, DarkMarket, has resulted in the arrest of 150 suspected drug vendors and buyers. The Wall Street Market seizure is not the first or even most devastating law enforcement takeover of a dark web storefront.
Germany’s Federal Criminal Police Office Takes Down Hydra Darknet Marketplace
- As for cybercriminal administration, the category includes inflows from ransomware affiliate wallets.
- The sentence follows a multiagency investigation involving Homeland Security Investigations (HSI) Arizona.
- Users of Incognito Market were able to search thousands of listings for illegal narcotics, including heroin, cocaine, LSD, MDMA, oxycodone, methamphetamines, ketamine, and alprazolam.
- Mega clearly dominated the realm of wholesale drug purchases, capturing 51.9% of that segment.
- As large platforms face disruption from law enforcement action, dark web infighting, and an influx of users from Telegram, there’s a growing shift toward smaller, more specialized marketplaces.
Officials announced they recovered over two metric tons of drugs, a haul that included a hefty 144 kilograms of fentanyl or fentanyl-laced substances, alongside some 180 firearms. In order to gain control of victims’ computers, the malware Genesis Market employed used a legacy Bitcoin address to determine the command-and-control (C2) server, from which cybercriminals initiated remote access to infected devices. Though Mega Darknet Market typically serves a Russian customer base, the drug revenue shown in the chart above likely came from customers based in Europe. Mega clearly dominated the realm of wholesale drug purchases, capturing 51.9% of that segment. At its peak, Nemesis counted over 150,000 user accounts and 1,100 seller accounts worldwide, with about 20% of them being based in Germany.
With these stolen credentials, the suspects purchased ghost gun parts and tools from a variety of legitimate websites, which they used to build ghost guns with a 3D printer, and sell for cash. A Manhattan district attorney successfully used this evidence to bring charges against one of the suspects. After the UAPS infrastructure takedown, we observed a swift decline in on-chain activity from UAPS counterparties, indicating that many fraud shops relied on this infrastructure to process customer payments.
Kazakhstan Busts $224M Darknet Crypto Laundering Ring As RAKS Exchange Collapses
In the US, there’s a large diversity in the types of products sold, including counterfeit pills. For example, in the screenshot below, an American vendor lists protonitazene powder, and advertises its uses as a counterfeit for oxycodone, also referred to as “M30” (i.e. 30 mg). Since 2021, Abacus Market’s revenue has increased substantially, and in 2024, it more than doubled, growing by 183.2% YoY.
Police Arrest 150 ‘high Value’ Darknet Vendors
- “When it comes to ideology I think that is pretty clear. The reason is to make good to the AlphaBay name … this is our way to reimburse the darknet scene for what has happened.”
- Its emphasis on user anonymity and document forgery makes it a core tool for identity fraud.
- The far-reaching success of Operation RapTor hinged on extensive cooperation between numerous agencies and international partners.
- Operation SpecTor was a collaborative initiative across JCODE members, including the Department of Justice, FBI, DEA, USPIS, HSI, IRS-CI, ATF, Naval Criminal Investigative Service (NCIS), and the FDA’s Office of Criminal Investigations.
- The seized drugs include 64 kilograms (141 pounds) of fentanyl or fentanyl-laced narcotics; over 258 kilograms (569 pounds) of amphetamines; 43 kilograms (95 pounds) of cocaine; 43 kilogram (95 pounds) of MDMA; and over 10 kilograms (22 pounds) of LSD and ecstasy pills, authorities said.
- These new niche sites are focused on specific illicit goods, offering enhanced security and a more targeted environment for buyers and sellers.
The vendor accepts BTC and XMR, and analyzing its on-chain exposure to regional CEXs and DNMs reveals that it serves customers worldwide, including in the United States, Canada, Sweden, and Russia. The Reactor graph below shows this vendor’s connection with drug vendors on Abacus Market. As reported last year, some drug shops have been outsourcing services like website hosting and payment processing. IKlad.biz and Klad.cc, shown in the chart above, are examples of those infrastructure providers. While these outfits are not traditional DNMs, their success highlights how drug vendors are scaling their operations throughout Russian-speaking countries. In spite of Hydra Market’s disruption in 2022, former Hydra affiliates still found operating in today’s DNMs rely heavily on these infrastructure providers.
Hundreds Nabbed In Global Crackdown On Dark-web Drug Marketplace
The RAKS bust also reignites the perpetual debate within the crypto community regarding decentralization versus regulation. While the ethos of decentralization champions freedom from central authority, the persistent misuse of crypto by entities like RAKS underscores the challenges this poses for oversight. Discussions are now more intense around finding a pragmatic balance – how to preserve the core tenets of decentralization while implementing effective regulatory frameworks that prevent criminal exploitation. This event will likely accelerate dialogues on “regulated blockchain” models and international cooperation to combat cross-border financial crime. Using his credentials, cybercriminals committed a variety of online fraud activity over the course of six months.
(He declined to share detailed numbers, which he says are part of a still-unpublished study.) “What happened in 2017 was very unique, that one-two punch,” Christin says. A nine-count indictment was unsealed in the Western District of Tennessee charging six alleged members of a criminal street gang known as Unknown Vice Lords (UVL) – Ghost Mob with… Today, a federal jury in Memphis convicted Mervin Anderson, 40, of Memphis, Tennessee, of one count of possession of contraband in prison, including two homemade knives, or shanks. District Court for the Eastern District of New York unsealed a superseding indictment charging Volodymyr Viktorovich Tymoshchuk — also known as deadforz, Boba, msfv, and farnetwork…
When it comes to cybercriminal enablement, markets like Kraken Market, the DNM Aggregator, and Exploit.in are go-to services, providing bad actors with tools to carry out ransomware attacks, hacks, and more. Kraken Market also captured the largest share of transfers potentially sent for the purpose of obfuscating funds, as well as buying illegal products. In addition to that activity, markets like these host vendors that advertise their own cashout or swapping services, resulting in tens of millions of dollars in laundered funds. Cybercrime enablement represents flows from ransomware, stolen funds, malware, or fraud shops to darknet markets. Darknet markets were one of two categories of crypto crime that saw revenues rise in 2023.
Buyers and sellers are often subject to vetting processes that reduce fraud and scam risks, making these platforms more reliable and secure for customers. By offering heightened anonymity and stronger defenses against law enforcement, these markets attract criminals who feel they provide a safe environment. Historically, the darknet drug trade has been dominated by large, multi-purpose platforms like AlphaBay and DrugHub.
The platform only prohibited the sale of child abuse material, contract killing services, weapons, and Fentanyl-based substances. “With all of that said you decide for yourself whether you ride the wave with us to the top and beyond,” he wrote in a message to users on the dark web market forum Dread. “I understand if you decide not to but over time you will be proven that we are the original AB and we have never been ‘compromised’ in any way shape or form.” DeSnake counters that if law enforcement had gotten to him and launched the new AlphaBay as a honeypot, they would have simply reused the original AlphaBay’s code.
Latest High-Profile Arrests
“Our coalition of law enforcement authorities across three continents proves that we all do better when we work together,” Europol’s director Catherine De Bolle said. Police also recovered 50.8 million euros ($53.4 million) in cash and virtual currency and seized 850 kilos of drugs, mainly amphetamines and opioids, Europol and the DOJ added. Darknet markets are, after all, very tiny in the grand scheme of things, the research said. “Satisfied customer, will be back,” writes one user on the product page of a meth dealer with the handle shardyshardface.
