Euro Security Watch with Mathew J. Schwartz

Cybercrime , Fraud Management & Cybercrime , Fraud Risk Management

Led by Hydra, Darknet Markets Logged Record Revenue

Global Cybercrime Market Revenue Surged to $1.7 Billion in 2020, Chainalysis Reports
Led by Hydra, Darknet Markets Logged Record Revenue
Source: Chainalysis

Darknet markets continue to thrive - despite being regularly targeted by law enforcement agencies and site administrators often stealing buyers' and sellers' cryptocurrency via "exit scams."

See Also: Realities of Choosing a Response Provider

Why darknet markets persist might be best summarized as: While they aren't perfect, and users may sometimes lose funds or risk arrest, for anyone who wants to buy or sell illegal goods or services online, what other options do they have?

Alternatives include cybercrime forums, which also continue to thrive - but the best ones tend to be restricted to users in Russia and neighboring countries. Another option is to use legitimate, encrypted messaging apps, such as Telegram, Discord, Jabber and Wickr. But criminals often distrust tools not built by and for criminals.

Buyers and sellers also still need to find ways to first connect, and that’s a function readily provided by darknet or dark web markets - .onion websites that can only be reached by using the anonymizing Tor browser. Many darknet markets also offer the ability for buyers and sellers to rate each other. Some offer escrow services so that funds won't flow until transactions have been confirmed. And some go even further, for example, by helping to facilitate the delivery of products, such as illicit drugs.

Logo for the Hydra darknet market

So, the markets live on, led by Hydra, the world's largest darknet market, which serves only Russian speakers and accounted for 75% of global darknet market revenue last year, according to blockchain forensics firm Chainalysis. The company has issued a report tracing how cryptocurrency flowed to and from such markets last year.

Overall darknet market revenues were flat from 2019 to 2020 - except for Hydra, Chainalysis says. Hydra handled more than $1.2 billion in cryptocurrency in 2020.

"This is the biggest year on record for darknet marketplaces,” Kim Grauer, head of research at Chainalysis, tells Bloomberg. "Hydra is really the crux of this."

Hydra Dominates

Russian investigative news site Project in 2019 reported that Hydra had 2.5 million accounts, of which 393,000 - or about 15% - had made at least one purchase.

Source: Chainalysis

Hydra's membership is several orders of magnitude larger than rivals, such as DarkMarket, which had more than 500,000 users until it was disrupted last month via an international police operation.

Before that, one of the dominant players was Empire Market, with 1.3 million users. But one or more of its administrators shut down the site last summer, leaving, via an exit scam, with a horde of bitcoins and other digital currencies the site was holding in escrow.

Bogus $20 bills previously for sale on Wall Street Market

In April 2019, Wall Street Market - another major player, with 1.15 million users - also suffered death by exit scam, with administrators departing with an estimated $13 million worth of users' bitcoins.

For Sale: Drugs, Weapons, Payment Card Data

What are users buying via darknet markets? Based on total revenue, in 2020, "fraud shops" - selling stolen payment card data, hacking tools and counterfeit payment cards - had more revenue than markets that sold illicit drugs, Chainalysis reports.

Darknet buyers and sellers are global. Chainalysis says the top countries, as measured by cryptocurrency transaction volumes last year, were Russia - thanks to Hydra - followed by the U.S., Ukraine, China and Britain.

2020 data (Source: Chainalysis)

Drugs do remain a popular darknet market product, and historical patterns of how drugs get bought and sold parallel illicit cryptocurrency flows last year. "Generally speaking, drugs are grown or manufactured in Latin America and Asia and consumed in North America and Northern and Western Europe," Chainalysis says. "Darknet vendors and administrators typically launder funds through cryptocurrency services - often over-the-counter brokers - in China or Eastern Europe."

Source: Chainalysis

For funds being moved out of darknets - by sellers and administrators taking a cut of every transaction - Chainalysis says that from 2019 to 2020, it saw a marked increase, from 5% to 13%, in the share of funds being routed first to mixing services, which are also known as tumbling services. These third-party services attempt to mix bitcoins by routing them between numerous addresses as a way of laundering the cryptocurrency. In return, mixing service administrators keep a percentage of all cryptocurrency they mix.

The increased use of such services "may reflect increasing caution from darknet market vendors and administrators following law enforcement crackdowns," Chainalysis says.

Hydra: By Russians, for Russians

While Hydra dominates the darknet market landscape, there's a wrinkle for would-be users located in many parts of the world: The site's administrators try to restrict its use to Russian speakers. This is part of a broader trend, bolstered by a distrust of the West as well as a desire to keep foreign law enforcement agencies at bay.

With colloquialism-laden posts and listings - and a trust-based system designed to block unwanted users - nonnative speakers who want to gain access to Russian-language forums, including Hydra, face numerous hurdles.

Hydra is designed to serve domestic buyers and sellers, at least where physical goods are concerned. As Vice reported last year, part of Hydra's popularity can be tied to constant innovation - for example, in training an army of couriers to use dead drops for fulfilling drug deliveries in Russia.

"The online stores on Hydra employ drug dealers known as kladmen ('treasuremen' or 'droppers'), whose job is to stash drugs in GPS-tagged hiding spots ready for pick up by online buyers," Vice reports. "It’s a street-tech workaround in a country where the postal system is slow and unreliable and regular street drug dealing is highly risky."

Other goods and services are also available via darknet markets. The BBC reports that two teenagers in Russia admitted to fulfilling a murder-for-hire contract against a police inspector, Evgenia Shishkina, near Moscow in October 2018, in return for 1 million rubles (about $13,500). A darknet drug seller she was investigating allegedly hired the hitman and his accomplice via a listing on Hydra.

About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.