Darknet market
A darknet market is a commercial website on the dark web that operates via darknets such as Tor and I2P. They function primarily as black markets, selling or brokering transactions involving drugs, cyber-arms, weapons, counterfeit currency, stolen credit card details, forged documents, unlicensed pharmaceuticals, steroids, and other illicit goods as well as the sale of legal products. In December 2014, a study by Gareth Owen from the University of Portsmouth suggested the second most popular sites on Tor were darknet markets.
Following on from the model developed by Silk Road, contemporary markets are characterized by their use of darknet anonymized access, Bitcoin or Monero payment with escrow services, and eBay-like vendor feedback systems.
History
1970s to 2011
Though e-commerce on the dark web started around 2006, illicit goods were among the first items to be transacted using the internet, when in the early 1970s students at Stanford University and Massachusetts Institute of Technology used the ARPANET to coordinate the purchase of cannabis. By the end of the 1980s, newsgroups like alt.drugs would become online centres of drug discussion and information; however, any related deals were arranged entirely off-site directly between individuals. With the development and popularization of the World Wide Web and e-commerce in the 1990s, the tools to discuss or conduct illicit transactions became more widely available. One of the better-known web-based drug forums, The Hive, launched in 1997, serving as an information sharing forum for practical drug synthesis and legal discussion. The Hive was featured in a Dateline NBC special called The "X" Files in 2001, bringing the subject into public discourse. From 2003, the "Research Chemical Mailing List" would discuss sourcing "Research Chemicals" from legal and grey sources as an alternative to forums such as alt.drugs.psychedelics. However Operation Web Tryp led to a series of website shut downs and arrests in this area.Since the year 2000, some of the emerging cyber-arms industry operates online, including the Eastern European "Cyber-arms Bazaar", trafficking in the most powerful crimeware and hacking tools. In the 2000s, early cybercrime and carding forums such as ShadowCrew experimented with drug wholesaling on a limited scale.
The Farmer's Market was launched in 2006 and moved onto Tor in 2010. In 2012, it was closed and several operators and users were arrested as a result of Operation Adam Bomb, a two-year investigation led by the U.S. Drug Enforcement Administration. It has been considered a "proto-Silk Road" but the use of payment services such as PayPal and Western Union allowed law enforcement to trace payments and it was subsequently shut down by the FBI in 2012.
Silk Road and early markets
The first marketplace to use both Tor and Bitcoin escrow was Silk Road, founded by Ross Ulbricht under pseudonym "Dread Pirate Roberts" in February 2011. In June 2011, Gawker published an article about the site, which led to "Internet buzz" and an increase in website traffic. This in turn led to political pressure from Senator Chuck Schumer on the US DEA and Department of Justice to shut it down, which they finally did in October 2013 after a lengthy investigation. Silk Road's use of all of Tor, Bitcoin escrow and feedback systems would set the standard for new darknet markets for the coming years. The shutdown was described by news site DeepDotWeb as "the best advertising the dark net markets could have hoped for" following the proliferation of competing sites this caused, and The Guardian predicted others would take over the market that Silk Road previously dominated.The months and years after Silk Road's closure were marked by a greatly increased number of shorter-lived markets as well as semi-regular law enforcement takedowns, hacks, scams and voluntary closures.
Atlantis, the first site to accept Litecoin as well as Bitcoin, closed in September 2013, just prior to the Silk Road raid, leaving users just one week to withdraw any coins. In October 2013, Project Black Flag closed and stole their users' bitcoins in the panic shortly after Silk Road's shut down. Black Market Reloaded's popularity increased dramatically after the closure of Silk Road and Sheep Marketplace; however, in late November 2013, the owner of Black Market Reloaded announced that the website would be taken offline due to the unmanageable influx of new customers this caused. Sheep Marketplace, which launched in March 2013, was one of the lesser known sites to gain popularity with Silk Road's closure. Not long after those events, in December 2013, it ceased operation after two Florida men stole $6 million worth of users' Bitcoins.
