What Is a Darknet Market? Definition & Enforcement Guide- Chainalysis

Key takeaways

A darknet market is an e-commerce platform on the dark web — accessible only through Tor — where illegal goods and services are traded using cryptocurrency.
The ecosystem has proven structurally resilient: every major takedown, from Silk Road to AlphaBay to Hydra, has been followed by a new generation of successor markets within months.
Markets active today include Russian Market, Abacus Market, STYX Market, and several others — most specializing in stolen data, cybercrime-as-a-service, or narcotics.
Every transaction on these platforms is recorded on a public blockchain. Chainalysis has supported the majority of major darknet market enforcement actions of the past decade.

What is a darknet market?

A darknet market — also called a dark web market, dark web marketplace, or darknet marketplace — is an e-commerce platform that operates on the dark web, accessible only through anonymizing networks such as Tor (The Onion Router), and that facilitates the buying and selling of illegal goods and services, typically using cryptocurrency as payment. These platforms trade primarily in illegal drugs, stolen data and credentials, cybercrime-as-a-service tools, counterfeit documents, and fraud services — all transacted pseudonymously through bitcoin, Monero, and other cryptocurrencies to obscure the financial trail between buyers, vendors, and market operators.

The first major darknet market, Silk Road, launched in 2011 and processed an estimated $1.2 billion in transactions before the FBI seized it in 2013 and arrested its founder. That takedown did not end the underlying activity; it demonstrated its resilience. AlphaBay, Hansa, Hydra, and dozens of successor platforms followed, each more sophisticated than the last, until Hydra’s 2022 seizure — coordinated by the DOJ, DEA, IRS-CI, and Europol — resulted in the confiscation of approximately $25 million in cryptocurrency and the shutdown of what had become the largest such marketplace in the world.

For compliance teams at crypto exchanges, financial institutions, and VASPs, this activity represents one of the highest-priority illicit exposure categories: a persistent, high-volume source of crypto transactions that require real-time screening, transaction monitoring, and SAR filing capability. For law enforcement, darknet markets are a primary target for blockchain analytics-driven investigations — and one where Chainalysis has been directly involved in major enforcement actions.

Which darknet markets are active right now?

The darknet market ecosystem doesn’t stand still. New platforms emerge within months of every major takedown, and the roster of active markets changes fast enough that compliance and investigations teams need a live view, not a historical one. The following markets have been active in 2026 and are relevant to current screening and monitoring programs:

Russian Market

Russian Market specializes in “logs” — packages of browser-extracted credentials, session cookies, and payment data harvested by infostealer malware from infected machines. It’s one of the largest sources of compromised credentials and stealer logs currently in circulation, feeding downstream identity theft and account takeover fraud.

Abacus Market

Abacus Market has positioned itself as one of the more reliable general marketplaces in the post-Hydra landscape, offering a broad catalog spanning stolen data, counterfeit documents, and other illicit goods. Reliability and uptime — rare in this ecosystem — have been central to its user base, though markets at this scale carry elevated exit-scam risk as they grow.

STYX Market

STYX Market focuses specifically on cybercrime-as-a-service: exploit kits, botnet access, and ransomware tooling, rather than physical goods. It reflects the broader shift of darknet marketplaces from primarily drug-trade venues toward specialized cybercrime infrastructure.

Torzon Market

Torzon Market operates as a general-purpose marketplace in the current Tor-based ecosystem, part of the wave of platforms that expanded to absorb vendor and buyer bases displaced by earlier takedowns.

Brian’s Club

Brian’s Club (BriansClub) is a long-running carding market specializing in stolen credit card data and financial credentials, known within the ecosystem for data-validation mechanisms that let buyers verify card data before purchase — a feature that has made it a persistent source of fraud-service exposure for financial institutions.

WeTheNorth

WeTheNorth is a darknet marketplace that has drawn a regional user base, adding to the fragmented, multi-market landscape that has replaced the single-dominant-market model Hydra represented before its 2022 seizure.

BidenCash

BidenCash is a long-running carding and stolen-data marketplace, associated with large-scale credential and payment-card data dumps circulated across darknet forums.

This list will change — markets exit-scam, get seized, or lose relevance, and new ones launch to absorb displaced vendors. Chainalysis KYT maintains continuously updated attribution data on active market wallet clusters so compliance teams are screening against the current landscape, not last year’s.

