Big thanks to the folks at Chainalysis for their 2025 Crypto Crime Report. It’s always a fascinating look into the darker corners of the digital world. Turns out, 2024 was a wild year for crypto crime revenue overall, but some of the usual suspects, like darknet markets (DNMs) and fraud shops, actually saw their Bitcoin (BTC) earnings drop. It’s almost like law enforcement has been busy, isn’t it?
- Darknet markets saw a decrease in Bitcoin earnings in 2024, suggesting increased law enforcement effectiveness. However, some markets like Kraken DNM experienced significant growth.
- Cybercriminals are increasingly turning to privacy coins like Monero and decentralized finance (DeFi) to evade detection. This shift indicates an adaptation to the transparency of Bitcoin transactions.
- China-based manufacturers play a significant role in the global synthetic drug supply chain. They supply precursors and pill presses, with some vendors openly selling materials for making fake pills.
These digital marketplaces, where folks used to buy all sorts of illicit goods, pulled in just over $2 billion in BTC. Fraud shops, which are basically online stores for stolen data, saw their haul shrink to $225 million. That’s a pretty sharp decline for them, down 50% from the year before. You see, the digital world, much like the real one, has its ups and downs, especially when the authorities decide to play whack-a-mole.
Historically, DNMs were mostly about the drug trade. But lately, many have tried to branch out, offering other shady services. Not everywhere, though. If you look at Russia-based DNMs, it’s still mostly about drugs. And get this: Kraken DNM, which fancied itself the heir to the infamous Hydra’s Market, really took off. It pulled in $737 million in 2024, a jump of nearly 68% from the previous year. Meanwhile, Mega, which used to be the big dog, saw its inflows cut by more than half. Blacksprut, another market that popped up after Hydra’s big bust, came in third, but its revenue dipped a bit too. It’s a tough crowd out there, even for criminals.
Speaking of Hydra, remember that huge takedown in 2022? It really shook things up. The suspected founder, Stanislav Moiseyev, even got a life sentence from a Russian court last December. Fifteen of his pals got long stretches in prison too. Even with Hydra gone, some of its old crew are still around, relying on what you might call “infrastructure providers” like iKlad.biz and Klad.cc. These aren’t traditional DNMs, but they help drug sellers scale up their operations across Russian-speaking countries. It’s a bit like how legitimate businesses use cloud services, just, you know, for selling illegal stuff.
It wasn’t just Hydra operators facing the music. Incognito Market, another DNM, pulled an “exit scam” in March. That’s when the operators just vanish with everyone’s money. But the FBI, being rather clever, traced crypto transfers to an exchange account and nabbed the operator, Rui-Siang Lin, in New York. Then there was Nemesis Market, which German authorities shut down in March, seizing its infrastructure and a cool $102,000 in crypto. It seems the long arm of the law is getting pretty good at tracing those digital breadcrumbs.
These crackdowns have taught cybercriminals a harsh lesson: Bitcoin (BTC), for all its digital magic, isn’t exactly invisible. It’s transparent, which means every transaction leaves a trail. So, what did many of these operators do? They packed up their digital bags and moved to Monero (XMR), a privacy coin designed to be much harder to trace. It’s like they finally realized that trying to hide in plain sight with Bitcoin wasn’t working out so well. The report doesn’t even get into Monero activity, which tells you something about how much things have changed.
Darknet vendors are also getting smarter about how they handle their money. Historically, they’d just cash out at centralized exchanges (CEXs), which are like regular banks for crypto. But in 2024, a lot more funds started flowing into DeFi (decentralized finance). Think of DeFi as a wild west bank, no rules, just code, and usually harder to track. Vendors also started sending more money to personal wallets and just holding it on-chain. It seems the smaller retail vendors are holding onto their digital cash, while the big-time wholesale dealers, the ones moving drugs in huge quantities, are getting more involved with DeFi. It’s a whole new financial strategy for the illicit trade.
When you look at what people are actually buying on these markets, it’s mostly wholesale drug purchases. We’re talking about 71% to 81% of the total market share in 2024. For online pharmacies, it’s the same story: wholesale first, then large retail. They categorize purchases by size: small retail (under $100, for personal use), large retail ($100-$500, also personal), social supply ($500-$1000, sharing with friends), and potential wholesale (over $1000, for selling and distributing). It’s like a tiered membership program, but for illegal substances.
The big drop in wholesale drug revenue back in 2022? That was all thanks to the Hydra Market takedown. Since then, wholesale purchases have climbed back up, but they haven’t hit their old highs. This might mean a few things. Maybe no new DNM has managed to become the go-to spot for wholesale deals like Hydra was. Or perhaps global law enforcement is just getting better at busting these big operations. And it could also be that sellers are using other ways to do business, like instant messaging apps, or different payment methods entirely. It’s a constant game of hide-and-seek.
