This week, the US Department of Justice announced the unsealing of a federal indictment against Iranian national Behrouz Parsarad, the alleged architect behind the now-defunct Nemesis Market. The indictment—paired with previously announced sanctions by the US Treasury’s Office of Foreign Assets Control (OFAC)—offers a look inside the sprawling darknet drug marketplace that processed over 400,000 illicit transactions between 2021 and 2024. More than 55,000 of those orders involved powerful stimulants like methamphetamine and cocaine, while an additional 17,000 involved opioids such as heroin and fentanyl—drugs central to the opioid epidemic devastating U.S. communities.
Parsarad is accused of overseeing the platform's rise into one of the world’s largest darknet marketplaces, amassing more than 150,000 users and 1,100 vendor accounts. Nemesis operated primarily on Tor, offering a menu of contraband that extended from counterfeit documents and hacking tools to narcotics in their most dangerous forms. Parsarad also allegedly provided laundering services for vendors by using mixing protocols and retained a cut of all transactions processed through Nemesis.
OFAC sanctioned Parsarad in March 2025, describing him as the marketplace’s sole administrator and noting he had communicated with vendors about relaunching a successor platform. OFAC’s designation also included 49 cryptocurrency addresses—44 in Bitcoin and 5 in Monero—associated with Parsarad, striking at the financial infrastructure that sustained his operations. The Treasury action followed Nemesis’s dismantlement in March 2024, when a coordinated law enforcement operation led by US, German, and Lithuanian authorities seized its servers and approximately €94,000 (about USD 102,000) in cryptocurrency.
“While one person can register infrastructure or oversee a platform’s setup, a darknet marketplace of Nemesis’s size typically requires a broader operational team,” according to Ari Redbord, TRM’s Global Head of Policy when asked by Decrypt if Parsarad likely acted alone.
Redbord explained that collaborators may have included administrators, moderators, escrow agents, technical developers and “money laundering facilitators.” He added, “As seen in prior takedowns (e.g., AlphaBay or Hydra), these platforms often involve distributed teams with clearly defined roles to ensure uptime, user trust, dispute resolution, and secure cash-out mechanisms.”
According to TRM Labs, there are clear on-chain links between Nemesis and Chinese drug precursor manufacturers, with funds sent directly from vendors to Chinese suppliers—demonstrating the nexus between crypto-fueled drug trafficking and global supply chains.
At TRM, darknet marketplaces are defined narrowly as platforms focused specifically on drug trafficking, such as the now-defunct Silk Road. This is an important distinction. Other entities that operate on the darknet but deal in malware or stolen credentials are categorized separately as cybercrime platforms—not as DNMs. This clarity allows for more targeted threat analysis and policy response.
TRM currently assesses that between 20 and 30 significant drug-focused DNMs are active at any given time—a number that has remained remarkably consistent over the past several years. Their longevity is generally short-lived, with most platforms shuttering or collapsing within two to three years due to law enforcement pressure, market volatility, or internal instability.
These DNMs exist across two primary ecosystems: a Russian-language ecosystem built around dead-drop delivery, and a Western ecosystem that relies on postal systems for drug distribution. The Russian-language markets—led by platforms such as Blacksprut and Kraken—are far more dominant, technologically advanced, and resilient. They benefit from limited domestic enforcement risk and a domestic supply of synthetic drugs and precursors, mostly sourced from China.
According to TRM’s 2025 Crypto Crime Report, Russian-language DNMs accounted for over 97% of global drug trafficking volume via crypto in 2024. These platforms have become deeply embedded in regional drug economies and remain relatively unchallenged since the takedown of Hydra in 2022.
By contrast, Western darknet markets faced severe headwinds in 2024—high-profile exit scams, shutdowns, and arrests destabilized the ecosystem. Markets like Bohemia, Incognito, and GoFish vanished under suspicious circumstances. One administrator, later identified as a 23-year-old Taiwanese national, was arrested in May 2024. Nemesis itself was seized by German authorities in March. Even in the face of disruption, new models are emerging, including Telegram-based platforms like Si Market and a first-of-its-kind darknet M&A between SuperMarket and DrugHub.
While innovation persists, the sanctions and indictment of Behrouz Parsarad demonstrate the evolving capabilities of law enforcement and blockchain intelligence in tracking illicit finance and disrupting the criminal infrastructure behind darknet drug trade. According to TRM Labs, operating a platform like Nemesis isn’t a one-man job—it requires a distributed network of developers, moderators, escrow agents, and money laundering facilitators. These actors rely on anonymity and fragmentation to operate, but even in the anonymized corners of the internet, there are digital footprints.
Parsarad’s indictment is not just the story of one marketplace’s demise—it is a signal that even in hostile jurisdictions and decentralized systems, there remains a path to accountability. It also underscores the critical role of blockchain intelligence in mapping threat networks, tracing illicit funds across borders, and giving investigators the tools they need to protect communities from the growing threat of synthetic opioids.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
