Darknet marketplaces remain central to illicit trade in 2025, with evolving business models, payment systems, and law enforcement responses. This survey highlights active and recently shuttered markets with actionable metrics and intelligence for threat hunters, CISOs, and red team leaders.
Active Marketplaces in 2025
Abacus Market was launched in 2021 and now lists over 40,000 illicit goods, including hacking tools, counterfeit documents, and listings for drugs. In 2024, it recorded on-chain revenue of $43.3 million, a 183 per cent increase, driven by vendor migrations post-shutdown of competitors, according to Chainalysis’ 2023 market report Darknet revenue in 2023.
Russian Market has operated since 2019, specialising in stolen credentials, stealer logs, and remote desktop access. Threat reports consistently rank it among the top ten darknet sites Top 10 Dark Web Markets.
BriansClub remains a long-standing credit card data shop since at least 2014. Despite a 2019 breach that exposed over 26 million credit cards, it continues to operate, indicating sustained trust in its data pipelines.
Exodus Marketplace emerged in early 2024 as a successor to Genesis Market, focusing on malware-harvested device logs. It reportedly controls around 7,000 infected endpoints across 190 countries Top 10 Dark Web Markets.
Payment Methods Overview
In 2025, darknet marketplaces primarily accept Monero (XMR) and Bitcoin (BTC). Privacy-focused operators are shifting to Monero due to its default anonymity, compared to Bitcoin’s transparent ledger Darknet markets see BTC inflow drop to $2B.
Monero’s ring signatures, stealth addresses, and RingCT obfuscate transaction details—enhancing privacy and hindering traceability The Rise of Monero. Sites such as Abacus and Russian Market accept both currencies to broaden their appeal. Exclusive Monero usage signals a heightened prioritisation of anonymity.
Shuttered Markets and Lessons
Archetyp Market was dismantled in June 2025 during Operation Deep Sentinel in a coordinated raid across six countries. At the time, it had over 600,000 users, 17,000 listings, and approximately €250 million in transactions. Authorities seized €7.8 million and arrested operators in Germany, Spain, Sweden, Romania, the Netherlands, and the US Europol leads takedown of Archetyp.
BidenCash and other exit-scam markets such as Torzon and Kingdom Market collapsed between 2022 and 2024. They used “free data dumps” and emotional marketing to build trust before vanishing—an enduring lesson in the risks of social engineering.
Niche Trends and Ecosystem Shifts
Markets are increasingly adopting stricter trust mechanisms. Abacus enforces PGP messaging and vendor reviews, while Exodus relies on invite-only access and bot reliability checks. Specialisation by vertical continues: The Russian Market focuses solely on stolen data, while Abacus maintains diversified listings. These trends support more granular intelligence gathering.
Metrics That Matter
Chainalysis data shows darknet marketplace revenue dropped post-Hydra seizure in 2022 but recovered to $2 billion in Bitcoin inflows during 2024 Darknet market BTC inflow drop and shift to Monero. Abacus alone represented nearly 5 per cent of total DNM revenue, underscoring the ongoing scale of underground commerce.
Implications for Security Leaders
Monitoring active marketplaces offers early access to malware kits, credential dumps, and fraud tools. Tracking vendor migration—such as from Archetyp to Exodus—provides insight into tactical shifts. Focusing intelligence collection on specialised marketplaces yields better ROI for threat detection and proactive defence.
Conclusion
Darknet marketplaces in 2025 illustrate a resilient and evolving underground economy. Major active platforms include Abacus, Russian Market, BriansClub, and Exodus. Law enforcement takedowns, such as Archetyp, demonstrate both impact and adversary adaptation. For cybersecurity professionals, focusing on payment methods, vendor migration, and marketplace specialisation offers the most effective path to actionable intelligence.