Now, let’s talk about Abacus Market. In 2024, this was the top earner for Western customers, raking in $43.3 million. That’s more than double its revenue from the year before, a whopping 183.2% increase. Why the boom? Well, other big DNMs got shut down, some moved exclusively to Monero, and popular crypto exchanges even delisted Monero, making it harder to use. So, Abacus became the place to be. It’s got a global reach and sells all sorts of stuff. In the US, you’ll find a mix, including fake pills. Colombia? Lots of cocaine listings. India? Generic meds. And China? Research chemicals, plus precursors for MDMA and meth. It’s a truly international bazaar of badness.
Here’s where it gets really interesting: there’s a direct link between darknet markets and Chinese pill press manufacturers. Imagine ordering a machine to press pills online, like you’re buying a new coffee maker. Except this vendor, who advertises on regular business-to-business (B2B) websites, also openly sells die kits for making fake Oxycontin and Xanax pills. And they accept Bitcoin and Monero. Chainalysis found 16 vendors on Abacus Market who were either selling drug material or sourcing it from this Chinese manufacturer, and then buying their production supplies from them. This one manufacturer serves customers all over the world, from the US to Russia. It’s a chilling thought, isn’t it?
China-based precursor manufacturers are at the very beginning of the synthetic drug supply chain. These are the folks making the raw ingredients. A few years back, they were pretty open about advertising these chemicals on mainstream B2B sites. But in 2024, many have moved to criminal forums or quietly removed listings for fentanyl-related chemicals. This is likely because the US and China have been putting a lot of pressure on them. But don’t be fooled; the connection between Mexican cartels and Chinese fentanyl precursor makers still exists, even if the money flowing to them has dipped a bit.
And then there are nitazenes. These are a new type of synthetic opioid, just as strong as fentanyl, maybe even stronger. They’ve been popping up more and more, causing overdose deaths in the US and Europe. China-based vendors are the initial source for these nasty compounds. One long-standing Chinese chemical manufacturer even sells nitazenes, boldly stating that one of its compounds is 20 times more potent than fentanyl. And get this: they offer free shipping to the US. Once it arrives, it can be pressed into fake pills, like the M30s, and then sold to unsuspecting users. It’s a truly terrifying thought.
This particular vendor is known for selling chemicals in bulk. We’re talking deposits from hundreds to tens of thousands of dollars, with the average in 2024 being over $2,000. On-chain data shows this supplier is providing drugs to other online pharmacies and DNM vendors, with customers stretching across North America, Europe, Australia, and South America. They even supplied OFAC-designated fentanyl traffickers, Alex Adrianus Martinus Peijnenburg and Matthew Simon Grimm, to the tune of nearly $1.5 million. It’s a big operation, to say the least.
Fraud shops, as we mentioned, saw their revenues tumble in 2024. A 50% drop year-over-year is nothing to sneeze at. A few things likely caused this. First, a payment processor many of them relied on, UAPS, got taken out. Second, US agencies and other international authorities have really been focusing on busting these fraud services. And third, just like the DNMs, many of them probably moved away from Bitcoin to Monero. It seems even criminals are learning about market diversification.
The takedown of UAPS was a big deal. Last September, US authorities, working with international partners, went after Sergey Sergeevich Ivanov, the alleged creator of UAPS, along with a related crypto exchanger and a crypto exchange. They seized web domains and infrastructure. After that, activity from UAPS users just plummeted. It showed how much those fraud shops depended on it. Of course, some of the older, more trusted fraud shops like Vclub and Bankomat actually saw their business pick up, as customers just moved over to them. It’s a bit like when one big store closes, and everyone just goes to the next one down the street.
And here’s a real-world example of how these fraud shops impact us. In 2023, the New York Police Department (NYPD) got a tip about two people making and selling “ghost guns” in New York City. These are firearms assembled from parts, without serial numbers, making them almost impossible to trace. The NYPD found that the suspects were exchanging cash for Bitcoin at a mainstream crypto exchange. Then, they used that Bitcoin to buy stolen credit cards and identities from dark web fraud shops. With those stolen credentials, they bought ghost gun parts and tools from legitimate websites, built the guns with a 3D printer, and sold them for cash. A Manhattan district attorney used this evidence to charge one of the suspects. It’s a stark reminder that what happens in the digital shadows can have very real, very dangerous consequences.
So, while darknet market and fraud shop revenues did decline in 2024, thanks to years of international law enforcement efforts, these platforms are pretty resilient. They keep finding new ways to operate. Darknet markets, especially, still play a big role in the global synthetic drug supply chain, particularly from China. It just goes to show that the fight against these illicit networks is far from over. It’s a continuous effort, a digital game of cat and mouse, and it requires everyone working together to keep the pressure on.