Why do darknet markets matter?

Scale and Persistence of the Darknet Economy

This ecosystem represents a multi-billion-dollar segment of the global black market that has persisted and adapted through more than a decade of international law enforcement pressure. Chainalysis data show that darknet market revenue has consistently generated hundreds of millions to billions of dollars in annual crypto flows, making it one of the largest and most measurable categories of crypto-enabled financial crime.

When AlphaBay was seized in 2017, traffic shifted to Hansa. When Hydra was seized in 2022, successor Russian-language markets absorbed its vendor base within months. Understanding this economy requires understanding its systemic resilience, not just its individual participants.

Cryptocurrency as the Engine of Darknet Commerce

Cash is untraceable but impractical for pseudonymous online transactions; cryptocurrency is practical, borderless, and often perceived as anonymous by unsophisticated users. Bitcoin has historically been the dominant payment currency here, but Monero has grown as a privacy-preferred alternative among vendors and buyers seeking stronger transaction obfuscation. The pseudonymous nature of these transactions creates a paradox: users believe they are invisible, but every transaction is permanently recorded on a public blockchain — creating the forensic evidence trail that blockchain analytics platforms use to trace, attribute, and disrupt this activity.

The Compliance and Law Enforcement Imperative

Proceeds from these markets must eventually reach fiat currency to be useful, and that conversion almost always passes through a regulated exchange. The compliance obligation for exchanges, financial institutions, and VASPs is clear: transaction monitoring programs must detect exposure in incoming and outgoing transactions, flag accounts with links to active markets for SAR filing, and cooperate with law enforcement records requests supporting active investigations. Exchanges that fail to screen for this exposure face regulatory enforcement, correspondent banking restrictions, and potential criminal liability for processing illicit proceeds. The quality of the underlying attribution data is the primary determinant of whether screening programs actually work.

### $25M

Cryptocurrency seized during the Hydra Market takedown in April 2022 — coordinated across DOJ, DEA, IRS-CI, and Europol — representing the largest darknet market enforcement action to date.

How do darknet markets work?

These platforms replicate the structure of legitimate e-commerce — product listings, vendor ratings, escrow payment systems, customer reviews, and dispute resolution — but operate on anonymizing infrastructure designed to obscure the identities of operators, vendors, and buyers from law enforcement.

Accessing Darknet Markets: Tor and Onion Routing

Darknet markets operate as hidden services on the Tor network — accessible only through Tor Browser, which routes traffic through a series of encrypted relays (onion routing) to conceal the user’s IP address and location. Each marketplace has a .onion address — a long string of alphanumeric characters — that isn’t indexed by conventional search engines and changes periodically to evade seizure. Users discover current addresses through darknet forums, Telegram channels, and community boards that function as the dark web’s equivalent of search engines.

Tor provides meaningful anonymity against passive traffic monitoring, but it doesn’t eliminate law enforcement visibility. Server IP addresses can be exposed through misconfiguration; timing correlation attacks can link Tor circuits to user locations. These transactions are recorded on public blockchains that blockchain analytics can trace, regardless of how the user accessed the platform.

Market Structure and Features

Functionally, these marketplaces resemble Amazon or eBay: product categories, vendor storefronts, rating systems, search functionality, and messaging infrastructure. Vendors create accounts, list products priced in bitcoin or Monero, and accumulate reputation scores from buyer feedback. Larger platforms employ administrators, moderators, and customer support staff — a full organizational structure operating behind pseudonymous identities, typically with strict prohibited-category rules (no weapons of mass destruction, no content involving minors) alongside otherwise broad product availability.

Escrow and Payment Systems

Escrow systems built on cryptocurrency give buyers and vendors a way to transact between parties who can’t verify each other’s identities. In centralized escrow, the market holds funds from the buyer until delivery is confirmed, then releases it to the vendor. In multi-signature (multisig) escrow, the market, buyer, and vendor each hold a cryptographic key, and any two of three signatures can release funds — reducing the operator’s ability to abscond with escrowed funds. Despite these mechanisms, escrow has been a primary vector for exit scams, in which operators drain escrowed funds and disappear.

