Cryptocurrency Usage in Dark Web and Underground Markets: Cryptovest Investigates

In the first part of our investigation into the dark web, we scanned online markets to find which cryptocurrencies are most popular for which kind of seller.

Though the cryptocurrency world has been thoroughly studied, those studies have mostly focused on the run-of-the-mill “white” markets where people go to buy everything from shoes to graphics cards. It’s time that we finally had a comprehensive study of the deeper, darker reaches of the internet, where some of the most cloaked individuals hang out and sell things that make people cringe.

This is the first part of Cryptovest’s investigation into dark web markets. In this section, we will run down which cryptocurrencies are the most popular in particular categories within the markets they appear, as well as a run-down of what we believe are the methods that vendors use to conceal their identities based on the conclusions we have drawn.

The investigation was carried out over four months to ensure the quality of our results and to accounts for variations of changing perceptions regarding particular cryptocurrencies.

Our sample of 7,193 offers from one of the marketplaces we scanned through was categorized and subcategorized through 10 different types of markets. Our second sample of 129,878 came from a more generic marketplace that dealt mostly with drugs and digital goods such as mass data dumps, data on high-profile individuals, tools for fraud, various hacking tools, account dumps, and other such materials.

These two marketplaces bring the sum of our investigation to a sample size of 137,071 subjects and their offers. This is, as far as we know, the largest public investigation of dark web markets in history.

Our exclusions

For the sake of the dignity of the individuals exploited in this market, and to avoid giving any sort of information that could encourage the propagation of activities involving human trafficking, we decided to exclude results that include any of this sort of activity from our report.

Instead, we decided to perform our civic duty and inform the relevant authorities of these activities and offer our full cooperation with the FBI, Interpol, and Europol in tracking down what we firmly and unequivocally believe to be disgusting and deplorable acts.

Our analysis of the first marketplace

In our investigation, we tracked down a marketplace in which merchants offered a variety of products in a wide range of categories. Its neat styling simplified the process of categorizing and spotting whether merchants would prefer Bitcoin or a privacy coin in their listings.

It bears mentioning at this point that although the marketplace in question allowed vendors to accept Monero exclusively, we came across no one who did. Everyone either accepted Bitcoin exclusively or both cryptocurrencies.

In total, we found 7,193 offers in this underground marketplace from various merchants, with no bias towards accepting Bitcoin exclusively. A full survey of all offers shows that 3,654 (50.8%) were Bitcoin-biased and 3,539 (49.2%) included Monero.

Breaking down these offers into their respective categories reveals more interesting information.

A first look: Scams

One of the first things we noticed in this marketplace—and other marketplaces we browsed but chose not to include in this report due to their unreliability and lack of credible merchants—is that there are many scammers attempting to sell self-published “get-rich-quick” videos or books.

Among them, we found examples like one MrMillionaire, who kept selling his own videos for just under $1,000 with the promise of helping any buyers achieve over $100,000 per day after making a minimum of effort. Here’s one such message in one of his listings:

In the end, MrMillionaire’s listing turned out to be an offer for tutorial videos about binary options, something looked down upon in most of the developed world as an extraordinarily risky gamble. Most of these scams and schemes sell products for prices ranging from $10 to thousands of dollars.

We identified 106 such scams in the marketplace we were looking into and found that 57 of them (53.77%) accepted Bitcoin and the other 49 (46.22%) accepted both Bitcoin and Monero.

Analyzing the drug market

By far the largest market in the dark web is for drugs, particularly cannabis. This marketplace was no exception.

We found a total of 5,405 offers for drugs, with the lion’s share (1,624) being for cannabis and cannabis-related products. Out of all these offers, 921 of them (56.71%) accepted Bitcoin and 703 of them (43.28%) accepted both BTC and XMR.

The rest of the drug offers on the market were as follows:

  • MDMA (Ecstasy):
    • Total Offers: 199
    • Bitcoin: 112 (56.28%)
    • Bitcoin/Monero: 87 (43.71%)
  • Steroids:
    • Total offers: 582
    • Bitcoin: 226 (38.83%)
    • Bitcoin/Monero: 357 (61.34%)
  • Benzos (Xanax, Valium, etc.):
    • Total offers: 371
    • Bitcoin: 198 (53.36%)
    • Bitcoin/Monero: 173 (46.63%)
  • Other pharmaceuticals:
    • Total offers: 611
    • Bitcoin: 358 (58.59%)
    • Bitcoin/Monero: 253 (41.41%)
  • Other:
    • Total offers: 2,017
    • Bitcoin: 1,219 (60.44%)
    • Bitcoin/Monero: 798 (39.56%)

Interestingly, and with no explanation immediately coming to mind, people selling steroids were more biased towards privacy coins, with over 60% of vendor offers accepting Monero. The rest of the drug market was biased towards Bitcoin, perhaps due to its widespread use in “white” markets.

