This blog is an excerpt of our 2025 Crypto Crime Report, available now!
A series of law enforcement takedowns in the last few years have shaped the 2024 drug and fraud ecosystems. While 2024 was likely a record year for crypto crime revenue overall, darknet market (DNM) and fraud shop inflows fell, with DNMs receiving just over $2 billion in BTC on-chain, and fraud shops $225 million.
Historically, DNMs have been known for the illicit drug trade, but in recent years have differentiated themselves with unique service offerings. This trend, however, is not universal. For example, in Russia-based DNMs, the illicit drug trade remains predominant. Since last year’s Crypto Crime Report, the top performing Russia-based DNMs have held steady, but Kraken DNM overtook Mega as the leading DNM by annual revenue in 2024.
While Mega’s inflows declined by more than 50% year-over-year (YoY), Kraken DNM’s rose nearly 68% YoY. Kraken DNM, which billed itself as Hydra’s Market’s successor, received $737 million on-chain in 2024. Blacksprut, which rose to prominence with Mega in the wake of Hydra’s 2022 sanctions designation, law enforcement seizure, and subsequent collapse, came in third with 13.6% less revenue YoY.
As reported last year, some drug shops have been outsourcing services like website hosting and payment processing. iKlad.biz and Klad.cc, shown in the chart above, are examples of those infrastructure providers. While these outfits are not traditional DNMs, their success highlights how drug vendors are scaling their operations throughout Russian-speaking countries. In spite of Hydra Market’s disruption in 2022, former Hydra affiliates still found operating in today’s DNMs rely heavily on these infrastructure providers. Last December, a Russian court imposed a life sentence on Stanislav Moiseyev, Hydra Market’s suspected founder and operator, although the Moscow prosecutor’s office did not publicly tie the guilty verdict to Hydra. The court also sentenced fifteen accomplices to anywhere from eight to 23 years in maximum-security penal colonies.
Besides Hydra operators, other DNM administrators faced criminal prosecution in 2024. In March, Incognito Market’s administrators conducted an exit scam. The FBI tied Taiwanese national Rui-Siang Lin, Incognito’s operator, to the DNM’s website by tracing crypto transfers to an exchange account in Lin’s name. Lin was charged with a host of crimes, and by May, federal authorities in New York had arrested him.
Nemesis Market also saw its demise in March, when German authorities seized its infrastructure, along with $102,000 in cryptocurrency.
As international authorities have disrupted DNMs large and small in the last few years, cybercriminals and drug dealers have learned firsthand the consequences of running BTC-accepting DNMs given the currency’s inherent transparency. Many operators have since moved to accepting only Monero (XMR), a privacy coin with features designed to boost anonymity and reduce traceability. XMR activity falls outside the scope of this report.
Darknet market vendors evolve their on-chain behavior
Historically, DNMs have usually cashed out their funds at centralized exchanges (CEXs). Although CEXs remain a stable destination in the DNM ecosystem, the pattern of sending funds to them shifted in 2024, as illustrated in the chart below. Last year, DNM vendors sent a significantly higher portion of their funds to DeFi than they did historically. This trend is notable since DNMs operate largely in BTC or privacy coins. Throughout 2024, DNM vendors also sent far more value to personal wallets and stored funds on-chain. Retail vendors appear to be holding a greater portion of their proceeds on-chain than wholesale vendors, while wholesale vendors (those who distribute drugs in large quantities) are making greater use of DeFi.
Darknet market and online pharmacy inflows according to drug-purchasing behaviors
When looking at crypto inflows to DNMs in 2024, the data indicate that wholesale drug purchases were dominant, averaging between 71 and 81% of this year’s total market share. For online pharmacies, wholesale purchases led in 2024, followed by large retail.
Below are definitions for DNM purchase categories, based on purchase sizes, from which we infer buyer intent:
- Small retail. Less than $100, likely made for personal consumption.
- Large retail. Between $100 and $500, also likely made for personal consumption.
- Social supply. Between $500 and $1,000, indicating customers may be sharing drugs with third parties in social settings.
- Potential wholesale. Over $1,000, more likely made by drug sellers and distributors.
When examining drug-purchasing habits from DNMs spanning 2020 to 2024, some patterns emerge, in particular about wholesale activity, that is, purchases likely made by organizations with the intent to redistribute. First, the major drawdown in DNM wholesale revenue in 2022 can be attributed to the Hydra Market takedown. Second, while wholesale drug purchasing revenues have steadily climbed since that drop, they have yet to regain their former highs. This could indicate that:
- No DNM since Hydra has established itself as the premier destination for wholesale drug purchases.