Vendor Operations and Operational Security

Experienced vendors employ layered operational security (OPSEC) practices: PGP encryption for communications, separate operational identities per market, Monero for vendor-side transactions, physical drop points rather than personal addresses for shipments, and cryptocurrency tumbling to obscure proceeds. Despite these precautions, OPSEC failures — reused usernames, unencrypted communications, shipping patterns, and traceable on-chain flows — remain the primary vectors through which law enforcement identifies and arrests high-volume vendors.

Exit Scams and Market Disruptions

Exit scams — where operators drain escrow accounts and disappear — are endemic to this ecosystem. The 2019 Wall Street Market exit scam, in which operators took approximately $11 million in escrowed funds before attempting to flee, is among the largest documented. Incognito Market’s 2024 exit scam went further: operators attempted to extort vendors and buyers by threatening to publish their transaction records unless a ransom was paid before disappearing with escrowed funds. This structural vulnerability has pushed some platforms toward multisig escrow models and vendor direct-pay arrangements that reduce operator custody of user funds — but exit scam risk hasn’t disappeared.

What’s the difference between darknet markets, the deep web, and the surface web?

These three terms are frequently conflated, including in regulatory and compliance contexts where precision matters. Understanding the distinction is essential for accurate risk assessment and for communicating with regulators, law enforcement, and executive audiences.

Layer	How It’s Accessed	Examples	What It Contains
Surface Web (Open Web)	Standard browsers; indexed by Google, Bing, and other search engines	News sites, social media, company websites, Wikipedia	Publicly accessible content — approximately 5% of total internet content
Deep Web	Standard browsers with authentication; not indexed by search engines	Email inboxes, bank portals, medical records, subscription databases, corporate intranets	Private but legal content requiring login or direct access — approximately 90%+ of total internet content
Dark Web (Darknet)	Requires Tor Browser or other anonymizing software; not indexed; .onion addresses	Darknet markets, forums, illicit services — but also legitimate privacy tools, journalist communication platforms, political dissident resources	Mix of illicit commerce and legitimate anonymity use cases; a subset of deep web content

This layer of the internet not indexed by search engines is simply the deep web — your email inbox, your bank’s customer portal, and every other private but lawful system requiring authentication. The dark web is a specific, smaller subset that requires specialized software to access and deliberately obscures the location of servers and users. Darknet markets are a category of dark web site, not a synonym for the dark web itself.

This distinction matters for compliance and regulatory communication: characterizing all deep web activity as illicit overstates the risk surface, while conflating the dark web with the deep web understates the specific threat these markets represent.

What is sold on darknet markets?

The product taxonomy has evolved from primarily drug marketplaces into a diversified set of criminal service ecosystems, spanning five major categories.

Illegal Drugs

Illegal drugs — including cocaine, heroin, MDMA, methamphetamine, fentanyl, and pharmaceutical opioids — remain the dominant category by transaction volume. Vendors ship through postal and parcel services, using concealment techniques to evade customs inspection. The scale has grown continuously since Silk Road: Chainalysis data and law enforcement seizures document multi-million-dollar vendor operations shipping to buyers across dozens of countries. The fentanyl crisis added a specific dimension — small-volume, high-potency shipments that are difficult to intercept and have contributed directly to overdose mortality.

Stolen Data and Credentials

Stolen personal data — credit card numbers, bank account credentials, Social Security numbers, passport scans, and corporate login credentials obtained through breaches and phishing — is sold in bulk packages and individual listings. Russian Market and similar platforms specialize in stealer logs: packages of browser-extracted credentials, session cookies, session tokens, and payment data harvested by infostealer malware from infected machines. These products are a direct input to identity theft, account takeover fraud, and business email compromise — linking this activity to downstream financial crime and broader cybersecurity risk across the traditional banking system.

Cybercrime-as-a-Service

Darknet markets and associated forums offer a full suite of cybercrime capabilities: ransomware kits and ransomware-as-a-service (RaaS) subscriptions, DDoS-for-hire services, phishing kits and targeting lists, custom malware development, exploit brokers, and initial access brokers selling pre-compromised corporate network access. This has dramatically lowered the barrier to entry for sophisticated financial crime — enabling actors without technical expertise to purchase and deploy ransomware, conduct data breach attacks, or execute fraud campaigns. It’s a direct cybersecurity threat to financial institutions, critical infrastructure, and government systems, and a core reason threat intelligence and dark web monitoring programs treat these markets as a standing priority rather than a one-time risk assessment.

