What is a darknet market?

A darknet market — also called a dark web marketplace, darknet marketplace, or dark web market — is an e-commerce platform that operates on the dark web, accessible only through anonymizing networks such as Tor (The Onion Router), and that facilitates the buying and selling of illegal goods and services often using cryptocurrency as a payment method. Darknet markets trade primarily in illegal drugs, stolen data and credentials, cybercrime-as-a-service tools, counterfeit documents, and fraud services — all transacted pseudonymously through bitcoin, Monero, and other cryptocurrencies to obscure the financial trail between buyers, vendors, and market operators.

The first major darknet market, Silk Road, launched in 2011 and processed an estimated $1.2 billion in transactions before the FBI seized it in 2013 and arrested its founder. That takedown did not end darknet commerce; it demonstrated its resilience. AlphaBay, Hansa, Hydra, and dozens of successor markets followed, each more sophisticated than the last, until Hydra’s 2022 seizure — coordinated by the DOJ, DEA, IRS-CI, and Europol — resulted in the confiscation of approximately $25 million in cryptocurrency and the shutdown of what had become the world’s largest darknet marketplace.

For compliance teams at cryptocurrency exchanges, financial institutions, and VASPs, darknet markets represent one of the highest-priority illicit exposure categories: a persistent, high-volume source of crypto transactions that require real-time screening, transaction monitoring, and SAR filing capability. For law enforcement, darknet markets are a primary target for blockchain analytics-driven investigations — and one where Chainalysis has been directly involved in major enforcement actions.

Why do darknet markets matter?

Scale and Persistence of the Darknet Economy

Darknet markets represent a multi-billion-dollar segment of the global illicit economy that has persisted and adapted through more than a decade of international law enforcement pressure. Chainalysis data show that darknet market revenue has consistently generated hundreds of millions to billions of dollars in annual cryptocurrency flows, making them one of the largest and most measurable categories of crypto-enabled financial crime.

When AlphaBay was seized in 2017, traffic shifted to Hansa. When Hydra was seized in 2022, successor Russian-language markets absorbed its vendor base within months. Understanding the darknet economy requires understanding its systemic resilience, not just its individual participants.

Cryptocurrency as the Engine of Darknet Commerce

Cash is untraceable but impractical for pseudonymous online transactions; cryptocurrency is practical, borderless, and often perceived as anonymous by unsophisticated users. Bitcoin has historically been the dominant payment currency on darknet markets, but Monero has grown as a privacy-preferred alternative among vendors and buyers seeking stronger transaction obfuscation. The pseudonymous nature of cryptocurrency transactions creates a paradox: users believe they are invisible, but every transaction is permanently recorded on a public blockchain, creating the forensic evidence trail that blockchain analytics platforms use to trace, attribute, and disrupt darknet market activity.

The Compliance and Law Enforcement Imperative

Darknet market proceeds must eventually reach fiat currency to be useful, and that conversion almost always passes through a regulated cryptocurrency exchange. The compliance obligation for exchanges, financial institutions, and VASPs is clear: transaction monitoring programs must be capable of detecting darknet market exposure in incoming and outgoing transactions, flagging accounts with darknet market links for SAR filing, and cooperating with law enforcement requests for records supporting active investigations. Exchanges that fail to screen for darknet market exposure face regulatory enforcement, correspondent banking restrictions, and potential criminal liability for processing illicit proceeds. The quality of darknet market attribution data is the primary determinant of whether screening programs actually work.

$25M

Cryptocurrency seized during the Hydra Market takedown in April 2022 — coordinated across DOJ, DEA, IRS-CI, and Europol — representing the largest darknet market enforcement action to date.

How do darknet markets work?

Darknet markets replicate the structure of legitimate e-commerce platforms — product listings, vendor ratings, escrow payment systems, customer reviews, and dispute resolution — but operate on anonymizing infrastructure designed to obscure the identities of operators, vendors, and buyers from law enforcement.

Accessing Darknet Markets: Tor and Onion Routing

Darknet markets operate as hidden services on the Tor network — accessible only through Tor Browser, which routes traffic through a series of encrypted relays (onion routing) to conceal the user’s IP address and location. Each darknet marketplace has a .onion address — a long string of alphanumeric characters — that is not indexed by conventional search engines and changes periodically to evade seizure. Users discover current .onion addresses through darknet forums, Telegram channels, and community boards that function as the dark web’s equivalent of search engines.

