TL;DR
- Darknet market activity remains resilient, with aggregate DNM flows reaching nearly $2.6 billion in 2025, underscoring the persistence of crypto-enabled drug markets despite repeated enforcement actions.
- On-chain fentanyl-related flows declined sharply, aligning with a decline in fentanyl interdictions and a meaningful drop in opioid overdose deaths — highlighting blockchain data as a means of measuring strategic and operational impact as well as a potential early warning signal for public health authorities.
- Stimulant-related analysis using Canadian public health data shows transaction size matters: larger crypto purchases correlate with worse health outcomes, while smaller transactions show no meaningful association.
- DNMs increasingly function as a globalized supply network, with inter-market resupply, post-disruption migration, and TorZon’s rise following Abacus Market’s closure in July 2025 reshaping cross-market dynamics.
- Fraud shop activity has declined YoY, which was driven by enforcement pressure and increased use of custodial merchant services, while Chinese-language fraud shops appear to be consolidating into higher-value, wholesale-focused operations.
Darknet markets (DNMs) remain one of the most persistent segments of the crypto-enabled illicit economy. Despite repeated law enforcement takedowns, market exits, and infrastructure disruptions, DNMs continue to facilitate the sale of illicit drugs at scale, while also serving as key hubs for fraud-related services. In 2025, on-chain activity associated with DNMs and adjacent fraud shops rose YoY, but this contraction masks important structural shifts within the ecosystem — particularly in how illicit drug markets resupply, how fraud services are organized, and how crypto-based drug purchasing can shed light on public health crises.
Over the years, one of our most consistent findings has been the resilience of darknet drug markets and the growing analytical value of blockchain data. Crucially, this on-chain data can be operationalized, not only by law enforcement and the private sector, but also by public health authorities — providing real-time, actionable insights.
Darknet markets continue to process billions in annual crypto flows
Total crypto inflows to drug vendors and DNMs increased slightly YoY in 2025 to slightly over $2.5 billion.
Drug vendors and darknet markets, which are grouped together in the Crypto Crime Report but are distinct entities in our product suite, facilitate retail and wholesale drug sales, with payments typically flowing from personal wallets and exchanges into escrow services or vendor-controlled addresses. While mainstream darknet marketplaces also offer fraud-related goods and hacking tools, drugs generally account for the majority of listings. Taken together, aggregate flows tell us how large an ecosystem is — but not how it affects the real world. To understand that, we turn to a specific drug category where on-chain activity intersects directly with off-chain realities and public health outcomes.
On-chain data reflect fentanyl supply chain disruption
Some good news: deaths from fentanyl overdoses in the U.S. have declined since they peaked in 2023. Given that explaining this dramatic drop is of interest to scientists and policymakers alike, academics recently made the case in Science for one major driver: a reduction in the supply of fentanyl. Specifically, they analyzed public reports and communications to make the case that improved collaboration between the U.S. and China, which led to China taking direct action on online fentanyl precursor vendors, disrupted supply at the source. These actions translated into sharp reductions in overdose mortality, a trend first observed in 2023 that continued into 2025 in both the US and Canada.
On-chain data reflect this development. Throughout 2022, crypto transaction volumes to fentanyl-related precursor brokers – operating disproportionately in China – steadily climbed. These fluctuations preceded the sustained high levels of overdose deaths in the US that persisted through 2022 and early 2023, when the 12-month rolling death toll remained around 80,000.
The U.S. Government then took several actions with China, including:
- October 2023: Sanctions and indictments against China-centric drug trafficking networks that used cryptocurrency to sell fentanyl precursors.
- November 2023: Former President Biden and President Xi Jinping announced the resumption of bilateral cooperation on counternarcotics and China’s Office of the National Narcotics Control Commission published a notice urging caution in the selling of substances that could be used to produce drugs.
- January 2024: The two countries launched a bilateral working group.
In March 2025, China issued a White Paper stating that by June 2024, more than 140,000 advertisements and 14 online platforms had been taken down.