Counterfeit Documents and Currency

Counterfeit identity documents — passports, driver’s licenses, Social Security cards — are sold for use in identity fraud, account opening fraud, and money mule recruitment. Counterfeit currency is available in multiple denominations. These products directly enable the opening of fraudulent bank accounts and crypto exchange accounts used to launder proceeds, creating a feedback loop between darknet market activity and the regulated financial system.

Fraud Services

Carding services — using stolen credit card data (including CVVs) to make fraudulent purchases — are among the most active categories. Specialized carding markets list card data by issuing bank, card type, and geographic region, with prices reflecting estimated credit limits and verification bypass capability. Money mule services, fraudulent check operations, and account takeover services complete the fraud service taxonomy. For financial institutions, this ecosystem is a direct source of losses that transaction monitoring programs must detect and prevent.

How are darknet markets investigated and disrupted?

Major takedowns are the product of multi-year, multi-agency investigations combining blockchain analytics, undercover operations, technical exploitation, and international law enforcement cooperation. No single technique is sufficient; each successful action has combined methods specific to the target’s vulnerabilities.

Blockchain Analytics and Transaction Tracing

Blockchain analytics is the investigative foundation of modern enforcement. Because every transaction is recorded on a public blockchain, investigators can trace fund flows from buyer wallets to market deposit addresses, map vendor withdrawal patterns, identify exchange cashout points, and attribute wallet clusters to real-world identities — all from publicly available on-chain data. Chainalysis Reactor has been the primary blockchain analytics tool in the majority of significant enforcement actions, enabling investigators to follow proceeds from market wallets through layering transactions to the exchange and bank accounts where operators attempted to cash out.

When AlphaBay operator Alexandre Cazes was arrested in 2017, blockchain analytics had already mapped his Bitcoin withdrawal patterns to exchange accounts linked to his identity. When Hydra Market was seized in 2022, on-chain analysis of its wallet infrastructure gave investigators the full scope of market revenue — approximately $5.2 billion in cryptocurrency over its operational life — and identified the network of exchanges and financial institutions that had processed Hydra proceeds.

Undercover Operations and Market Infiltration

Law enforcement agencies — including the FBI, DEA, and Europol — have conducted undercover operations, establishing vendor accounts, making controlled purchases, and building cases against high-volume vendors. The 2017 Operation Bayonet included a phase in which Dutch National Police secretly operated Hansa Market for 27 days post-takedown, collecting buyer and vendor data before shutting the site down — providing a database of active participants that supported arrests across multiple countries. These infiltration operations depend on blockchain analytics to follow the on-chain flows connecting pseudonymous market accounts to real identities.

Server Seizure and Infrastructure Exploitation

Servers, while typically operated through Tor hidden services, can be identified and seized through misconfiguration, hosting provider cooperation, or active technical exploitation. Seizures provide law enforcement with market databases: account information, transaction histories, communications, and wallet data. The Silk Road server was identified partly through a misconfigured login interface that leaked its real IP address. AlphaBay’s infrastructure was seized across multiple jurisdictions simultaneously to prevent operational migration. Server data, combined with blockchain analytics of market wallet activity, provides the complete picture that supports prosecution.

International Law Enforcement Cooperation

The most significant enforcement actions have been coordinated international operations involving the FBI, DEA, IRS Criminal Investigation, HSI, Europol, Eurojust, and national agencies across dozens of countries. Operation Bayonet (2017) coordinated FBI and Dutch National Police against AlphaBay and Hansa simultaneously. Operation Dark HunTor (2021) resulted in 150 arrests across the US, Europe, and Australia. Operation SpecTor (2023) produced 288 arrests and the seizure of $53.4 million in cash and cryptocurrency. Operation RapTor (2025) resulted in more than 270 arrests across 10 countries and the seizure of over $200 million in drugs and assets. International coordination is essential because operators, vendors, and infrastructure are distributed across jurisdictions specifically to complicate enforcement.

