Dark web websites: 10 Onion sites to explore

When looking at darknet drug markets serving Russia-based customers, Kraken Market captured 30.9% of market share, with Blacksprut and Mega Darknet markets closely following. As for drug markets serving Western customers, ASAP Market held a 25.0% share, followed by Mega and Incognito. darknet markets active Western drug flows in particular come from US-domiciled exchanges and trace flows from those to darknet markets. The entity “DNM Aggregator” that appears within each category refers to a service we’ve identified as being in control of multiple, disparate darknet markets.

• Founded in early 2023, shortly after major law enforcement operations shut down several competing platforms, Abacus quickly filled the void by prioritizing reliability, advanced security, and user anonymity.
• One of the most notable developments is the integration of cryptocurrencies as the primary medium of exchange.
• Cryptocurrency accounts were the only category that we saw to have experienced an increase.
• Chainalysis data shows darknet marketplace revenue dropped post-Hydra seizure in 2022 but recovered to $2 billion in Bitcoin inflows during 2024 Darknet market BTC inflow drop and shift to Monero.
• Funds can be lost instantly through exit scams, frozen escrow wallets, or sudden marketplace shutdowns.
• Cybercrime enablement represents flows from ransomware, stolen funds, malware, or fraud shops to darknet markets.
• I’ve been poking around these places for a while now, from the giants like Abacus to the old-timers like Vice City.
• Our findings suggest that understanding the behavior of key players in dark web marketplaces is critical to effectively disrupting illegal activities.

How Law Enforcement Impacts Marketplace Stability

Until 2012, there is only one active market, namely Silk Road market, and hence no multihomer activity. From 2013 until 2015, the multiseller network grows in terms of connectivity, showing an increasing number of edges spread across different markets. During 2016 and 2017, the edges are polarized by AlphaBay, the dominant market (see Fig. 3). Then, between 2017 and 2018, there is a drastic structural change in the multiseller network structure due to operation Bayonet, after which the connections almost vanished. This change persists until the end of the observed period of the data set (also see Supplementary Information S4).

Monero (XMR)

In many cases, fear of arrest prompts administrators to run exit scams before enforcement action becomes public. Constant uncertainty, fear of scams, and enforcement pressure create sustained stress. Reputation scores and user feedback guide buyer decisions in the absence of real-world verification.

Crypto Investigations

By definition, users that interact among themselves form U2U transactions. If the pair of users interact with multiple DWMs these U2U transactions are included in all related DWMs and counted multiple times. Therefore, the simple sum of all U2U transactions of each DWM is more than the sum of all unique U2U transactions.

Darknet markets generate millions in revenue selling stolen personal data

Interestingly, the S2S network shows an intermediate level of resilience, which suggests that the S2S network might play the role of a supply chain network on the dark web. Furthermore, after a shock, the activity of buyers is resumed almost immediately, while the activity of sellers recovers more slowly. These different regimes suggest that the ecosystem’s resilience is mainly supported by the high demand of buyers rather than the response of the sellers.

Data and methods

Any unauthorized use of this information for illegal activities is strictly discouraged. This repository and its contributors are not liable for any misuse of the provided information. The cybersecurity challenges seen in 2024 highlight the dynamic and ever-evolving nature of cyber threats. As cryptors, loaders, and stealers become more sophisticated, and underground markets remain resilient, organizations must prioritize robust cybersecurity measures in 2025.

Top Darknet Markets 2025

Use Norton VPN to encrypt the data you send and receive and surf more anonymously. Administrator and prolific vendor Gal Vallerius was arrested in August 2017. These aren’t distant problems—they are immediate, and they affect public safety, financial systems, and global cooperation. According to a 2024 report citing unsealed court documents, USDT was widely available in Mexico at a discount, allowing resellers to profit in countries like Colombia. The arrest of Durov heightened fears that Telegram would start cooperating with authorities, forcing vendors to find new places to operate. Nexus opened in late-2023 after the Fall of Bohemia and quickly absorbed many of that community’s well-rated vendors.

Darknet Market Vendors Turn to DeFi

Businesses should be aware of the potential for data leaks and invest in data loss prevention measures. As of September 2025, public trackers mark it closed, underscoring the sector’s churn amid phishing/DDoS and sustained law‑enforcement pressure. And beware—while many explore out of curiosity or for research purposes, it’s important to remember that engaging with these platforms, even as an observer, can lead to serious legal and ethical consequences. Having JavaScript enabled on the dark web can cause havoc because it can reveal your IP address to your website.

