US Treasury Sanctions Iranian National for Operating Darknet Market Nemesis

Today, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced sanctions on Behrouz Parsarad, an Iranian national identified as the sole administrator of Nemesis, a darknet marketplace involved in the global distribution of illegal drugs, including fentanyl. This action underscores the US government's commitment to combating the proliferation of synthetic opioids and disrupting platforms that facilitate illicit trade. As part of the sanctions, OFAC added 49 cryptocurrency addresses—44 Bitcoin and 5 Monero—associated with Parsarad, targeting the financial infrastructure that supported his criminal enterprise.

Nemesis Darknet Marketplace

Established in 2021, Nemesis quickly became a major darknet marketplace, an encrypted platform accessible only through specialized browsers. The marketplace catered to narcotics traffickers and cybercriminals, offering a wide array of illicit goods and services. While its primary business was drug trafficking—including fentanyl in both its pure form and as a laced component in other substances—Nemesis also facilitated the sale of false identification documents and hacking tools, enabling cybercriminals to hijack victims' online accounts and communications.

By 2024, Nemesis had grown to over 150,000 registered users and more than 1,100 sellers, generating tens of millions of dollars in illicit transactions. The marketplace relied on cryptocurrency payments, primarily in Bitcoin and Monero, to facilitate anonymous transactions. Despite attempts to conceal these financial flows, investigators were able to trace and target the digital currency infrastructure associated with Nemesis, leading to today’s Treasury sanctions.

According to TRM, and consistent with today’s OFAC designation, there are clear on-chain links between Nemesis and Chinese drug precursor manufacturers with funds being sent directly from Nemesis vendors to Chinese DPMs.

‍Role of Behrouz Parsarad

Operating from Iran, Parsarad was the mastermind behind Nemesis, overseeing its infrastructure and maintaining full control over its virtual currency wallets. He profited from the marketplace’s operations by charging transaction fees, amassing millions of dollars in proceeds. In addition to managing the platform, Parsarad also engaged in laundering virtual currencies on behalf of narcotics traffickers and cybercriminals who used Nemesis. Even after the platform’s shutdown in 2024, he attempted to re-establish a similar marketplace by reaching out to former vendors, signaling his ongoing involvement in illicit online trade.

Law Enforcement Actions

On March 20, 2024, a coordinated effort by US, German, and Lithuanian law enforcement agencies led to the seizure of Nemesis' servers, effectively dismantling the marketplace. As part of the operation, authorities confiscated approximately €94,000 (around USD 102,000) in cryptocurrency assets linked to Nemesis. However, despite the marketplace’s closure, Parsarad sought to revive operations, prompting OFAC’s action today to cut off his access to financial networks.

The Evolution of Darknet Marketplaces in 2024

The sanctions against Parsarad and the takedown of Nemesis are part of a broader global crackdown on darknet marketplaces. The Treasury Department has previously sanctioned other major darknet platforms, including Genesis Market in April 2023 and Hydra Market in April 2022. According to Treasury’s Financial Crimes Enforcement Network (FinCEN), darknet marketplaces continue to play a crucial role in the sale of precursor chemicals and manufacturing equipment used to synthesize fentanyl and other synthetic opioids, as well as trafficking these drugs into the United States.

Despite these enforcement actions, darknet marketplaces, according to TRM Labs 2025 Crypto Crime Report, remained resilient in 2024, generating over USD 1.7 billion in revenue—a slight increase from the previous year. According to TRM, Russian-language darknet marketplaces continued to dominate the ecosystem, accounting for more than 97% of illicit drug sales facilitated via cryptocurrency, primarily in Bitcoin and TRON. This marked an increase of over 1% from 2023, further solidifying their dominance in the darknet economy.

Russian-Language Darknet Markets: Thriving Under Protection

The continued success of Russian-language darknet markets, according to TRM, is largely due to the low risk of enforcement action from Russian authorities. Unlike Western platforms, these marketplaces rely on a dead drop-based delivery model, where buyers collect drugs from hidden locations rather than relying on traditional shipping services. Additionally, the focus on synthetic drugs, such as alpha-PVP and mephedrone, which can be produced locally, reduces reliance on international trafficking networks. The availability of precursor chemicals, primarily sourced from China, further supports the expansion of these markets.

The Russian darknet ecosystem remained stable throughout 2024, with only four out of approximately 20 marketplaces ceasing operations. The closure of Solaris Market in autumn 2024 was a rare exception, as Russian-language marketplaces typically avoid abrupt exit scams, a common issue in Western DNMs. Instead, administrators often voluntarily shut down operations and allow users to withdraw their funds, fostering a sense of stability and trust within the community. Since the takedown of Hydra Market in April 2022, no major Russian-language darknet platforms have been successfully targeted by law enforcement, allowing these operations to continue largely unchallenged.

Western Darknet Marketplaces: Struggling Under Pressure

In contrast, Western darknet marketplaces faced a tumultuous 2024, marked by law enforcement crackdowns and high-profile exit scams. These challenges severely eroded user confidence, stagnating the ecosystem’s growth and creating a climate of distrust reminiscent of previous enforcement waves, such as Operation Onymous in 2014, which dismantled Silk Road 2.0, and Operation Bayonet in 2017, which targeted AlphaBay and Hansa Market.

Early 2024 saw several major exit scams in the Western darknet market scene. Bohemia Market and Cannabia Market disappeared in January under suspicious circumstances, later revealed by Dutch authorities to be part of an ongoing investigation. In March, Incognito Market collapsed in an unprecedented exit scam, where its administrator, known as "Pharoah," attempted to extort users before shutting down. This individual, later identified as 23-year-old Taiwanese national Rui-Siang Lin, was arrested in May 2024.

Compounding these setbacks, Nemesis Market was seized by German law enforcement in March 2024, further weakening the Western darknet ecosystem. Additional shutdowns followed, including Cypher Market in April and GoFish Market in September, both of which were once considered trusted marketplaces.

Innovation Amidst Turmoil

Despite these challenges, 2024 also saw notable innovations in the Western darknet market ecosystem. One of the most significant developments was the first-ever merger and acquisition between two darknet marketplaces—SuperMarket, a struggling platform, was absorbed by DrugHub in a month-long integration process.

Additionally, a new operational model emerged with Si Market, the first Telegram-only Western darknet marketplace. By the end of 2024, Si Market had grown to host over 40 vendors specializing in psychedelics, cannabis, and cannabis-related products, signaling a potential shift in how illicit markets operate as they seek to evade law enforcement.

The Future of Darknet Marketplaces

While Western darknet marketplaces struggled under increased enforcement and operational instability, Russian-language platforms continued to thrive, consolidating their control over illicit drug sales in the cryptocurrency space.

With law enforcement agencies intensifying their efforts to dismantle these markets, the darknet landscape is evolving. New strategies, including alternative delivery methods and the rise of encrypted messaging-based marketplaces, may shape the next phase of illicit online trade. The crackdown on Nemesis and the sanctions against Behrouz Parsarad highlight the critical role of financial tracking in disrupting darknet operations, but the continued adaptation of these markets suggests that enforcement efforts will need to evolve just as rapidly.