A look at other markets

The offers in other market segments, though broken down into categories in the marketplace we found, were smaller in number than drug offers. Because of this, we decided to avoid getting into excessive detail and just collected our data on the broad categories, which include malware, fraud, and counterfeits.

The counterfeit market, which included clothing, electronics, jewelry, cash, fake IDs, and other items of a similar nature, was extremely biased towards Bitcoin. Out of 293 total offers, there were 233 (79.52%) that accepted Bitcoin exclusively and 60 (20.48%) that also accepted Monero.

In the malware market, we found the reverse. Of the 399 offers available, we found that 357 of them (89.47%) included Monero and only 42 (10.53%) accepted Bitcoin exclusively.

Fraud markets, which included accounts, credit cards, fake documents, credential dumps, and other items of a similar nature, were not as biased towards Monero as the malware markets were, but still had a pronounced inclination to accept the privacy coin. Of 990 available offers, we found only 288 (29.09%) that accepted Bitcoin exclusively while 702 (70.91%) of them included Monero.

The larger marketplace

In our search, we found out about a far larger marketplace, sprawling with a whopping 129,878 offers for what mostly amounted to drugs and digital goods. This particular market dealt with vendors who accepted either Bitcoin exclusively or Bitcoin and Bitcoin Cash.

In every market segment we analyzed, we spotted a strong bias towards including both cryptocurrencies. Of the total, 27,678 (21.31%) offers were Bitcoin-biased while 102,200 (78.69%) included Bitcoin Cash.

Because this particular marketplace tended to be chaotic, with several offers outside of their own respective subcategories, we decided to analyze our results by splitting them into drugs and digital goods.

In the drug market, we found a total of 70,660 offers with 22,073 (31.24%) of them biased towards Bitcoin and 48,587 (68.76%) including Bitcoin Cash.

The digital goods market was far more biased towards accepting Bitcoin Cash. Out of 59,218 offers, we found only 5,605 (9.47%) exclusive towards Bitcoin and 53,613 (90.53%) inclusive of Bitcoin Cash.

The greater conclusion

It’s noteworthy that Bitcoin continues to be the currency of trade in underground markets, despite it not being an ideal coin with which to perform anonymous transactions that would give authorities trouble identifying buyers and sellers.

Over the four months that we spent looking at these sites, communicating with vendors, and gathering information on cryptocurrency trends, we did not notice any changes over time in how these trends played out. Namely, the proportion of individuals accepting a particular cryptocurrency or another remained thoroughly consistent during the period in which we conducted our investigation.

We wanted to account for changes in cryptocurrency trends, but as things are, our study went on for an insufficient amount of time for us to draw better conclusions about how perceptions change among illicit vendors. Perhaps a longer investigation, with periodic monitoring spanning over a few years, would shed more light on how people change their habits.

Although the pervasive use of Bitcoin in dark web markets may seem to contradict former Europol director Rob Wainwright’s thesis that criminals are no longer focused on Bitcoin, it would be naive to believe that they keep their earnings in the cryptocurrency.

Our theory is that although most people make their final purchases and sales on Bitcoin, they did so by laundering their coins first through a mixing service or privacy coin. We get this belief from the fact that many of the advertisements found in dark web portals advise people to use cryptocurrencies in this manner.                

If Bitcoin were the only cryptocurrency used by criminals, it wouldn’t be so challenging for the authorities to draw the correlations necessary to prosecute individuals who break the law by using dark web marketplaces. The Silk Road marketplace may have come down due to correlations like these, but cryptocurrencies have evolved.

Many of the marketplaces we saw were very transparent in what they were offering. No one used typical slang terms like “Special K” to describe ketamine or “girl scout cookies” to describe cannabis or marijuana.

This transparency reveals that these people are acting with full confidence that they are hidden in plain sight from the authorities, likely because they are behind an onion routing exit node and trading with cryptocurrencies that cannot be traced back to them.

The varying degrees of removal from a personal identity that we find in these marketplaces make recourse more difficult for individuals who are scammed, but also makes the job of institutions like the FBI and Europol more challenging. Both marketplaces we visited were well-hidden and did not require an email address for registration.

In the future, we will publish conversations we had with a few vendors who decided to speak to Cryptovest under the condition of anonymity. This may shed some light into how they manage to hide their trails.