Monitoring Successor Markets and Migration Patterns

When a market is seized, its vendor and buyer base typically migrates to successor platforms — which is exactly why the roster of active markets above changes so often. Blockchain analytics lets investigators follow this migration: tracking vendor wallets from a seized market to their next platform, identifying which successor markets absorb the displaced user base, and maintaining surveillance of the reconstituted ecosystem. Chainalysis research has documented consistent post-seizure migration patterns across multiple market generations, giving law enforcement the predictive intelligence needed to identify the next enforcement target before it reaches Hydra-scale revenue.

Risks and common misconceptions about darknet markets

“Darknet markets are anonymous and untraceable.”

Tor provides meaningful IP address anonymity; it doesn’t anonymize cryptocurrency transactions. Bitcoin, the dominant currency here, records every transaction permanently on a public ledger. Blockchain analytics platforms attribute wallet addresses to real-world entities through clustering heuristics, behavioral analysis, and exchange intelligence — and this attribution capability has been the primary mechanism through which operators, administrators, and high-volume vendors have been identified, arrested, and prosecuted. The persistent belief in cryptocurrency anonymity among participants is, from a law enforcement perspective, an investigative asset.

“Darknet markets are a small, niche problem.”

Chainalysis data document billions of dollars in annual crypto flows through this black market infrastructure. Hydra Market alone processed an estimated $5.2 billion over its operational life. Russian Market and its successors have listed tens of millions of compromised credentials. The downstream effects — drug overdose mortality, identity theft losses, ransomware campaigns funded by darknet-procured tools, and fraud enabled by stolen credentials — represent measurable harm at population scale. For compliance teams, the question isn’t whether this exposure is a real risk; it’s whether their screening programs are sophisticated enough to detect it.

“Taking down one market solves the problem.”

Every major seizure has been followed by market succession and revenue recovery. When Silk Road was seized in 2013, AlphaBay launched the following year and grew to ten times Silk Road’s size. When AlphaBay was seized in 2017, Hydra emerged as the dominant Russian-language market. When Hydra was seized in 2022, multiple successor markets — including several active today — absorbed its infrastructure within months. This ecosystem is structurally resilient: distributed vendor bases, cryptocurrency payment systems that don’t require market-operated banking infrastructure, and persistent buyer demand ensure that enforcement disruption produces displacement rather than permanent elimination. Law enforcement treats successive takedowns as the objective — continuously disrupting operations, degrading trust between participants, and raising the operational cost for operators — rather than expecting any single action to end this activity.

“Monero makes darknet transactions completely untraceable.”

Monero’s privacy features — ring signatures, stealth addresses, and RingCT — make transaction tracing significantly more difficult than Bitcoin analysis. However, “more difficult” isn’t “impossible.” Law enforcement has made Monero-related arrests, and blockchain analytics research continues to advance tracing capability against it. Critically, even markets that accept Monero typically also accept bitcoin for a subset of transactions, and vendor behavior — including converting Monero proceeds to bitcoin for exchange cashout — creates on-chain linkages that analytics can exploit. The fiat off-ramp for these proceeds almost always passes through a regulated exchange with KYC records, regardless of what cryptocurrency was used on-market. The regulated exchange remains the compliance chokepoint even when on-chain history is obscured by privacy features.

Compliance risks for exchanges and financial institutions

Regulated exchanges face direct regulatory and legal exposure from processing proceeds tied to these markets. KYT monitoring programs that fail to detect deposits from known wallets or withdrawals to linked addresses expose exchanges to FinCEN enforcement, potential OFAC designation risk if transactions involve sanctioned entities, and correspondent banking restrictions if institutional partners assess the exchange’s AML program as inadequate. The risk isn’t only direct exposure: indirect exposure through mixer transactions, layering through multiple wallets, and the use of privacy coins to obscure fund origins creates compliance risk that requires multi-hop transaction graph analysis to detect — not just direct address screening.

What are the biggest darknet market enforcement actions?

The following actions represent the most significant takedowns of the past decade. Blockchain analytics played a central investigative role in each.

