Dark Web Marketplace Remains Resilient Despite Prominent Takedown

Fortify Security Team
Apr 19, 2021

Despite the takedown of DarkMarket, the broader dark web marketplace remains nimble and resilient. DarkMarket was one of the largest marketplaces on the dark web. The takedown likely will not have lasting effects in curbing illicit behavior, as other platforms look to take its place and provide forums that routinely reap financial benefits. We base this assessment on the trend of users migrating to other market sites following past shutdowns of prominent dark web marketplaces and the expanding popularity of dark web markets during the COVID-19 pandemic. Dark web  marketplaces serve as vehicles for criminal activity in the United States and worldwide, as these marketplaces offer illicit materials and services—such as malware, narcotics, counterfeit  identification documents, and more—for sale.

In January 2021, Europol led a globally coordinated investigation and arrested the alleged operator of DarkMarket, seizing over 20 servers, according to a Europol press release. DarkMarket was the largest market on the dark web, with over 500,000 active users, 2,400 sellers, and 320,000 transactions associated with illicit goods—including malware, drugs, forged money, and stolen credit cards—according to the same press release and reliable media reporting. Authorities began investigating DarkMarket following the seizure of a data processing center that previously hosted DarkMarket and other illicit sites on the dark web, according to the same reliable media reporting.

Authorities in November 2013 took down the first prominent dark web marketplace, Silk Road, according to a reliable US media report. Within a month, the AlphaBay dark web market was brought online and the migration of users grew to nearly 10 times the size of Silk Road—to 200,000 users and 40,000 vendors, according to the same source.

US authorities in July 2017 seized AlphaBay, which had grown to the largest dark web market of its time, according to a Department of Justice press release. After the shutdown of AlphaBay, users migrated to one of AlphaBay’s biggest competitors, Hansa Market, resulting in a jump in the number of vendors on Hansa Market to an average of 8,000 a day from 1,000, according to a reliable US media report. Dutch authorities had taken Hansa Market down in June 2017, a month before AlphaBay’s take down, but had been using Hansa Market to trap users fleeing from AlphaBay. With the shutdown of both AlphaBay and Hansa Market, users flocked to other markets, such as Dream Market, which also observed a spike in transactions and listings, according to the same report.

With the demise of AlphaBay and Hansa, Empire Market came online in 2018 and became known as the “largest and most trusted English-language marketplace” on the dark web. In August 2020, however, Empire Market closed in an apparent exit scam by the marketplace’s operators, absconding with members’ funds, according to a cyber risk protection firm reporting. Following the disappearance of Empire Market, other dark web markets experienced a surge in customers—such as Icarus, a prominent English-language market that saw an increase of 10,000 listings within the month following Empire Market’s exit, according to the same report.

Increased international cooperation can aid with identifying and rapidly taking down multiple popular dark web marketplaces and their potential successors, either simultaneously or in rapid succession, and cause more disruptions with greater impact. Other actions, such as publicizing the associated legal actions against individual criminal actors and enablers (e.g. hosting companies), could complement the takedowns and potentially dissuade some participation in dark web markets.




Recent Posts

Ransomware Attacks on Agricultural Cooperatives

The Federal Bureau of Investigation (FBI) is informing Food and Agriculture (FA) sector partners that ransomware actors may be more likely to attack agricultural cooperatives during critical planting and harvest seasons, disrupting operations, causing financial loss,...

SIM Swapping Attacks to Steal Cryptocurrency to Become Prominent

Unidentified actors are conducting subscriber identity module (SIM) attacks and stealing cryptocurrency from victims, resulting in financial loss to cryptocurrency investors. Reporting indicates, unidentified actors withdrew cryptocurrency worth over $600,000 from...

Stabbing Attack Injures Multiple Victims on Passenger Train

A yet to be identified male attacker, armed with a knife, stabbed at least 10 passengers on board a commuter train in the Japanese capital, Tokyo, on Friday night, August 6. The attack occurred on an evening commuter train in Tokyo's Setagaya ward, which is located in...

Beware of Grandparent Fraud Scheme Using Couriers

Criminal actors target elderly U.S. citizens in a grandparent fraud scheme in which they arrange for couriers to pick up bail money in person at the victim’s residence. Criminals telephonically contact their victims and pose as a grandchild, or another family member,...