As seen below, business-to-business websites that were once watering holes for brokers have strayed away from hosting listings of fentanyl-related chemicals (like sodium borohydride, which is on the DEA’s Special Surveillance List due to its use as a reagent in fentanyl synthesis), and brokers have begun turning away customers in the US, Mexico, and Canada. For the chemicals that are finding their way in through US borders, brokers claim that those packages are now more likely to be seized, which adds to their hesitancy to engage with the US market.
The key question, however, is whether these policy and enforcement actions translated into measurable changes in illicit supply. On-chain data can provide a compelling method to test that hypothesis in near real-time.
According to the Science article authors, it is challenging to determine whether a supply shock could account for a substantial part of the decline in deaths, because drug trafficking organizations operate clandestinely. They suggest that “developing and deploying more systematic methods for monitoring illicit drug supply chains… could improve the ability of law enforcement and public health authorities to detect and effectively address future supply shocks.”
More good news: because fentanyl supply chains operate to a large extent on crypto rails, we can gain actionable insights in real-time that are not always available through other sources. We can see that the sharp decline in crypto flows to fentanyl precursor vendors began in mid-2023, preceding the substantial drop in overdose deaths that became apparent in official statistics by late 2023 and continued throughout 2024. Disruptions to fentanyl precursor sales – which reflect the fact that many fentanyl precusor vendors either went dark, delisted fentanyl-related chemicals, or ceased shipment of such chemicals to the US – as well as a decrease in border interdictions, point to a meaningful disruption of the fentanyl supply chain at the precursor procurement stage.
We reached out to the authors of the Science article with our analysis and they shared: “The Chainalysis study adds an important additional indicator that a decrease in Chinese fentanyl precursors contributed substantially to the decline in fatal opioid overdoses. That the decline in crypto flows to fentanyl precursor vendors starts just before the downturn in deaths is also consistent with this hypothesis, since the flow of fentanyl into the US lags precursor payments.”
Indeed, this dramatic correlation suggests that monitoring crypto flows could potentially provide 3-6 months of advance warning for changes in overdose trends long before patient data are collected, indexed, and processed by public health authorities.
This good news, though, may not last. Supply disruptions are often fleeting, and as long as demand persists, and synthetic drug manufacturing remains a profitable alternative to agriculturally cultivated substances like heroin, trafficking organizations can adapt to supply shocks and find workarounds. In terms of non-fentanyl related synthetic drugs, precursors for methamphetamine, MDMA, and cannabinoids are still being advertised by brokers and shipped worldwide. Interdictions of methamphetamine at the southern border doubled in 2025, which further illustrates that trafficking organizations are prompt in their pivoting to the next-best profitable alternative.
China could change its posture on counter-fentanyl enforcement, against the backdrop of a range of other hotly contested geopolitical issues. Vendors in other countries, like India, could step in to fill the supply gap. Pre-precursors, and other basic pharmaceutical building blocks, could remain uncontrolled due to their many legitimate uses, which means that cartels could construct more sophisticated labs that can support the advanced synthesis required to manufacture fentanyl from these basic chemicals. And as such, government agencies and public health experts may seek data for monitoring drug markets and supply, not just drug use and deaths. And as more economic activity moves on chain – both illicit and legitimate – use cases for real-time transaction data will grow.
Transaction size separates personal use from stimulant distribution
For another example of the potential predictive power of crypto data, we turn to Canadian health data.
We analyzed the relationship between crypto flows to darknet markets and public health outcomes (ER visits, hospitalizations, and deaths). The data tells two very different stories depending on the size of the transaction:
- Small Transfers (<$500): There is no relationship between small payments and health outcomes. The trend line is flat.
- Large Transfers (>$500): There is a strong, positive link between these flows and negative health outcomes. As money flows increase, stimulant-related hospitalizations and ER visits rise.
So, what’s going on here and why does it matter?
Mechanically, it is likely that transfers in excess of $500 represent larger purchases intended for either heavy personal use or redistribution. Whether this volume is consumed by the buyer or dispersed to others, the presence of this quantity in the community increases the probability of harm. This leads to more ER visits, more hospitalizations, and, tragically, more deaths within the quarter.
