< Back to Searchlight Blog

Darknet market landscape more volatile - and lucrative - than ever

Published on 11 Nov 2020 by Louise

Recent trends of law enforcement shutdowns and exit scams by popular marketplaces have made the Western darknet market landscape increasingly volatile, with no single platform dominating in terms of volume. This multipolarity, combined with the rise of cryptocurrencies such as Bitcoin, has contributed to the number of active markets on the darknet reaching record levels.

A recent report by Blockchain forensics firm Ciphertrace claims there are more darknet markets online concurrently than ever before. This increase has occurred in tandem with rising turbulence on the darknet as a result of numerous factors, including the increasingly tenacious efforts by authorities to shut sites down. Compared to the early days of the darknet and Tor usage, when sites such as Silk Road dominated the illicit e-commerce scene, or even the success experienced by Alphabay and Hansa prior to 2017's Operation Bayonet, no one site truly dominates the Western market.

Searchlight's darknet intelligence tool Cerberus closely monitors the rise and fall of darknet markets and concurs that there is currently no single site dwarfing its peers in terms of listings or business volume. Rather, there are several popular markets offering a variety of products and services and jostling for supremacy, alongside smaller shops catering to more niche demands. It is worth noting this multipolarity only rings true for the Western darknet scene; Russophone darknet market Hydra, established in 2015, has long occupied the role of darknet superpower in Russia and the surrounding Commonwealth of Independent States (including Ukraine, Belarus and Kazakhstan).

Confidence in Western darknet markets has been severely undermined in recent years for two key reasons. The first is the growing effectiveness with which global law enforcement monitor, infiltrate and eventually bust darknet markets. A recent example of the evolving tactics used by law enforcement is Operation Bayonet in 2017, which culminated in the arrest and subsequent death of the founder of AlphaBay, at the time the biggest name in Western darknet market circles, and the daring mission by Dutch authorities to infiltrate and assume control of European market Hansa for purposes of evidence-gathering. Another instance is Operation DisrupTor, an FBI-led investigation announced in September this year which resulted in over 150 arrests in multiple countries, the seizure of 500 kilograms of drugs and 64 guns.

The threat posed by law enforcement is just one piece of the puzzle. Another factor depleting the desire of vendors and buyers alike to invest in a single darknet market platform is the rising frequency of exit scams, whereby market administrators deliberately reduce the useability of their site while quietly absconding with user funds held on the service in escrow and cryptocurrency wallets. In most instances, the market still functions in some manner for a short period; typically purchases and deposits are still functional, while the option to withdraw funds from the site is disabled. This was the case with Empire, perhaps the last market to come close to exerting dominance over the Western darknet scene, whose administrators profited up to $30 million in cryptocurrency after shutting down over several days in August 2020. The volume of markets that have exit scammed since the Empire scandal - the most recent being DeepSea - has bred an environment of extreme suspicion among darknet users, with currently operational markets being accused of scamming on a near-daily basis (see Cerberus records below).

Example of forum chatter regarding exit scam suspicions

Example of forum chatter regarding exit scam suspicions

Example of forum chatter regarding exit scam suspicions

Despite the steady erosion of user trust in darknet markets, the rising popularity of Bitcoin and other cryptocurrencies has allowed them to continue operating and grow in multiplicity. As well as an increasing demand for the goods and services available on darknet markets, including drugs, stolen credit card details, and malicious software, the recent Bitcoin surge has rendered the darknet market business potentially more profitable than ever before, with one Bitcoin being worth over $15,000 at time of writing. Needless to say, darknet markets as a whole are unlikely to disappear anytime soon - though the same clearly cannot be said for individual sites.

Try our Darknet Intelligence/Forensics tool for free, contact enquiries@slcyber.io

Latest News from Searchlight

20 May 2021

Is all press good press? DarkSide, Colonial Pipeline and Ransomware-as-a-Service

This article explores the darknet structures and relationships sustaining the ransomware ecosystem, and enquires whether the consequences of DarkSide's attack against Colonial Pipeline will affect the continued growth of this lucrative cybercriminal enterprise.


03 Mar 2021

Zero-day exploit in Accellion FTA leads to data compromise of multiple companies

This article evaluates the recent slew of data breaches suffered by a range of major organisations as a result of vulnerabilities in the soon-to-be-retired Accellion File Transfer Appliance, as well as the implications of suspected involvement by notorious ransomware gang Cl0p.


06 Jan 2021

Covid-19 and the darknet: deceit, disinformation and disruption

Since the beginning of the coronavirus pandemic, darknet actors have exploited the heightened sense of fear and uncertainty for financial and even political gain. In tandem with the much-anticipated rollout of vaccines for the disease in multiple countries worldwide, actors have renewed efforts at Covid-related fraud, disinformation, and cyber-espionage.


02 Dec 2020

The quest for Monero deanonymisation and potential impacts on darknet markets

Monero, often hailed by darknet users as the most private cryptocurrency available, has recently been the subject of efforts by security researchers to deanonymise and trace its transactions. How will Monero's potential traceability affect the illicit trade that occurs on darknet markets?