- Global law enforcement operations are becoming increasingly effective in disrupting markets that cater to these purchasers.
- Sellers and vendors are resorting to other channels, like instant messaging platforms, and/or payment methods for illicit drug trade.
As for online pharmacies, these have predominantly catered to wholesale and large retail customers in the last several years, and 2024 saw growth in wholesale purchases toward the end of last year. Like DNMs, online pharmacies receive most of their revenues from larger drug resellers.
Abacus Market: Facilitating illicit drug trade
In 2024, Abacus Market was the highest-earning DNM serving Western customers. Last year, Abacus Market received $43.3 million on-chain.
Since 2021, Abacus Market’s revenue has increased substantially, and in 2024, it more than doubled, growing by 183.2% YoY. This increase may be due in part to the closures of top DNMs, the shift to the exclusive acceptance of XMR by other active markets, and delistings of XMR by popular centralized exchanges. The below graph shows an increase in Abacus sales (in BTC) following the closure of ASAP Market in July 2023, and a further increase following some CEXs delisting XMR.
Abacus Market has a global presence and broad product offering. Below is a screenshot from the Abacus Market website showing the range of items it sells, with drugs and chemicals representing the overwhelming majority of its products.
On Abacus Market, the US, Canada, Germany, Australia, and the UK have the highest number of listings. In the US, there’s a large diversity in the types of products sold, including counterfeit pills. For example, in the screenshot below, an American vendor lists protonitazene powder, and advertises its uses as a counterfeit for oxycodone, also referred to as “M30” (i.e. 30 mg).
While the US market is best characterized by its diverse product offerings, other countries offer regional specialties. In Colombia, for instance, many of the vendor listings are for cocaine or Infrastructure-as-a-Service, as seen in the screenshot below.
Some countries have just one or a few vendors with a loyal customer base and a wider selection of goods. For example, in India, one of the most frequent listings is for generic medication, which mostly comes from the first vendor shown below.
China-based Abacus vendors have many listings for research chemicals. They also sell PMK and BMK, which are precursors to MDMA and methamphetamine, respectively.
Darknet market connection to Chinese pill press manufacturers
While China-based vendors are frequently referenced as the source of precursors for dangerous synthetic drugs, their involvement in machinery sales is also an important aspect of the drug supply chain. One China-based pill press manufacturer which advertises on clearnet business-to-business (B2B) websites has on-chain ties to drug vendors on Abacus Market. Along with its listings for large pill press machines, the vendor does not hide the sale of Oxycontin and Xanax TDP die kits, which are used to press counterfeit pills. The vendor accepts BTC and XMR, and analyzing its on-chain exposure to regional CEXs and DNMs reveals that it serves customers worldwide, including in the United States, Canada, Sweden, and Russia. The Reactor graph below shows this vendor’s connection with drug vendors on Abacus Market.
While not all are pictured above, in total, we found 16 vendors either selling or sourcing drug material from Abacus and purchasing production supplies from this China-based vendor.
China-based vendors and novel synthetic opioids
China-based precursor manufacturers mark the beginning of the synthetic drug supply chain. In years past, these organizations were more overt in their display of such products, openly advertising on mainstream B2B websites. Depending on the severity of the chemical, some manufacturers still follow this practice.
In 2024, however, many vendors of reagents and precursors have turned to criminal forums to advertise their product offerings, or have delisted (at least publicly) chemicals related to fentanyl synthesis. This could be in response to increasing pressure from the United States and China, and the crackdown on the websites selling these products. The organized crime section of this report, which discusses the nexus between Mexican cartels and Chinese fentanyl precursor manufacturers, indicates that this corridor still exists, although overall inflows to these manufacturers have seen a dip.
In addition to fentanyl, the presence of nitazenes in the global supply of dangerous synthetic opioids has increased, and China-based vendors have established themselves as the initial source. Nitazenes are a type of synthetic opioid with a similar potency to fentanyl. The US and Europe have seen an increase in nitazine-related overdose deaths in recent years, perhaps due to the halt in the heroin supply following the Taliban’s crackdown. Due to the novelty of these substances (and the fact that many are analogs) the true number of overdoses in Europe could be higher, as forensic drug testing may lag behind the pace of the crisis.