Market	Year	Enforcement outcome	Blockchain analytics role
Silk Road	2013	FBI seizure; founder Ross Ulbricht convicted and sentenced to life in prison; ~$1B in Bitcoin seized across proceedings	Transaction tracing linked wallet addresses to Ulbricht’s personal accounts; blockchain evidence was central to conviction
AlphaBay	2017	Operation Bayonet: simultaneous FBI/DEA/Dutch Police action; operator Alexandre Cazes arrested in Thailand; server infrastructure seized across multiple jurisdictions	Chainalysis traced fund flows to exchange accounts registered to Cazes; on-chain analysis mapped the full revenue footprint
Hansa Market	2017	Dutch National Police operated Hansa covertly for 27 days post-takedown, collecting buyer/vendor data before shutdown; supported arrests across Europe	Transaction data cross-referenced with blockchain analytics to identify users who had migrated from AlphaBay
Hydra Market	2022	DOJ/DEA/IRS-CI/Europol coordination; ~$25M in cryptocurrency seized; German servers taken down; largest darknet market by revenue at time of seizure	Chainalysis documented $5.2B in total revenue; on-chain analysis identified the exchange network processing proceeds, supporting parallel financial enforcement
Operation Dark HunTor	2021	150 arrests across US, Europe, and Australia; $31.6M in cash and cryptocurrency seized; based on data from multiple seized markets	Blockchain analytics of seized wallet data enabled cross-border identification of vendors and buyers across multiple post-seizure markets
Operation SpecTor	2023	288 arrests across multiple countries; $53.4M in cash and cryptocurrency seized; 850+ kg of drugs; largest coordinated action to date	Transaction tracing identified vendor financial infrastructure across jurisdictions; cross-chain analysis traced proceeds through mixing attempts
Incognito Market	2024	Exit scam and extortion: operators took $4.5M in escrowed funds and threatened to publish transaction records; operator arrested	On-chain records gave investigators a complete market activity history; wallet tracing identified operator cashout attempts through exchange accounts
Operation RapTor	2025	270+ arrests across 10 countries; $200M+ in drugs and assets seized; coordinated Europol/DOJ action targeting mid-level vendors across multiple active markets	Reactor-based analysis of active wallet clusters identified mid-tier vendor infrastructure; cross-chain tracing followed layered proceeds to fiat off-ramps

How Chainalysis helps organizations investigate and monitor darknet markets

Chainalysis is the blockchain data platform trusted by 100+ government agencies, 50+ regulators, and nine of the top ten crypto exchanges — the only solution subjected to Daubert scrutiny in court. Chainalysis has been the blockchain analytics provider in the majority of significant darknet market enforcement actions over the past decade — not as a passive data source, but as the investigative platform used by FBI, DEA, IRS-CI, Europol, and partner agencies to trace funds, identify operators, and build prosecutable cases. The same platform and attribution data supporting law enforcement investigations powers the transaction monitoring programs of regulated exchanges and financial institutions.

Chainalysis Reactor

Reactor is the investigation platform law enforcement uses to trace darknet market funds through the transaction graph. Investigators use Reactor to follow funds from a known deposit address through layering transactions — mixer deposits, exchange transfers, wallet consolidations — to the final cashout point where proceeds reach fiat currency. Reactor’s interactive graph interface visualizes these multi-hop fund flows across 400+ networks and 40M+ assets, producing evidence-quality outputs that have supported prosecutions in every major case of the past decade. The attribution database underlying Reactor is continuously updated with new market wallet clusters as they’re identified through ongoing research and law enforcement intelligence sharing.

Chainalysis KYT (Know Your Transaction)

KYT provides the real-time transaction monitoring layer that enables regulated exchanges and VASPs to detect exposure before processing illicit proceeds. KYT maintains continuously updated attribution data covering known deposit and withdrawal addresses, flags transactions with direct or indirect exposure, and generates risk alerts for compliance team review and SAR filing. KYT provides automated screening at the scale that manual review cannot achieve, built on attribution data validated at a false-positive rate near 0.01%.

Chainalysis Data and Intelligence

The attribution data underlying every Chainalysis product includes continuously updated darknet market intelligence: identified wallet clusters, vendor address databases, and behavioral indicators. This data layer is maintained by Chainalysis research teams in direct coordination with law enforcement partners, ensuring that the attribution data powering KYT monitoring and Reactor investigations reflects the current state of the ecosystem — including the markets active today — not its state as of initial database build.

### $5.2B

Total cryptocurrency revenue processed by Hydra Market over its operational life — documented through Chainalysis blockchain analytics and cited in DOJ enforcement proceedings at the time of the market’s 2022 seizure.

