How dark web markets work: Tor, crypto and escrow

Darknet markets took in nearly $2.6 billion in crypto in 2025, despite repeated law enforcement takedowns. They sit on the dark web, a part of the internet invisible to standard browsers and search engines. Crypto became tied to its criminal side early on, but Bitcoin's role is changing. This guide explains how these markets work, how they get paid, what they sell, and why they keep coming back.

TL;DR

• The dark web uses privacy networks like Tor to host sites that aren't accessible through ordinary browsing, including both legal services and criminal marketplaces.
• Darknet markets borrow familiar features from e-commerce, such as listings, seller reviews and escrow, but these systems don't guarantee a safe or successful transaction.
• Bitcoin dominated early darknet commerce, but Monero-only markets are becoming more common. Chainalysis estimates that crypto flows associated with darknet markets and drug vendors exceeded $2.5 billion in 2025.
• International operations in 2026 targeted fraudulent dark web sites, drug suppliers and cybercrime infrastructure, leading to arrests, seizures and takedowns.
• Closing a market doesn't necessarily end the trade. Buyers and vendors can migrate to other platforms, although disruptions can still cost them money and access.

What is the dark web?

The internet is often described in terms of three layers, commonly visualized as an iceberg. Start with the top, entirely public layer, the surface web that every internet user knows and interacts with. This is where you find YouTube, Wikipedia, e-commerce marketplaces like Amazon, X profiles and Reddit front pages, all indexed by search engines and accessed through traditional browsers.

Below it sits the deep web, which hosts password-protected and subscription-based content such as your email inbox, online banking portal, academic journal databases and corporate intranets. These sites use standard DNS domains but aren’t indexed by search engines.

Go deeper and you reach the dark web, where DNS is replaced by .onion addresses, websites require special software to access, and the addresses of both users and servers are hidden from outsiders. Though best known for illicit uses, it grew out of government research and decentralized communication projects of the 1990s and 2000s.

Most users reach the dark web through Tor, short for The Onion Router, which was released to the public in September 2002. It builds on onion routing technology developed at the US Naval Research Laboratory to protect sensitive intelligence exchange online.

What makes Tor different?

Tor serves a different purpose than conventional browsers like Safari or Firefox. Standard tools prioritize convenience, usability and speed, while the dark web runs on a trifecta of its own: anonymity, privacy and censorship resistance.

A browser like Chrome connects you directly to the target website’s server. Tor, in comparison, bounces your traffic through three encrypted volunteer nodes, randomized global relays for entry, middle and exit, and each relay only knows the step right before and after it.

The website sees the exit node’s IP address instead of yours, and your internet service provider can see that you’re using Tor but not what you do on it. Tor also does not retain any browsing history, and cookies are only valid for a single session. The flip side of this anonymity is slow browsing.

What does a dark web market look like?

A dark web market features product listings, seller profiles and reputation systems based on buyer feedback, much like Amazon or eBay. The crucial difference is what’s sold and reviewed, and how transactions are processed.

While the dark web isn’t exclusively criminal, its marketplaces let pseudonymous operators sell illegal goods under the radar of traditional banking systems. Transactions often use escrow: the market holds a buyer's cryptocurrency until the order is confirmed or the platform's release conditions are met. This scheme was popularized by Silk Road, the first modern darknet black market that operated from February 2011 to October 2013.

Step 1. A buyer deposits cryptocurrency into a market-controlled wallet, where the funds are held in escrow.

Step 2. Digital goods like malware are delivered directly over the platform, while physical goods are shipped by the vendor through standard postal services.

Step 3. The buyer confirms receipt.

Step 4. The market releases the payment to the seller.

Buyers and sellers typically communicate through the Pretty Good Privacy (PGP) system, which encrypts their conversations and hides them from the market operators. Buyers can also leave reviews and rate sellers, just like on a mainstream e-commerce site.

Crypto as default payment method

Crypto dominates dark web commerce because of its pseudonymous and decentralized nature. Peer-to-peer transactions bypass bank approvals and clearing houses, while accounts rely on cryptographic wallet addresses instead of real-world names.

Concealing buyers' and sellers' identities was central to Silk Road, which facilitated sales totaling roughly 9.5 million BTC in its first two and a half years of operation. The marketplace relied on Tor to conceal users' network locations and Bitcoin to process payments without conventional payment intermediaries. But Bitcoin's public ledger left a record of transactions that investigators could later analyze.

Monero offers a different approach. Its protocol obscures transaction amounts and the sender and receiver information available on a public blockchain. According to TRM Labs, 48% of darknet markets launched in 2025 accepted only Monero, a sign of growing demand for privacy-focused payments in this part of the market. 

