Dark Web Marketplace Remains Resilient Despite Prominent Takedown

Fortify Security Team
Apr 19, 2021

Despite the takedown of DarkMarket, the broader dark web marketplace remains nimble and resilient. DarkMarket was one of the largest marketplaces on the dark web. The takedown likely will not have lasting effects in curbing illicit behavior, as other platforms look to take its place and provide forums that routinely reap financial benefits. We base this assessment on the trend of users migrating to other market sites following past shutdowns of prominent dark web marketplaces and the expanding popularity of dark web markets during the COVID-19 pandemic. Dark web  marketplaces serve as vehicles for criminal activity in the United States and worldwide, as these marketplaces offer illicit materials and services—such as malware, narcotics, counterfeit  identification documents, and more—for sale.

In January 2021, Europol led a globally coordinated investigation and arrested the alleged operator of DarkMarket, seizing over 20 servers, according to a Europol press release. DarkMarket was the largest market on the dark web, with over 500,000 active users, 2,400 sellers, and 320,000 transactions associated with illicit goods—including malware, drugs, forged money, and stolen credit cards—according to the same press release and reliable media reporting. Authorities began investigating DarkMarket following the seizure of a data processing center that previously hosted DarkMarket and other illicit sites on the dark web, according to the same reliable media reporting.

Authorities in November 2013 took down the first prominent dark web marketplace, Silk Road, according to a reliable US media report. Within a month, the AlphaBay dark web market was brought online and the migration of users grew to nearly 10 times the size of Silk Road—to 200,000 users and 40,000 vendors, according to the same source.

US authorities in July 2017 seized AlphaBay, which had grown to the largest dark web market of its time, according to a Department of Justice press release. After the shutdown of AlphaBay, users migrated to one of AlphaBay’s biggest competitors, Hansa Market, resulting in a jump in the number of vendors on Hansa Market to an average of 8,000 a day from 1,000, according to a reliable US media report. Dutch authorities had taken Hansa Market down in June 2017, a month before AlphaBay’s take down, but had been using Hansa Market to trap users fleeing from AlphaBay. With the shutdown of both AlphaBay and Hansa Market, users flocked to other markets, such as Dream Market, which also observed a spike in transactions and listings, according to the same report.

With the demise of AlphaBay and Hansa, Empire Market came online in 2018 and became known as the “largest and most trusted English-language marketplace” on the dark web. In August 2020, however, Empire Market closed in an apparent exit scam by the marketplace’s operators, absconding with members’ funds, according to a cyber risk protection firm reporting. Following the disappearance of Empire Market, other dark web markets experienced a surge in customers—such as Icarus, a prominent English-language market that saw an increase of 10,000 listings within the month following Empire Market’s exit, according to the same report.

Increased international cooperation can aid with identifying and rapidly taking down multiple popular dark web marketplaces and their potential successors, either simultaneously or in rapid succession, and cause more disruptions with greater impact. Other actions, such as publicizing the associated legal actions against individual criminal actors and enablers (e.g. hosting companies), could complement the takedowns and potentially dissuade some participation in dark web markets.




Recent Posts


Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China ’s MSS Hainan State Security Department SUMMARY APT40—aka BRONZE MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, MUDCARP, Periscope,...

Commemoration of Tulsa Race Massacre Attractive Target DVE’s

While we there isn't a specific or credible intelligence indicating that violent extremists are planning to target events taking place between May 28th and June 1st, the current Homeland threat environment remains heightened and racially or ethnically motivated...