Notably, our dataset includes Silk Road (the first modern DWM)1, Alphabay (once the leading DWM)44, and Hydra (currently the largest DWM in Russia)12. Other general statistics about our dataset can be found in the Section S3. Overall, our study provides a first step towards the understanding of how users of DWMs collectively behave outside organised marketplaces.

Fraud And Hacking Services
However, they have so far mainly focused on DWM users, without distinguishing between buyers and sellers, and neglecting the different weight that more active users may have in the system. The reason is that the operational structure of DWMs inherently hides the seller–buyer link, as all transactions are made through the marketplace. Buyers send money to the marketplace, which in turn sends the money to the seller. Thus, further analyses in this direction have been hindered by the lack of heuristics able to identify these two key classes of actors in transaction networks and their roles in the structure and dynamics of the ecosystem. Betweenness centrality30,31 measures the extent to which a node is on shortest paths connecting pairs of nodes in the network.
Recent results have shown that transaction networks and activity on DWMs and regulated online marketplaces share several robust macroscopic properties43. One might therefore hypothesise that U2U trading is also a prevalent feature on regulated online marketplaces. Darknet-hosted drug markets (‘cryptomarkets’) are an established model of illicit drug distribution which makes use of specialised online hosting and payment systems to link buyers and sellers remotely. Cryptomarkets appear to professionalise, gentrify and integrate drug markets. Therefore, they can be hypothesised to have effects on drug availability by allowing purchases by people who use drugs (PWUD) outside of face-to-face networks that have typified drug distribution. They may attract new buyers and may change use patterns by offering a greater range of higher-potency drugs.
However, the question of why (certain) vendors achieve high betweenness scores, remains an open question to be addressed in future work through methods such as topic modelling. In short, while topic engagement showed the best overall performance, betweenness centrality could provide the greatest added value to law enforcement activities for reducing the set of users to investigate. In this work we focus on identifying key players in dark net cryptomarkets that facilitate online trade of illegal goods. Law enforcement aims to disrupt criminal activity conducted through these markets by targeting key players vital to the market’s existence and success. We particularly focus on detecting successful vendors responsible for the majority of illegal trade.
- We reveal that stable U2U pairs play a crucial role for marketplaces by spending significantly more time and generating far greater transaction volume with DWMs than other users.
- Supervised this process and gave suggestions on the study design and result analysis.
- Individually, they are able to yield significant high incomes compared to other types of sellers.
- Here, the third polynomial is used to try to account for the two aforementioned events that took place in the Evolution cryptomarket27.
- With the advent of several markets at the beginning of 2014, the number of multisellers rapidly grows, representing more than 20% of all sellers until the beginning of 2016 (see Supplementary Information Section S3).
Insights And Caveats From Mining Local And Global Temporal Motifs In Cryptocurrency Transaction Networks

Whereas it can be easy to identify administrators due to titles given to these users, it may be harder to identify successful vendors. It is especially difficult to identify those vendors whose success is yet to come. These tasks might be further complicated when encryption is used for message contents.
Network Extraction

Rates in the USA have received most attention and are usually drawn from the National Survey on Drug Use and Health. In the EU the evidence is similarly sparse, barring some limited ECMDDA secondary data collection. Novak et al. (2016) surveyed just over 22,000 people aged between 12 and 49 in Denmark, Germany, Great Britain, Spain and Sweden with the intention of investigating NMPDU, and the characteristics of those users. They find that Spain and Sweden had the most prevalent use of sedatives, followed by Great Britain and Denmark. Germany had the lowest percentage of users in the population for both stimulants and sedatives. The work reports usage rates in EU countries slightly below those seen in the USA (20% lifetime usage vs between 7 and 13% in EU).
Effect On Purchases And Drug Diffusion
Dark web marketplaces (DWMs) are online platforms that facilitate illicit trade among millions of users generating billions of dollars in annual revenue. Recently, two interview-based studies have suggested that DWMs may also promote the emergence of direct user-to-user (U2U) trading relationships. Here, we carefully investigate and quantify the scale of U2U trading around DWMs by analysing 31 million Bitcoin transactions among users of 40 DWMs between June 2011 and Jan 2021.
Network Measures & Activity Indicators
As noted before, lines in these plots are third polynomial approximations of the trend. Figure 3 shows that, for both current and future success, degree and closeness centrality generally have a worse vendor recall than any of our activity indicators. From May onwards, PageRank outperforms post activity and performs on par with the topics started indicator. Meanwhile, from July onwards, betweenness centrality consistently outperforms both the post activity and topics started activity indicators and performs (nearly) on par with topic engagement. Overall, the topic engagement indicator most consistently achieves high performance in terms of vendor recall.
Reporting Countries

(b) Trading volume in dollars sent to a DWM compared with the total trading volume in its surrounding U2U transactions. The dashed line is the bisector and allows to easily compare the two trading volumes. (c) Total monthly trading volume sent to all DWMs and exchanged in all unique U2U pairs. We do not include the trading volume received from DWMs because it is essentially equivalent to the volume sent to DWMs. After Silk Road was shut down by law enforcement, many other markets proliferated, sparking rounds of innovation and disruption between market administrators and law enforcement 18.
Best Dарknet Markets For Drugs: Nexus And Abacus In 2025
It is important to exercise caution when using darknet markets, and to only transact with reputable sellers. Darknet markets offer a wide variety of goods and services, ranging from illegal drugs and weapons to counterfeit currency and stolen credit card information. Some markets also offer legitimate goods and services, such as digital products and software.
Conclusion And Future Directions
The pre-processing relies on established state-of-the-art heuristics to cluster addresses into entities, such as cospending, intelligence-base, and behavioral clustering39,40,41,42. The resulting data set includes for each transaction the source and destination entities, the time, and the value of the transaction. The number of multisellers steeply decreases after operation Bayonet but they still sustain high incomes. Nevertheless, by analysing the income of each multiseller, we observe that the median income still reflects their high income, as shown in Fig. Individually, they are able to yield significant high incomes compared to other types of sellers. With the advent of several markets at the beginning of 2014, the number of multisellers rapidly grows, representing more than 20% of all sellers until the beginning of 2016 (see Supplementary Information Section S3).

While degree captures this regardless of edge direction, in- and out-degree count only the neighbors connected through incoming and outgoing edges, respectively. Furthermore, the weighted degree variants sum the weights of the connections with the neighbors. Law enforcement and security researchers recommend treating all darknet interactions as compromised by default.

