Key insights
- The darknet marketplaces have gained attention during the COVID-19 pandemic.
- Darknet marketplaces are a decentralized, unindexed, and unregulated part of the World Wide Web, accessible using specific browsers like “Onion Router” or “Tor.”
- Silk Road was the first darknet marketplace to use cryptocurrencies for payment, which paved the way for today’s underground world of dark web marketplaces to follow suit.
- After the closure of a darknet marketplace, it takes around 5 days for trading volumes to recover, and users may move to other dark marketplaces, which is called migration.
- Blacksprut, Mega, Solaris, OMG! OMG!, and CTS Market are identified as the most active darknet marketplaces in 2022 after the unexpected closure of Hydra Marketplace.
- The sanctions against Hydra may have a lower effect than intended, as the migration process and redistribution of the Russian market by other darknet marketplaces are observed.
The world of the darknet has always attracted the attention of the masses. But darknet marketplaces entered the spotlight at the start of the COVID-19 pandemic, when the combination of a public health emergency, an economic crisis, and disinformation panic pushed some merchants and customers into the shadow economy.
In addition, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) recently sanctioned the world’s largest — and one of the most infamous — darknet markets, Hydra Market (Hydra), which only increased ordinary citizens’ interest in this phenomenon.
So what is the darknet, exactly?
The “darknet” (or dark web) is a decentralized, unindexed, unregulated part of the World Wide Web that is only accessible using certain browsers, such as the so-called “Onion Router,” or “Tor” for short. The dark web has become an immense center of criminal activity, a fully working marketplace where buyers and sellers may buy banned goods and services without any fear of detection.
But in addition to the marketplace, darknet participants also need an untraceable payment method in order to maintain maximum confidentiality inf their activities. Silk Road was the first darknet marketplace to use the anonymity of cryptocurrencies for payment, thus paving the way for today’s underground world of dark web marketplaces to follow suit. The GL research team notes that the main currency for conducting transactions on the dark web is Bitcoin (BTC); almost 100% of the transactions of the studied marketplaces used this currency. Therefore, our analysis focuses on transactions in BTC. This is what allowed the GL team to conduct an investigation to identify the most active darknet marketplaces since the beginning of 2022, especially after the unexpected closure of Hydra Marketplace, which dominated over 70% of the Russian darknet marketplaces.
Research on the collective dynamics of dark web marketplaces shows that after the unexpected closure of a darknet marketplace, it takes on average about 5 days for trading volumes to recover, which suggests that users may move to other dark marketplaces. This process is called migration. Moreover, 66% of migrating users choose to move their activity to the same coexisting marketplace.
Migration was observed repeatedly during our investigation. For example, after the closure of the AlphaBay marketplace, other marketplaces, namely Hansa and Dream Market, experienced an abnormal spike in activity.
Based on these facts, the GL team was able to identify the following activity in the volume of transactions across darknet marketplaces:
Blacksprut
Blacksprut breaks the rating in terms of transaction volume, despite the fact that it operates exclusively in Russia. Since it began operating over a year ago, Blacksprut has had thousands of users, with over 1,100 active vendors at the moment. Instead of traditional home deliveries, the market specializes in drop-offs. Customers essentially get instant access to local products. This works by per-distributing the products around cities and providing customers with coordinates to them. The market only supports BTC and has conducted 1041.55 BTC transactions since the beginning of 2022.
Mega
Mega darknet market is also a Russian market, but with a longer history; it has existed since 2016. Mega’s popularity started to skyrocket after Hydra was buried, and it is currently on track to become one of the largest darknet marketplaces in Russia. It has over 2,600 merchants and had generated 1006.02 BTC in transaction volume at the beginning of 2022. Mega also features an exchange that allows users to exchange BTC for Monero, as well as a mixer designed to help launder the funds used.
Solaris
Solaris has long held its place in the darknet market, operating since 2015. After the closure of Hydra, it actively attempted to advance in the market by hacking RuTor, the largest Russian darknet forum, and trying to lure stores away with additional discounts and bonuses. All transactions on Solaris are in BTC, and it also has a built-in exchange, which meant it ranked third in our rating system with a transaction volume of 720.14 BTC.
OMG! OMG!
OMG!OMG! is the youngest of the marketplaces on our list, having launched in 2021. OMG!OMG! is also based in Russia, but unlike the previously mentioned markets, it is international. Currently, it has over 1,000 listings. Payment on the platform is made in BTC to the built-in wallet, and since the beginning of this year, OMG!OMG! generated a payment volume of 689.79 BTC. One atypical security feature unique to this market is called the kamikaze password, which fraud actors are trying to protect themselves with. It can be used in emergency situations to destroy their accounts.
CTS Market
CTS Market is also a representative of Russian marketplaces and acts as a store that presents its products in the other large marketplaces on our list. It has been on the market since the RAMP forum. Payment for prohibited goods is made in BTC, and despite the absence of an independent market, the transaction activity of the CTS Market store generated a volume of 118.75 BTC in 2022.
To sum up
The closure of and sanctions against Hydra were a standout event this year, significantly reducing its stand-alone trading volumes. But as we can see, due to the migration process and the redistribution of the Russian market by other darknet marketplaces, the sanctions may have a much lower effect than what was originally intended.