Frequently asked questions about darknet markets

Q: What is a darknet market?

A: A darknet market is an e-commerce platform operating on the dark web — accessible through the Tor anonymizing network — that facilitates the buying and selling of illegal goods and services, primarily using cryptocurrency as payment. These platforms trade in illegal drugs, stolen data, cybercrime tools, counterfeit documents, and fraud services, using Bitcoin and Monero for pseudonymous transactions between buyers, vendors, and market operators.

Q: Which darknet markets are active right now?

A: Markets active in 2026 include Russian Market (stolen credentials and stealer logs), Abacus Market (general goods), STYX Market (cybercrime-as-a-service), Torzon Market (general goods), Brian’s Club (carding), WeTheNorth (general goods), and BidenCash (carding). The roster changes frequently — markets exit-scam, get seized, or launch to absorb displaced vendors, so this list should be treated as a snapshot, not a fixed reference.

Q: What is the largest darknet market today?

A: No single market currently dominates the way Hydra did before its 2022 seizure. Since then, the ecosystem has fragmented across several mid-sized platforms — including Russian Market, Abacus Market, and others — each absorbing a portion of the displaced user base rather than one market consolidating the majority of activity.

Q: Are darknet markets still active?

A: Yes. Despite sustained international law enforcement action — including the seizures of Silk Road (2013), AlphaBay (2017), and Hydra (2022), and hundreds of arrests through Operations Dark HunTor, SpecTor, and RapTor — this ecosystem has proven structurally resilient. When major markets are seized, vendor bases and user traffic migrate to successor platforms. Active markets continue to generate hundreds of millions to billions of dollars in annual crypto flows, as documented in the Chainalysis Crypto Crime Report.

Q: Can law enforcement track darknet market activity in real time?

A: Yes, within limits. Blockchain analytics platforms like Chainalysis continuously update attribution data on active market wallet clusters as new markets emerge and transaction patterns shift, giving investigators and compliance teams a near-real-time view of on-chain activity. What analytics can’t do is monitor the marketplaces’ own internal systems (listings, messaging, vendor accounts) in real time — that requires the undercover and infiltration techniques described above, used alongside blockchain analytics rather than in place of it.

Q: How do law enforcement agencies track activity on darknet markets?

A: Law enforcement uses a combination of blockchain analytics, undercover operations, server seizure, and international coordination. Blockchain analytics — using platforms like Chainalysis Reactor — traces funds from deposit addresses through layering transactions to the fiat cashout points where proceeds reach regulated exchanges, identifying operators and vendors through their financial activity. Undercover operations establish vendor identities through controlled purchases. Server seizures provide market databases with account and transaction records. These methods are most effective in combination, across coordinated international operations.

Q: What is the difference between the dark web and the deep web?

A: The deep web refers to all internet content not indexed by standard search engines — including email inboxes, bank portals, medical databases, and subscription services. It’s large (representing the majority of internet content) and mostly lawful. The dark web is a specific, much smaller subset that requires specialized software — typically Tor Browser — to access, and that uses anonymizing infrastructure to conceal the location of servers and users. Darknet markets are a category of dark web site — not synonymous with either the dark web or the deep web.

Q: What cryptocurrency do darknet markets use?

A: Bitcoin has historically been the dominant payment currency due to its liquidity and broad acceptance. Monero has grown as a privacy-preferred alternative, valued for ring signature and stealth address features that make tracing more difficult than Bitcoin analysis. Some markets accept both; others have shifted toward Monero-only policies in response to blockchain analytics advances. Despite these privacy features, the fiat off-ramp almost always passes through a regulated exchange — making KYC records at the exchange the persistent compliance chokepoint regardless of on-chain privacy.

Darknet markets remain one of the most persistent threats in the crypto crime landscape.

Chainalysis gives law enforcement, compliance teams, and financial institutions the tools to trace, monitor, and investigate this activity across every major blockchain.

Request a Demo See how Chainalysis can help your organization combat darknet-enabled financial crime.

Read the 2026 Crypto Crime Report’s darknet market analysis

Explore Chainalysis Reactor for darknet investigations

Learn how Chainalysis KYT detects darknet market exposure