Tor provides meaningful anonymity against passive traffic monitoring, but it does not eliminate law enforcement visibility. Server IP addresses can be exposed through misconfiguration; timing correlation attacks can link Tor circuits to user locations. Cryptocurrency transactions made through darknet markets are recorded on public blockchains that blockchain analytics can trace, regardless of how the user accessed the market.

Market Structure and Features

Functionally, darknet markets resemble Amazon or eBay: product categories, vendor storefronts, rating systems, search functionality, and messaging infrastructure. Vendors create accounts, list products with prices denominated in bitcoin or Monero, and accumulate reputation scores from buyer feedback. Larger markets employ administrators, moderators, and customer support staff — a full organizational structure operating behind pseudonymous identities. Markets operate strict prohibited categories (typically no weapons of mass destruction, no content involving minors) but otherwise offer broad product and service availability.

Escrow and Payment Systems

Darknet markets use cryptocurrency escrow systems to build buyer trust and facilitate transactions between parties who cannot verify each other’s identities. In centralized escrow, the market holds cryptocurrency from the buyer until the buyer confirms delivery, then releases it to the vendor. In multi-signature (multisig) escrow, the market, buyer, and vendor each hold a cryptographic key, and any two of three signatures can release funds — reducing the market operator’s ability to abscond with escrowed funds. Despite these mechanisms, escrow systems have been a primary vector for exit scams, in which market operators drain escrowed funds and disappear.

Vendor Operations and Operational Security

Experienced darknet vendors employ layered operational security (OPSEC) practices: PGP encryption for all communications, separate operational identities for each market, use of Monero for vendor-side transactions, physical drop points rather than personal addresses for shipments, and cryptocurrency tumbling to obscure proceeds. Despite these precautions, vendor OPSEC failures — reused usernames, unencrypted communications, shipping patterns, and cryptocurrency flows that can be traced on-chain — have been the primary vectors through which law enforcement has identified and arrested high-volume darknet vendors.

Exit Scams and Market Disruptions

Exit scams — in which market operators drain the escrow accounts holding buyer and vendor cryptocurrency and disappear — are endemic to the darknet ecosystem. The 2019 Wall Street Market exit scam, in which operators took approximately $11 million in escrowed funds before attempting to flee, is among the largest documented. Incognito Market’s 2024 exit scam went further: operators attempted to extort vendors and buyers by threatening to publish their transaction records unless ransom was paid before disappearing with escrowed funds. The structural vulnerability of centralized escrow to operator misconduct has driven some markets toward multisig escrow models and vendor direct-pay arrangements that reduce operator custody of user funds — but have not eliminated exit scam risk.

Darknet markets vs. the deep web vs. the surface web

These three terms are frequently conflated, including in regulatory and compliance contexts where precision matters. Understanding the distinction is essential for accurate risk assessment and communication with regulators, law enforcement, and executive audiences.

 

Layer How It’s Accessed Examples What It Contains
Surface Web (Open Web) Standard browsers; indexed by Google, Bing, and other search engines News sites, social media, company websites, Wikipedia Publicly accessible content — approximately 5% of total internet content
Deep Web Standard browsers with authentication; not indexed by search engines Email inboxes, bank portals, medical records, subscription databases, corporate intranets Private but legal content requiring login or direct access — approximately 90%+ of total internet content
Dark Web (Darknet) Requires Tor Browser or other anonymizing software; not indexed; .onion addresses Darknet markets, forums, illicit services — but also legitimate privacy tools, journalist communication platforms, political dissident resources Mix of illicit commerce and legitimate anonymity use cases; a subset of deep web content

 

The deep web is simply the portion of the internet not indexed by search engines. It includes your email inbox, your bank’s customer portal, and every other private but lawful system that requires authentication. The dark web is a specific, smaller subset of the deep web that requires specialized software to access and that deliberately obscures the location of servers and users. Darknet markets are a category of dark web site, but not synonymous with the dark web itself.

This distinction matters for compliance and regulatory communication: characterizing all deep web activity as illicit overstates the risk surface, while conflating the dark web with the deep web understates the specific threat that darknet markets represent.

What is sold on darknet markets?

Darknet markets have evolved from primarily drug marketplaces into diversified criminal service ecosystems. The current product taxonomy spans five major categories:

Illegal Drugs

Illegal drugs — including cocaine, heroin, MDMA, methamphetamine, fentanyl, and pharmaceutical opioids — remain the dominant product category on darknet markets by transaction volume. Vendors ship through postal and parcel services, using concealment techniques to evade customs inspection. The scale of darknet drug trade has grown continuously since Silk Road: Chainalysis data and law enforcement seizures document multi-million-dollar vendor operations shipping to buyers across dozens of countries. The fentanyl crisis has added a specific dimension — small-volume, high-potency shipments that are difficult to intercept and have contributed directly to overdose mortality.