Darknet markets have proved resilient to international law enforcement crackdowns. Chainalysis estimates that aggregate darknet market crypto flows reached nearly $2.6 billion in 2025, up from about $2 billion the year before. According to SQ Magazine, 68% of all transactions were denominated in XMR, compared to 26% in BTC and 6% in ZEC and DASH combined. 

What is sold on darknet markets?

In March 2013, drugs accounted for 70% of the 10,000 products listed on Silk Road, from prescription medications to opioids to cannabis products. By 2022, the balance had shifted toward stolen data such as user credentials, payment card data and forged identity documents, which made up 65% of listings.

Today, darknet markets mainly feed downstream fraud operations, from account takeovers to synthetic identity fraud. Sellers even offer complete packages of personal data and financial details, pre-bundled for identity theft (“fullz”), and some markets sell fake IDs, passports and driver’s licenses, along with KYC bypass material.

You can also find malware, counterfeit goods, hacking tools and even weapons, although markets differ in what they allow. Aside from using crypto for payments, some markets sell access to crypto exchange accounts and provide crypto mixer and mule services.

Legitimate uses of the dark web

It’s a common misconception that the dark web is populated exclusively by drug dealers and other criminals. In reality, dissidents and journalists also use it to keep personal information private:

• Corporate whistleblowers and political dissidents in oppressive regimes use the dark web to communicate freely and bypass state-mandated internet blocks.
• Investigative journalists access or exchange information via the dark web to protect their sources’ anonymity. The New York Times, for example, runs a SecureDrop tip line so sources and reporters can share sensitive documents safely.
• Some individuals access the dark web to check whether their own personal data has been leaked and possibly buy it back.

Crackdown operations in 2026

Law enforcement had several notable successes in 2026, but they targeted different parts of the ecosystem. Some operations shut down fraudulent dark web sites or drug suppliers. Others disrupted the malware and cybercrime services used by criminal groups. Together, they show how investigations can reach beyond a single marketplace to the people, funds and infrastructure supporting it.

Operation Jackal IV

Between November 2025 and June 2026, Interpol coordinated a multi-continent sweep targeting West African organized crime groups, some of which bought cybercrime-as-a-service (CaaS) tools on the dark web. The operation resulted in 58 arrests and 263 identified suspects.

Operation Alice

In March, German authorities and Europol launched a global operation against Alice with Violence CP, one of the largest networks of fraudulent darknet marketplaces. Its operator, a 35-year-old man based in China, ran over 373,000 onion websites advertising child sexual abuse material and CaaS offerings. None of the services or packages were ever delivered, and roughly 10,000 users were scammed out of Bitcoin.

The operation, which initially targeted the platform operator, involved 23 countries and eventually identified 440 of its customers, against whom further investigations were launched. Law enforcement shut down 105 associated servers and seized electronic devices.

Operation Endgame

In June 2026, Europol coordinated a joint operation with law enforcement in the Netherlands, Canada, the US and Germany targeting three malware tools: SocGholish, Amadey and StealC. Nearly 15,000 compromised websites were cleaned, 142 illicit domains were taken down and 27 million stolen credentials were recovered. Officials also identified illegally obtained crypto worth €41 million and flagged it to restrict its use.

Project Ghostwire

In September 2026, Canadian authorities dismantled one of the country’s most prolific dark web drug suppliers, the “Icy White North” network. Toronto’s York Regional Police charged five people and seized roughly $3 million in illicit drugs, $200,000 in cryptocurrency, a similar amount in cash and over $1 million in proceeds of crime.

What makes darknet markets resilient? 

Darknet markets are difficult to eliminate because shutting down a platform doesn't necessarily eliminate the people or demand behind it. Vendors can move to other markets, while buyers seek out familiar sellers or new platforms. Established vendor reputations can also help sellers rebuild their customer base elsewhere.

But resilience doesn't mean immunity from law enforcement. Silk Road was shut down in 2013 after investigators traced leads to its operator, Ross Ulbricht, identified a leak that exposed the market server's IP address, and gathered evidence through undercover purchases and digital forensics.

The structure of darknet markets can make the wider ecosystem harder to dismantle. Vendors, buyers and administrators may operate independently, so taking down one site can disrupt trade without ending it altogether. Onion services conceal server locations when properly configured, but they do not prevent every technical exposure or investigation.

Crypto's changing role

Darknet markets combine familiar online shopping features with privacy tools and cryptocurrency payments. But crypto's role is changing. Bitcoin's public ledger gives investigators a way to trace transactions, while privacy coins such as Monero offer a different level of transaction privacy. The 2026 crackdowns show that authorities can disrupt both marketplaces and the infrastructure supporting them, even as the methods used to move money continue to evolve.