Eight Months After Hydra Shutdown, New Russian-language Darknet Markets Are Filling the Void

TRM research shows that darknet markets (DNMs) have bounced back following the shutdown of Hydra, the world’s largest such marketplace, by German law enforcement in April 2022.

Also known as cryptomarkets, DNMs are multi-vendor online illicit global commerce platforms that mainly specialize in the sale of illicit drugs. An established form of transnational organized crime, DNMs combine anonymisation networks and cryptocurrencies with encryption technologies. They are distinct from independent single-vendor shops that also sell illicit drugs, and from other types of fraud stores.

The vacuum left by Hydra's takedown resulted in a veritable "Cambrian explosion" in DNMs, with at least a dozen illicit projects having surfaced in its place to meet user demand. Serving countries of the former Soviet Union, these new Russian-language DNMs have achieved near-dominance of the overall DNM ecosystem, representing over 80% of all deposits made to darknet marketplaces in 2022.

Despite Hydra’s historically large volumes – the marketplace received more than $400 million between January 2022 and its demise in April (detailed here) – the new generation of DNMs has caught up quickly. Following Hydra's seizure, the twelve new Russian-language marketplaces amassed approximately 24% more volume in a period of five months than Hydra did in the first five months of the year when it was still live.

And although there are at least 70 active DNMs globally as of November 2022, approximately 80% of market share is split between just four players. Notably, all form part of the new wave of Russian-language DNMs. By contrast, the largest western bitcoin DNM currently in existence – ASAP Market – accounts for less than 10% of global DNM market share.

The particularities of DNMs operating in the former Soviet Union means there is little interplay between them and western/global darknet marketplaces. Each has different target audiences, vendors, modus operandi, and characteristics. 

Four Key Differences Between Russian-language and Western DNMs:

1) Russian-language DNM vendors favour the dead-drop delivery model dubbed klad/клад (Russian for “treasure”), as opposed to the international mail delivery model adopted by western DNMs. This restricts the former to the geographic areas covered by the vendors and couriers. These can serve areas ranging from local neighborhoods to entire cities and regions, but most importantly, the vendors’ reach is not international.

2) DNMs operating in former Soviet countries generally employ fewer on-chain operational security measures. Address re-use is rife, as DNM actors in this space appear to operate with more impunity and less concern for law enforcement action than their western counterparts.

3) Most Russian-language DNMs only support Bitcoin, with no privacy coin options available. This also appears to reflect their lower perceived risk of being taken down by the authorities. By contrast, western DNMs offer Monero alongside Bitcoin or are Monero-only. 

4) Russian-language DNMs seek to establish monopolies, something most western DNMs largely avoid due to the resulting pressure, attention, and risk of law enforcement action that such dominance could bring.

Three Future Trends to Watch:

1. The Russian-language DNM space is preparing for the inauguration of the widely-anticipated Kraken Market, touted by the community as Hydra Market’s successor. Several marketplaces operating in the former Soviet Union could disappear as vendors and buyers establish themselves on this new DNM, resulting in a greater centralization of marketplaces in this region.

2. The widely-mooted DNM decentralization is unlikely to materialize over the short term. The familiar cycle of DNM launch and growth followed by exit scams, law enforcement action, or voluntary withdrawal is likely to continue in 2023.

3. Western DNMs will continue to innovate and spearhead blockchain operational security, including the possibility to forgo Bitcoin and other public ledger blockchains altogether. For instance, AlphaBay Market’s second iteration – which claims to be the world’s largest DNM – is a Monero-only marketplace.

About TRM Labs

TRM provides blockchain intelligence to help financial institutions, cryptocurrency businesses, and public agencies detect, investigate, and manage cryptocurrency-related fraud and financial crime. TRM's risk management platform includes solutions for transaction monitoring and wallet screening, entity risk scoring - including VASP due diligence - and source and destination of funds tracing. These tools enable a rapidly growing cohort of organizations around the world to safely embrace cryptocurrency-related transactions, products, and partnerships.

‍