Stolen Data and Credentials

Stolen personal data — including credit card numbers, bank account credentials, Social Security numbers, passport scans, and corporate login credentials obtained through data breaches and phishing campaigns — is sold on darknet markets in bulk packages and individual listings. Russian Market and similar platforms specialize in “logs,” which are packages of browser-extracted credentials, cookies, and payment data harvested by infostealer malware from infected machines. These products are a direct input to identity theft, account takeover fraud, and business email compromise operations, linking darknet market activity to downstream financial crime across the traditional banking system.

Cybercrime-as-a-Service

Darknet markets and associated forums offer a full suite of cybercrime capabilities for purchase: ransomware kits and ransomware-as-a-service (RaaS) subscriptions, DDoS-for-hire services, phishing kits and targeting lists, custom malware development, exploit brokers, and initial access brokers selling pre-compromised corporate network access. This cybercrime-as-a-service ecosystem has dramatically lowered the barrier to entry for sophisticated financial crime — enabling actors without technical expertise to purchase and deploy ransomware, conduct data breach attacks, or execute fraud campaigns. The darknet market infrastructure supporting cybercrime-as-a-service is a direct threat to financial institutions, critical infrastructure, and government systems.

Counterfeit Documents and Currency

Counterfeit identity documents — passports, driver’s licenses, Social Security cards — are sold on darknet markets for use in identity fraud, account opening fraud, and money mule recruitment. Counterfeit currency is available in multiple denominations. These products directly enable the opening of fraudulent bank accounts and crypto exchange accounts used to launder darknet market proceeds and other illicit funds, creating a feedback loop between darknet market activity and the regulated financial system.

Fraud Services

Carding services — using stolen credit card data to make fraudulent purchases — are among the most active product categories on darknet markets. Specialized carding markets list card data by issuing bank, card type, and geographic region, with prices reflecting estimated credit limits and verification bypass capability. Money mule services, fraudulent check operations, and account takeover services complete the fraud service taxonomy. For financial institutions, the darknet market fraud service ecosystem is a direct source of financial losses that transaction monitoring programs must detect and prevent.

How are darknet markets investigated and disrupted?

Major darknet market takedowns are the product of multi-year, multi-agency investigations combining blockchain analytics, undercover operations, technical exploitation, and international law enforcement cooperation. No single technique is sufficient; each successful enforcement action has combined methods in ways specific to the target market’s vulnerabilities.

Blockchain Analytics and Transaction Tracing

Blockchain analytics is the investigative foundation of modern darknet market enforcement. Because every darknet market transaction is recorded on a public blockchain, investigators can trace fund flows from buyer wallets to market deposit addresses, map vendor withdrawal patterns, identify exchange cashout points, and attribute wallet clusters to real-world identities — all from publicly available on-chain data. Chainalysis Reactor has been the primary blockchain analytics tool in the majority of significant darknet market enforcement actions, enabling investigators to follow cryptocurrency proceeds from market wallets through layering transactions to the exchange accounts and bank accounts where darknet operators attempted to cash out.

When AlphaBay operator Alexandre Cazes was arrested in 2017, blockchain analytics had already mapped his Bitcoin withdrawal patterns from AlphaBay to exchange accounts linked to his identity. When Hydra Market was seized in 2022, on-chain analysis of Hydra’s wallet infrastructure provided investigators with the full scope of market revenue — approximately $5.2 billion in cryptocurrency over its operational life — and identified the network of exchanges and financial institutions that had processed Hydra proceeds.

Undercover Operations and Market Infiltration

Law enforcement agencies — including the FBI, DEA, and Europol — have conducted undercover operations on darknet markets, establishing vendor accounts, making controlled purchases, and building cases against high-volume vendors. The 2017 Operation Bayonet included a phase in which Dutch National Police secretly operated Hansa Market for 27 days after takedown, collecting buyer and vendor data before shutting the site down — providing a database of active market participants that supported arrests across multiple countries. These infiltration operations are only possible in combination with technical infrastructure that identifies market participants through OPSEC failures, and they depend on blockchain analytics to follow the cryptocurrency flows that connect pseudonymous market accounts to real identities.