The dangers of darknet marketplaces

Moreover, we find a change of trend between the seller and the buyer median net income time series which reflects the dominance of markets, as detailed in the next section. Conversely, transaction networks obtained from the blockchain contain the entire transaction data of the DWMs and U2U transactions, allowing a thorough investigation of the ecosystem as a whole. In fact, previous studies on DWM transaction networks have revealed crucial aspects of the ecosystem13,14,15. However, they have so far mainly focused on DWM users, without distinguishing between buyers and sellers, and neglecting the different weight that more active users may have in the system. The reason is that the operational structure of DWMs inherently hides the seller–buyer link, as all transactions are made through the marketplace. Buyers send money to the marketplace, which in turn sends the money to the seller.

Multiseller network

Moreover, this darknet shop provides detailed statistics about each user profile on the platform, giving users a better idea of the vendors for the buyers and vice versa. This marketplace accepts payments via Monero but also supports the Escrow system. Dark web marketplaces are mostly hubs for illicit goods and activities, posing serious risks to users and the wider community.

What is the cost of stolen data on the darknet market?

• One of the key factors contributing to the growth of darknet markets is their ability to adapt to changing technological landscapes.
• Dark markets, as well as various other services within darknets, are hosted as ‘hidden services’.
• But in fact it was a guerrilla marketing stunt promoting OMG, a darknet marketplace selling heroin, mephedrone, marijuana, and everything else in between.
• Previous studies reported that COVID-19 had a strong impact on DWMs due to delays and damage to the shipping infrastructure caused by border closures37,38.
• Overall, dark-web marketplaces inherently involve substantial risk, and users must thoroughly understand these threats.
• Law enforcement investigations often span years and rely on digital traces collected over time.
• The large number of U2U-only sellers is in accordance with previous results that showed that the trading volume in the U2U network is significantly larger than that of DWMs13 (also see Supplementary Information Figure S8).
• We then show that hundreds of thousands of DWM users form stable trading pairs that are persistent over time.

Contrary to predictions, the market for cryptocurrency “cleaning” services, or Bitcoin mixers, stagnated. The competitive landscape remained unchanged, with no significant innovations reported. Black traffic schemes—malicious landing pages promoted via deceptive ads—remained a constant threat. These schemes leveraged mainstream ad platforms to distribute malware to unsuspecting users. After shut down, the site displayed a seizure notice and directed users to their hidden service[9] to find more information about the operation. Law enforcement seized substantial evidence, including 47 smartphones, 45 computers and notebooks, eight mobile phones, four computers, and 34 data storage devices from the primary suspect’s locations.

To reduce the presence of noise in the S2S network, we consider only stable U2U pairs, i.e., pairs that have at least three transactions throughout the whole period of observation13. The trading volume generated by stable pairs is more than five times larger than that of non-stable pairs13. The S2S network is mostly populated by U2U-only sellers, followed by market-only, and market-U2U (see Supplementary Information Section S5). In panels (b, c), we show the number of all sellers and buyers per quarter, respectively. In panels (d, e), we show the median net income in USD of all sellers and buyers per quarter, respectively. In panels (f, g), we show the PDF of the total money received by each seller and the total money sent by each buyer, respectively.

Transactions rely on cryptocurrencies to avoid traditional financial systems. Let’s get this straight — not everything on the dark web is illegal or harmful. In fact, some parts of it actually provide a safe space for privacy and freedom, especially where traditional internet access is limited or censored. While these guidelines may appear complex and bothersome initially, they will become second nature once you become accustomed to them. This is when you will develop a crucial sense of cybersecurity both online and in everyday life.

• Alphabay Market leads with 60,000+ listings and $20 million in monthly trades via BTC and XMR, dominating 20% of darknet marketplaces.
• These platforms have created a thriving digital economy, with vendors and buyers engaging in transactions that are both efficient and secure.
• Conversely, transaction networks obtained from the blockchain contain the entire transaction data of the DWMs and U2U transactions, allowing a thorough investigation of the ecosystem as a whole.
• According to the report, in 2023, crypto-linked OFAC sanctions shifted toward groups and individual actors and away from major darknet markets like Garantex and Hydra, as well as mixers like Tornado Cash.
• As with any hidden service, availability, policies, and coin options can change without notice; much of what’s known is either a point‑in‑time analyst snapshot or self‑reported market copy.
• In fact, when we compute the total net income for each seller, a considerable fraction (16%) has a negative net income because they spend in markets where they are not classified as sellers, or in the U2U network.
• Despite minor accessibility inconveniences, these strengths have solidified its position among the top dark-web marketplaces in 2025.
• By adopting a few straightforward rules and habits, you can make it more difficult for hackers to access your data and remove yourself from their line of sight.