In addition to various benzodiazepines, stimulants, and psychedelics, one longstanding China-based research chemical manufacturer also sells nitazenes. The vendor’s listing of a protonitazene analog boldly states that the compound has a potency 20x greater than that of fentanyl, as seen below. In this listing, the vendor offers free shipping to the US. Once received by the buyer, the compound could be pressed into counterfeit pills, like M30s, and further distributed to end consumers.
Screenshot from a China-based research chemical manufacturer’s website
This vendor is known for supplying chemicals in bulk. Deposits span from the hundreds to the tens of thousands of dollars, and the average deposit amount in 2024 was over $2,000. On-chain data indicates the vendor supplies these drugs to other Chainalysis-identified online pharmacies and DNM vendors, all while maintaining a far-reaching global customer base throughout North America, Europe, Australia, and South America.
Interestingly, this vendor has also been a trusted supplier for OFAC-designated fentanyl traffickers Alex Adrianus Martinus Peijnenburg and Matthew Simon Grimm, having received close to $1.5 million in purchases from them.
Fraud shop revenues decline in 2024
Fraud shops are services found mainly on the dark web that sell stolen data and personally identifiable information (PII), which cybercriminals use for scams, identity theft, and ransomware attacks. In 2024, fraud shop inflows declined by 50% YoY, a sharp downturn from the last three years.
A few factors likely influenced this BTC revenue decline among fraud shops:
- The elimination of UAPS, a payment processor on which many fraud shops relied.
- US agencies and other international authorities prioritizing the takedown of fraud-related services.
- A migration away from BTC payments to XMR, as observed with DNMs.
UAPS: The takedown of a fraud shop payment processor and its impact on ecosystem
Last September, OFAC designated Sergey Sergeevich Ivanov, the alleged creator and operator of Universal Anonymous Payment System (UAPS), a payment processor used by many fraud shops, as well as PM2BTC, a Russian virtual currency exchanger associated with Ivanov, and Cryptex, a crypto exchange operating in Russia and registered in St. Vincent and the Grenadines.
These actions were part of a coordinated effort among US government agencies and foreign counterparts to combat Russian illicit finance. In September 2024, the US Secret Service’s Cyber Investigative Section, Netherlands Police, and the Dutch Fiscal Intelligence and Investigation Service (FIOD) seized web domains and infrastructure linked to UAPS, PM2BTC, and Cryptex.
After the UAPS infrastructure takedown, we observed a swift decline in on-chain activity from UAPS counterparties, indicating that many fraud shops relied on this infrastructure to process customer payments. The chart below shows this counterparty decline, as well as a drop in crypto flows across the fraud shop ecosystem.
Conversely, some fraud shops saw an increase in activity and higher revenues on-chain. The chart below shows fraud shops that performed well after the UAPS takedown, indicating that the customer migration was swift, and favored longstanding, trusted fraud shops like Vclub and Bankomat.
Revenues for the fraud shops on the right side of the chart declined, suggesting their dependence on UAPS for payment infrastructure.
The fraud shop-ghost gun connection: A case study
Ghost guns, assembled with prefabricated parts and without required serial numbers, are nearly always designed to be semi-automatic firearms, and are almost impossible to trace. Everytown, an organization that works to prevent gun violence in America, calls ghost guns a “weapon of choice for violent criminals” and extremists.
In 2023, the New York Police Department (NYPD) Intelligence Bureau, which predominantly handles counter terrorism cases, received a tip about two people in New York City involved in manufacturing and selling ghost guns. Using a series of search warrants and subpoenas, the NYPD found the suspects’ online raw material purchases, and uncovered a crypto dimension to the case, not publicly shared until now. Suspects were exchanging large sums of fiat for cryptocurrency by transferring cash into a mainstream CEX account and buying BTC, which they used to purchase stolen credit cards and identities from fraud shops on the dark web. The Reactor graph below shows five purchases made to fraud shops, four of which passed through intermediary addresses.
With these stolen credentials, the suspects purchased ghost gun parts and tools from a variety of legitimate websites, which they used to build ghost guns with a 3D printer, and sell for cash. A Manhattan district attorney successfully used this evidence to bring charges against one of the suspects.
Continued law enforcement efforts key to illicit
market disruption
While DNM and fraud shop revenues declined in 2024 following years of concerted international law enforcement efforts, these platforms have managed to sustain their operations by adopting new tactics. In spite of disruptions to the dark web ecosystem, DNMs in particular continue to play a significant role in enabling the China-based synthetic drug production supply chain, highlighting the necessity for ongoing global cooperation to disrupt and dismantle illicit drug networks worldwide.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with the use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of
such material.