Server Seizure and Infrastructure Exploitation

Darknet market servers, while typically operated through Tor hidden services, can be identified and seized through misconfiguration, hosting provider cooperation, or active technical exploitation. Server seizures provide law enforcement with market databases: vendor and buyer account information, transaction histories, communications, and cryptocurrency wallet data. The Silk Road server was identified partly through a misconfigured login interface that leaked the server’s real IP address. AlphaBay’s server infrastructure was seized across multiple jurisdictions simultaneously to prevent operational migration. Server data, combined with blockchain analytics of market wallet activity, provides the complete picture of market operations that supports prosecution.

International Law Enforcement Cooperation

The most significant darknet market enforcement actions have been coordinated international operations involving the FBI, DEA, IRS Criminal Investigation, HSI, Europol, Eurojust, and national law enforcement agencies across dozens of countries. Operation Bayonet (2017) coordinated FBI and Dutch National Police against AlphaBay and Hansa simultaneously. Operation Dark HunTor (2021) resulted in 150 arrests across the United States, Europe, and Australia following analysis of data from seized markets. Operation SpecTor (2023) produced 288 arrests and the seizure of $53.4 million in cash and cryptocurrency. Operation RapTor (2025) resulted in more than 270 arrests across 10 countries and the seizure of over $200 million in drugs and assets. International coordination is essential because darknet market operators, vendors, and infrastructure are distributed across jurisdictions specifically to complicate enforcement.

Monitoring Successor Markets and Migration Patterns

When a darknet market is seized, its vendor and buyer base typically migrates to successor markets. Blockchain analytics enables investigators to follow this migration: tracking the movement of vendor wallets from a seized market to their next operational platform, identifying which successor markets absorb the displaced user base, and maintaining surveillance of the reconstituted ecosystem. Chainalysis research has documented consistent post-seizure migration patterns across multiple market generations, providing law enforcement with the predictive intelligence needed to identify the next enforcement target before it reaches Hydra-scale revenue.

Risks and common misconceptions about darknet markets

“Darknet markets are anonymous and untraceable.”

Tor provides meaningful IP address anonymity; it does not anonymize cryptocurrency transactions. Bitcoin, the dominant darknet market currency, records every transaction permanently on a public ledger. Blockchain analytics platforms attribute Bitcoin wallet addresses to real-world entities through clustering heuristics, behavioral analysis, and exchange intelligence — and the attribution capability of platforms like Chainalysis has been the primary mechanism through which darknet market operators, administrators, and high-volume vendors have been identified, arrested, and prosecuted. The persistent belief in cryptocurrency anonymity among darknet participants is, from a law enforcement perspective, an investigative asset.

“Darknet markets are a small, niche problem.”

Chainalysis data document billions of dollars in annual cryptocurrency flows through darknet market infrastructure. Hydra Market alone processed an estimated $5.2 billion in cryptocurrency over its operational life. Russian Market and its successors have listed tens of millions of compromised credentials. The downstream effects of darknet market activity — drug overdose mortality, identity theft losses, ransomware campaigns funded by darknet-procured tools, and fraud enabled by darknet-sold credentials — represent measurable harm at population scale. For compliance teams, the question is not whether darknet market exposure is a real risk — it is whether their screening programs are sophisticated enough to detect it.

“Taking down one market solves the problem.”

Every major darknet market seizure has been followed by market succession and revenue recovery. When Silk Road was seized in 2013, AlphaBay launched the following year and grew to ten times Silk Road’s size. When AlphaBay was seized in 2017, Hydra emerged as the dominant Russian-language market. When Hydra was seized in 2022, multiple successor markets absorbed its infrastructure within months. The darknet market ecosystem is structurally resilient: distributed vendor bases, cryptocurrency payment systems that don’t require market-operated banking infrastructure, and a persistent buyer demand base ensure that enforcement disruption produces displacement rather than permanent elimination. Law enforcement treats successive takedowns as the objective — continuously disrupting operations, degrading trust between market participants, and raising the operational security cost for market operators — rather than expecting any single action to end darknet commerce.

“Monero makes darknet transactions completely untraceable.”

Monero’s privacy features — ring signatures, stealth addresses, and RingCT — make transaction tracing significantly more difficult than Bitcoin analysis. However, “more difficult” is not “impossible.” Law enforcement has made Monero-related arrests. Blockchain analytics research continues to advance Monero tracing capability. Critically, even markets that accept Monero typically also accept bitcoin for a subset of transactions, and vendor behavior — including converting Monero proceeds to bitcoin for exchange cashout — creates on-chain linkages that analytics can exploit. Additionally, the fiat off-ramp for darknet proceeds almost always passes through a regulated exchange with KYC records, regardless of what cryptocurrency was used on-market. The regulated exchange remains the compliance chokepoint even when on-chain transaction history is obscured by privacy features.