Just like the fentanyl example, money moves before the crisis hits. People buy drugs before they redistribute them, and users consume them before they overdose and require medical care.
Because on-chain data is transparent and real-time, it can serve as a high-fidelity “early warning system.” Public health agencies can use this data to predict spikes in hospitalizations months before they occur, allowing them to prepare rather than react. While these findings help explain downstream harm, they do not shed light on how drugs move through the darknet ecosystem itself. To understand that, we examine how markets source from one another.
Darknet markets function as interconnected global supply network
One of the clearest signals of maturation within the darknet drug economy is the degree to which DNMs increasingly function as suppliers to other DNMs, rather than solely as retail endpoints.
By ranking markets based on inbound flows from other DNMs, we can identify “anchors” that serve as upstream suppliers within the ecosystem. In 2025, a small number of markets accounted for a disproportionate share of these inter-market transfers.
Rather than operating in parallel silos, markets are increasingly interconnected through wholesale relationships. Following the closure in July 2025 of Abacus Market, the largest bitcoin DNM for customers in the West, TorZon emerged as the dominant Western-facing DNM, effectively serving as its primary successor. In terms of supplying other markets, TorZon also ascended past western darknet markets of years past, which marks a notable shift. Russia-focused DNMs remain highly active, particularly in synthetic drug distribution, and while TorZon is not operating in the billion-dollar range like Russian markets such as Kraken, OMG!OMG!, Mega, or Blacksprut, it now occupies a central position in the inter-DNM supply network, thus putting it in the same strata.
This evolution coincides with broader changes in drug production and distribution. Western European drug services are increasingly adopting vertically integrated models, engaging more directly in production and upstream supply chains — patterns we are now observing in crypto transaction data. In Operation Fabryka, the largest-ever operation against synthetic drugs, law enforcement and judicial authorities in Belgium, Czechia, Germany, the Netherlands, Poland, and Spain shut down 24 industrial-scale “superlabs,” as demand for synthetic amphetamines has continued to rise in Western Europe and Russia. Drug traffickers see the opportunity to maximize profits by investing in localized synthetic drug production (as opposed to relying exclusively on foreign suppliers), and law enforcement is cracking down.
Disruptions are triggering capital flight and resupply
One consistent trend over time has been that market disruptions consistently produce short-term moves toward capital flows between DNMs, reflecting both resupply activity and user migration. When a major market is shut down, voluntarily closes, or is otherwise compromised, vendors often turn to other DNMs to replenish inventory or re-establish distribution channels. This behavior is visible in sharp increases in DNM-to-DNM transfers following major events.
For example, after the Blacksprut hack in November 2022, which preceded the earlier shutdown of ASAP Market, we observed an immediate and substantial increase in inter-DNM sending, with the gap in net flows swinging from roughly $500,000 in favor of off-chain originating inflows to nearly -$1 million in the direction of intramarket flows. These spikes likely reflect a combination of vendor resupply, consolidation of funds, and precautionary movement of assets in anticipation of further disruptions.
At the same time, the dominant source of inflows into DNMs remains centralized exchanges, particularly in periods of relative market stability. These flows are consistent with retail purchasing behavior, where individuals acquire crypto — often via compliant exchanges — and send funds directly to DNM addresses to purchase illegal drugs.
Taken together, the DNM ecosystem continues to demonstrate both resilience and increasing structural sophistication. While individual markets rise and fall, underlying activity persists through vendor migration, inter-market resupply, and shifting payment behaviors rather than disappearing altogether. As a result, headline transaction volumes offer an incomplete picture; the greater analytical value lies in the visibility on-chain data provides into how illicit markets respond to disruption, enforcement pressure, and changes in global supply chains.