Since Silk Road
From late 2013 through to 2014, new markets started launching with regularity, such as the Silk Road 2.0, run by the former Silk Road site administrators, as well as the Agora marketplace. Such launches were not always a success; in February 2014 Utopia, the highly anticipated market based on Black Market Reloaded, opened only to shut down eight days later following rapid actions by Dutch law enforcement. February 2014 also marked the short lifespans of Black Goblin Market and CannabisRoad, two sites which closed after being deanonymized without much effort.November 2014 briefly shook the darknet market ecosystem, when Operation Onymous, executed by the United States' FBI and UK's National Crime Agency, led to the seizure of 27 hidden sites, including Silk Road 2.0, one of the largest markets at the time, as well 12 smaller markets and individual vendor sites. By September 2014, Agora was reported to be the largest market, avoiding Operation Onymous; as of 2015, Agora has gone on to be the largest overall marketplace, with more listings than the Silk Road at its height.
Further market diversification occurred in 2015, as did further developments around escrow and decentralization.
In March 2015, the Evolution marketplace performed an "exit scam", stealing escrowed bitcoins worth $12 million, half of the ecosystem's listing market share at that time. The closure of Evolution led to users redistributing to Black Bank and Agora. However Black Bank, which as of 2015 captured 5% of the darknet market's listings, announced on May 18, 2015, its closure for "maintenance" before disappearing in a similar scam. Following these events commentators suggested that further market decentralization could be required, such as the service OpenBazaar, in order to protect buyers and vendors from this risk in the future as well as more widespread support from "multi-sig" cryptocurrency payments.
In April, TheRealDeal, the first open cyber-arms market for software exploits as well as drugs, launched to the interest of computer security experts. In May, varied DDOS attacks were performed against different markets including TheRealDeal. The market owners set up a phishing website to get the attacker's password, and subsequently revealed collaboration between the attacker and the administrator of Mr Nice Guy's market who was also planning to scam his users. This information was revealed to news site DeepDotWeb.
On July 31, the Italian police in conjunction with Europol shut down the Italian language Babylon darknet market seizing 11,254 Bitcoin wallet addresses and 1 million euros.
At the end of August, the leading marketplace Agora announced its imminent temporary closure after reporting suspicious activity on their server, suspecting some kind of deanonymization bug in Tor.
By October 2015, AlphaBay was recognized as the largest market. From then on, through to 2016 there was a period of extended stability for the markets, until in April when the large Nucleus marketplace collapsed for unknown reasons, taking escrowed coins with it.
On April 28, investigations into the Italian Darknet Community forum-based marketplace led to a number of key arrests.
In May 2017, the Bloomsfield Market closed after investigations in Slovakia inadvertently led to the arrests of its operators. Later that month, the long-lived Outlaw market closed down citing a major bitcoin cryptocurrency wallet theft; however, speculation remained that it was an exit scam.
In July 2017, the markets experienced their largest disruptions since Operation Onymous, when Operation Bayonet culminated in coordinated multinational seizures of both the Hansa and leading AlphaBay markets, sparking worldwide law enforcement investigations. The seizures brought in lots of traffic to other markets making TradeRoute and Dream Market the most popular markets at the time.
In October 2017, TradeRoute exit-scammed shortly after being hacked and extorted.
In June 2018, the digital security organization Digital Shadows reported that, due to the climate of fear and mistrust after the closure of AlphaBay and Hansa, darknet market activity was switching away from centralized marketplace websites and towards alternatives such as direct chat on Telegram, or decentralized marketplaces like OpenBazaar.
In 2019, Dream Market was the most popular market by far, with over 120,000 current trade listings, followed at one time by Wall Street Market with under 10,000 listings. Dream Market was shut down in 2019, and Wall Street Market was seized by law enforcement in May 2019 as part of an Internal Law Enforcement Operation Dark Huntor. That same operation also shut down the dark markets DeepSea, Berlusconi, White House, and Dark Market.
The May 2019 seizure of news and links site DeepDotWeb for conspiring with the markets created a temporary disruption around market navigation.
In 2021, authorities took down the dark web marketplace DarkMarket, along with arresting the Australian man who was believed to be the operator of the website. The 20 servers that hosted the website were seized.
In August 2021, AlphaBay was relaunched after the return of one of the original security administrators DeSnake.
In June 2025 Europol took down the Archetyp Market with an estimated 3200 registered vendors and 600,000 customers worldwide.