Compliance risks for exchanges and financial institutions

Regulated cryptocurrency exchanges face direct regulatory and legal exposure from processing darknet market proceeds. KYT monitoring programs that fail to detect deposits from darknet market wallets or withdrawals to darknet market-linked addresses expose exchanges to FinCEN enforcement, potential OFAC designation risk if transactions involve sanctioned entities, and correspondent banking restrictions if institutional partners assess the exchange’s AML program as inadequate. The risk is not only from direct darknet market exposure: indirect exposure through mixer transactions, layering through multiple wallets, and the use of privacy coins to obscure fund origins creates compliance risk that requires multi-hop transaction graph analysis to detect — not just direct address screening.

Real-world examples: major darknet market enforcement actions

The following enforcement actions represent the most significant darknet market takedowns of the past decade. Blockchain analytics played a central investigative role in each.

 

Market Year Enforcement outcome Blockchain analytics role
Silk Road 2013 FBI seizure; founder Ross Ulbricht convicted and sentenced to life in prison; ~$1B in Bitcoin seized across proceedings Bitcoin transaction tracing linked Silk Road wallet addresses to Ulbricht’s personal accounts; blockchain evidence was central to conviction
AlphaBay 2017 Operation Bayonet: simultaneous FBI/DEA/Dutch Police action; operator Alexandre Cazes arrested in Thailand; server infrastructure seized across multiple jurisdictions Chainalysis traced AlphaBay Bitcoin flows to exchange accounts registered to Cazes; on-chain analysis mapped the full revenue footprint of the market
Hansa Market 2017 Dutch National Police operated Hansa covertly for 27 days post-takedown, collecting buyer/vendor data before shutdown; supported arrests across Europe Transaction data from Hansa’s wallet infrastructure cross-referenced with blockchain analytics to identify users who had migrated from AlphaBay
Hydra Market 2022 DOJ/DEA/IRS-CI/Europol coordination; ~$25M in cryptocurrency seized; German servers taken down; largest darknet market by revenue at time of seizure Chainalysis documented $5.2B in total Hydra revenue; on-chain analysis identified the exchange network processing Hydra proceeds, supporting parallel financial enforcement
Operation Dark HunTor 2021 150 arrests across US, Europe, and Australia; $31.6M in cash and cryptocurrency seized; based on data from multiple seized markets Blockchain analytics of seized market wallet data enabled cross-border identification of vendors and buyers across multiple post-seizure markets
Operation SpecTor 2023 288 arrests across multiple countries; $53.4M in cash and cryptocurrency seized; 850+ kg of drugs; largest coordinated darknet enforcement action to date Transaction tracing from seized market data identified vendor financial infrastructure across jurisdictions; cross-chain analysis traced proceeds through mixing attempts
Incognito Market 2024 Exit scam and extortion: operators took $4.5M in escrowed funds and threatened to publish transaction records; operator arrested On-chain transaction records provided investigators with complete market activity history; wallet tracing identified operator cashout attempts through exchange accounts
Operation RapTor 2025 270+ arrests across 10 countries; $200M+ in drugs and assets seized; coordinated Europol/DOJ action targeting mid-level vendors across multiple active markets Reactor-based analysis of active market wallet clusters identified mid-tier vendor infrastructure; cross-chain tracing followed layered proceeds to fiat off-ramps

 

How Chainalysis helps organizations investigate and monitor darknet markets

Chainalysis has been the blockchain analytics provider in the majority of significant darknet market enforcement actions over the past decade — not as a passive data source, but as the investigative platform used by FBI, DEA, IRS-CI, Europol, and partner agencies to trace funds, identify operators, and build prosecutable cases. The same platform and attribution data that supports law enforcement investigations powers the transaction monitoring programs of regulated exchanges and financial institutions.

Chainalysis Reactor

Reactor is the investigation platform used by law enforcement to trace darknet market funds through the transaction graph. Investigators use Reactor to follow cryptocurrency from a known darknet market deposit address through layering transactions — mixer deposits, exchange transfers, wallet consolidations — to the final cashout point where market proceeds reach fiat currency. Reactor’s interactive graph interface visualizes these multi-hop fund flows across dozens of supported blockchains, producing evidence-quality outputs that have supported prosecutions in every major darknet market case of the past decade. The attribution database underlying Reactor is continuously updated with new darknet market wallet clusters as they are identified through ongoing research and law enforcement intelligence sharing.