DNMs are no longer best understood as isolated retail platforms, but rather as interconnected nodes within a broader illicit supply network. Inter-DNM transfers and short-term capital movements following disruptions reveal in near real-time how supply chains adapt. Blockchain data provide an invaluable window into these dynamics, equipping analysts to identify shifts, emerging relationships, and downstream effects that can be difficult to observe otherwise — insights that will remain critical as DNMs continue to evolve.
Fraud shops contract amid enforcement, but Chinese-language networks emerge as new wholesale powerhouses
Fraud shops — markets specializing in stolen payment data, credentials, and forged documents — saw on-chain volumes plummet from approximately $205 million to $87.5 million year-over-year. This sharp contraction stems largely from successful law enforcement actions targeting key infrastructure nodes, including the takedown of payment processors like the Universal Anonymous Payment System (UAPS) and laundering services like Cryptex. These disruptions have severely hampered the liquidity and operational capacity of the traditional, largely Russia-facing ecosystem, which now exhibits smaller, more frequent transfers suggestive of a fragmented retail clientele.
Despite these disruptions, there is still an increased pivot to custodial merchant services. It is critical to note that on-chain data of independent fraud shops operating their own wallet infrastructure only offers a partial view into the overall ecosystem, as official metrics do not capture activity that flows into broader custodial services that facilitate payments for many different types of threat actors. Another example of such a service is Sellix, which was dismantled through global law enforcement action in Operation Talent. On top of providing a payment gateway to Cracked and Nulled forums (also targeted in the Operation), they provided merchant services to fraud shops like zyzzmarket and BestCombo, as well as CSAM sites and infrastructure services. Use of a payment processor can provide “exposure laundering” to threat actors, who want to hide in the weeds of a larger service.
However, as Russian-language shops struggle, a distinct and formidable alternative has emerged: Chinese-language Telegram-based fraud networks. These entities represent a shift toward a wholesale operational model, specializing in bulk sales of compromised credit card data.
Unlike their Russian counterparts, Chinese-language shops tend to process significantly larger average transfers, indicating a focus on high-volume, B2B-style criminal transactions. With some Telegram channels boasting tens of thousands of members and offering automated English translations, these networks signal that the fraud economy is not just facing a contraction, but restructuring—moving away from traditional web-based markets toward resilient, wholesale-focused social platforms.
The screenshot below shows that for one of the many Telegram channels geared toward credit card sales, there are nearly 27,000 members. While these Telegram channels are in Chinese, the Telegram bot shops themselves often offer English translations.
Chinese-language Telegram fraud shops tend to process larger average transfers than those of Russian-language fraud shops, consistent with bulk sales of compromised payment data and wholesale-style transactions. Russian-language shops, by contrast, continue to exhibit smaller, more frequent transfers suggestive of a retail clientele.
Why visibility, not volume, matters most
Taken together, these patterns demonstrate something larger than a story about drugs or public health alone. They show that blockchain transaction data can function as a real-time barometer of illicit economic activity — one that consistently surfaces meaningful signals, sometimes months before they are visible through other reporting systems. Whether tracking fentanyl supply shocks, shifts in trafficking routes, or the downstream effects of enforcement actions, crypto flows provide an upstream view of how illicit markets adapt, contract, or expand in response to real-world pressures.
This is the strategic value of on-chain intelligence: it allows policymakers, enforcement agencies, and regulators to move from retrospective analysis to forward-looking insight. Instead of waiting for overdose statistics, seizure data, or hospital admissions to confirm that a crisis is underway — or that an intervention has worked — blockchain data can offer an early read on whether supply chains are tightening, vendors are disappearing, or capital is moving elsewhere. In this sense, crypto flows can signal not only emerging threats, but also the success or failure of policy choices in real-time.
The infrastructure to operationalize this capability already exists. Chainalysis, through its blockchain analytics platform and unrivaled Data Solutions offering, enables governments, financial institutions, and public sector stakeholders to securely translate raw blockchain data into actionable intelligence. By integrating on-chain indicators into existing analytical and decisionmaking frameworks, agencies can better anticipate crises, evaluate enforcement outcomes, and allocate resources based on what illicit actors are doing — not just what has already happened.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