You’ll get stolen credit cards, remote desktop account info, personal details, and various logs. What makes this market popular is the fact that it’s less expensive compared to the rest. The market started in 2021 in Canada and features both international and Canadian users.

In 2023, Chainalysis discovered that some popular fraud shops rely on payment processors as a way to reduce their own costs, add efficiency to their operations, and perhaps add a layer of security to transactions. Genesis Market extensively used a payment processor called UAPS, so much that the processor’s average inflows fell by 25.7% after Genesis closed last April. Regardless, UAPS remains a key provider of payment infrastructure to top fraud shops. Customer reviews found on the Abacus site indicate that some of its American vendors sell drug products laced with fentanyl. The most recent example is the shutdown of the oldest marketplace Hydra Market in 2022 which took a combined effort of the FBI and the German authorities. Unfortunately, that as well didn’t stop other darknet markets from rising.

Nevertheless, as for Empire Market itself; Hackread.com will keep an eye on the situation and update the article accordingly even if it is an exit scam. It offers numerous categories of products, most of which feature illegal products. Just like Alpha Bay, Drugs and Chemicals is one of the most popular product categories in the Empire Market. Dark.fail tweeted on Friday that Empire was targeted with a DDoS (distributed denial of service) attack. In a DDoS attack, the server is bombarded with artificial traffic, which makes it difficult for the server to process web requests, and it ultimately goes down. Despite these explanations, the darknet community remained skeptical, leading to a dramatic 94% decline in deposit volumes.

• Please note that all material provided here is aimed at promoting awareness, responsible research, and ethical use of information.
• Valued at approximately $15 million, Abacus Market is one of the most lucrative platforms in the dark web ecosystem.
• Malware can compromise systems running on various operating systems, including Microsoft Windows and Android.
• Beginning in September 2021, Abacus Market has established itself as one of the leading dark web marketplaces.
• In 2020, a total of 6778 pairs of users in stable pairs met inside a DWM, corresponding to 192% of the 2019 level and to 255% of the 2018 level, see Fig.
• The evolution of darknet markets has been a remarkable journey, driven by advancements in technology and the increasing demand for secure, decentralized platforms for trade.
• However, DuckDuckGo doesn’t index dark web content — it only accesses surface and deep web sites through Tor.

That prevents small dealers from participating in the market and a natural tendency towards fewer but larger dealers on those markets,” Fiedler told Decrypt. These numbers show that darknet customers are making fewer purchases in total, but these purchases are, on average, for larger amounts. All sponsored and commercial content, including press releases, is clearly labeled and reviewed for accuracy, disclosure and compliance. All news, reviews, and analysis are produced with full journalistic independence and integrity.

Dutch police discovered the true location in 2016.[4] Law enforcement quickly began monitoring all actions on the site. Administrators soon moved the site to another unknown host, but law enforcement got another break in April 2017, which allowed them to identify the new hosting company, in Lithuania. The Dutch National Police successfully located and seized the server infrastructure hosting Archetyp Market at a data center in the Netherlands, effectively terminating the platform’s operations. Norton VPN fortifies your internet connection with ultra-secure AES-256 encryption, masks your IP, and never logs your activity. And, with an automatic kill switch that guards against unexpected exposure if the connection drops, you can enjoy powerful privacy protection as you navigate even the darker corners of the web.

The dark net’s layered encryption and routing protocols offer stronger anonymity, making onion sites appealing to whistleblowers, political dissidents, privacy advocates — and, inevitably, cybercriminals. Freshtools was established in 2019 and offers various stolen credentials, accounts, and host protocols like RDP. It is considered a go-to site for malware purchasing, providing keyloggers, trojans, and other Malware as a Service products.

It sells stolen card data — dumps, CVVs, even wholesale batches — and lets users bid on fresh leaks. Despite multiple takedown efforts by law enforcement and security researchers, Brian’s Club has resurfaced repeatedly and continues to add new stolen credit card data. Another key aspect of this evolution is the rise of darknet market lists, which serve as directories for users to identify reliable platforms. These lists are regularly updated to reflect the latest trends, ensuring that traders can access the most secure and innovative markets.

In the chart below, we see that the DNM Aggregator emerged as the clear leader among fraud shops enabling cybercrime, and Exploit.in and Kraken Market almost equally sold tools used to facilitate ransomware attacks. As for cybercriminal administration, the category includes inflows from ransomware affiliate wallets. This includes purchases such as malicious software and supporting services which cybercriminals sometimes make using escrow services on crime forums.