Chainalysis KYT (Know Your Transaction)

KYT provides the real-time transaction monitoring layer that enables regulated exchanges and VASPs to detect darknet market exposure before processing illicit proceeds. KYT maintains continuously updated attribution data covering known darknet market deposit and withdrawal addresses, flags transactions with direct or indirect darknet market exposure, and generates risk alerts for compliance team review and SAR filing. For exchanges processing high transaction volumes, KYT provides automated darknet market screening at the scale that manual review cannot achieve — and with the attribution depth that simple address blacklists cannot match.

Chainalysis Data and Intelligence

The attribution data underlying every Chainalysis product includes continuously updated darknet market intelligence: identified market wallet clusters, vendor address databases, and behavioral indicators associated with darknet market activity. This data layer is maintained by Chainalysis research teams in direct coordination with law enforcement partners, ensuring that the attribution data powering KYT monitoring and Reactor investigations reflects the current state of the darknet market ecosystem — not its state as of initial database build.

$5.2B

Total cryptocurrency revenue processed by Hydra Market over its operational life — documented through Chainalysis blockchain analytics and cited in DOJ enforcement proceedings at the time of the market’s 2022 seizure.

Frequently asked questions about darknet markets

Q: What is a darknet market?

A: A darknet market is an e-commerce platform operating on the dark web — accessible through the Tor anonymizing network — that facilitates the buying and selling of illegal goods and services, primarily using cryptocurrency as payment. Darknet markets trade in illegal drugs, stolen data, cybercrime tools, counterfeit documents, and fraud services, using Bitcoin and Monero to conduct pseudonymous transactions between buyers, vendors, and market operators.

Q: Are darknet markets still active?

A: Yes. Despite sustained international law enforcement action — including the seizures of Silk Road (2013), AlphaBay (2017), Hydra (2022), and hundreds of arrests through Operations Dark HunTor, SpecTor, and RapTor — the darknet market ecosystem has proven structurally resilient. When major markets are seized, vendor bases and user traffic migrate to successor platforms. Active darknet markets continue to generate hundreds of millions to billions of dollars in annual cryptocurrency flows, as documented in the Chainalysis Crypto Crime Report.

Q: How do law enforcement agencies track activity on darknet markets?

A: Law enforcement uses a combination of blockchain analytics, undercover operations, server seizure, and international coordination to investigate darknet markets. Blockchain analytics — using platforms like Chainalysis Reactor — traces cryptocurrency flows from darknet market deposit addresses through layering transactions to the fiat cashout points where proceeds reach regulated exchanges, identifying operators and vendors through their financial activity. Undercover operations establish vendor identities through controlled purchases. Server seizures provide market databases with account and transaction records. These methods are most effective in combination across coordinated international operations.

Q: What is the difference between the dark web and the deep web?

A: The deep web refers to all internet content not indexed by standard search engines — including email inboxes, bank portals, medical databases, and subscription services. It is large (representing the majority of internet content) and mostly lawful. The dark web is a specific, much smaller subset of the deep web that requires specialized software — typically Tor Browser — to access, and that uses anonymizing infrastructure to conceal the location of servers and users. Darknet markets are a category of dark web site — they are not synonymous with either the dark web or the deep web.

Q: What cryptocurrency do darknet markets use?

A: Bitcoin has historically been the dominant payment currency on darknet markets due to its liquidity and broad acceptance. Monero has grown as a privacy-preferred alternative, valued for its ring signature and stealth address features that make transaction tracing more difficult than Bitcoin analysis. Some markets accept both; others have shifted toward Monero-only policies in response to blockchain analytics advances. Despite Monero’s privacy features, the fiat off-ramp for darknet market proceeds almost always passes through a regulated exchange — making KYC records at the exchange the persistent compliance chokepoint regardless of on-chain transaction privacy.

Darknet markets remain one of the most persistent threats in the crypto crime landscape.

Chainalysis gives law enforcement, compliance teams, and financial institutions the tools to trace, monitor, and investigate darknet market activity across every major blockchain.

Request a Demo  →  See how Chainalysis can help your organization combat darknet-enabled financial crime.

Read the 2026 Crypto Crime Report’s darknet market analysis  →

Explore Chainalysis Reactor for darknet investigations  →

Learn how Chainalysis KYT detects darknet market exposure  →