Editor’s note: The following post is the last in our series breaking down our 2025 Crypto Crime Report. Check out all of the posts in this series here:
- Overall 2024 figures and declining illicit crypto volume on TRON
- Sanctioned entities continued to drive illicit crypto volume in 2024
- Use of crypto in terrorist financing expanded in 2024
- Ransomware demands reached an all-time high in 2024
- $2.2 billion was stolen in crypto-related hacks in 2024
To read the 2025 Crypto Crime Report in full and download your copy, click here.
Cryptocurrency-enabled online sales of illicit drugs saw a year-on-year growth of over 19% between 2023 and 2024, nearing USD 2.4 billion.
2024 saw 42% fewer new darknet marketplaces (DNMs) launched year over year, with the proportion of Monero-only DNMs launched increasing from little more than a third in 2023 to nearly half in 2024.
Drug sales are continuing to move to encrypted chat and social media platforms in the West
Over the last year, the online illicit drug trade has continued to decentralize away from darknet markets and towards encrypted chat and social media platforms. This trend, already prevalent in Western communities, has been increasingly seen in the Russian-language ecosystem as well.
Vendors today are choosing to establish vendor shops and engage in direct deals through a diverse array of encrypted communication applications and email. These platforms allow vendors to reach customers who are less technologically savvy, whilst also mitigating against market turbulence caused by darknet market exit scams or law enforcement takedowns. In this respect, the use of encrypted communication apps like Telegram and Signal have reduced the barriers to access for drug buyers to purchase products online, whilst also reducing fees that vendors pay to darknet markets for sales. This migration is further bolstered by the fact that the majority of new Western DNMs launched in 2024 have been characterized by poor design features or security issues.
The reduction in the quality and user numbers of Western DNMs stands in contrast to the Russian-language ecosystem, where fierce competition and high profits are driving innovation. Russian darknet market admins are now experimenting with developments including artificial intelligence-facilitated dispute resolution, closer integration with encrypted communication applications, incentive programs, harm reduction, UX customization, and aggressive marketing campaigns across digital and physical spaces.
Russian language darknet marketplaces continue to drive overall volume of illicit drug sales
Despite the many challenges faced by darknet marketplaces over the course of 2024, these platforms have nevertheless seen a slight increase of income compared to 2023, generating more than USD 1.7 billion.
Keeping to the trend witnessed in 2023, Russian-language darknet marketplaces continue to be responsible for the vast majority of revenue generated, contributing over 97% to the overall volume of illicit drug sales (up more than 1% from 2023) in bitcoin and TRON.
The lower threat of action from Russian law enforcement — coupled with the dead drop-based delivery model (read more here), focus on synthetic drugs (such as alpha-PVP and mephedrone, which can be produced locally), and the wide availability and low price of drug precursor chemicals typically imported from China — have enabled Russian-language darknet marketplaces to thrive.
Only four Russian-language DNMs left the approximately 20-strong ecosystem in 2024. The departure of market leaders such as Solaris Market — which ceased operations in autumn 2024 — is a rare occurrence. And while there have been no more successful law enforcement takedowns of Russian-language DNMs since the fall of Hydra Market in April 2022, the administrators of these platforms also avoid exit scams (typical of the Western DNM ecosystem), preferring instead to voluntarily cease operations and allow all users to withdraw their funds from the marketplace escrow.
Western darknet marketplaces struggled under sustained law enforcement action and exit scams
In contrast to Russian-language DNMs, Western darknet marketplaces continued to struggle throughout 2024 as a result of sustained law enforcement action, coupled with several high profile exit scams.
This has curtailed user confidence and stunted the ecosystem's growth, creating a climate of distrust that is reminiscent of the aftermath of Op. Onymous (the law enforcement takedown of the Silk Road 2.0 darknet marketplace together with a host of smaller DNMs in 2014) and Op. Bayonet/GraveSac (the coordinated takedown of the AlphaBay and Hansa Market darknet marketplaces by US and European law enforcement in 2017), which left the Western DNM ecosystem reeling.
After the disappearance of Bohemia Market (a prolific Western DNM) and Cannabia Market (its sister market) in a suspected exit scam in January 2024 (later revealed by the Dutch authorities to have been under investigation), the community witnessed the exit scam of Incognito Market in March 2024. This incident also marked the never-before-seen attempt of its administrator, Pharoah (arrested in May 2024 and revealed to be 23 year-old Taiwanese national Rui-Siang Lin), to extort the marketplace’s users.
This crisis was further compounded by the seizure of Nemesis Market by German law enforcement in March 2024, as well as the exits of other important and trusted players including Cypher Market (which disappeared in April 2024) and GoFish Market (September 2024), which had even been included in the Superlist of marketplaces trusted by the community.
Nevertheless, the Western DNM ecosystem experienced some innovation in spite of recent enforcement actions. Amongst the most notable was the first merger and acquisition between two marketplaces on the darknet — whereby the struggling SuperMarket was absorbed by the now-Superlisted DrugHub in an operation that lasted around one month. 2024 also saw the establishment of the first Telegram-only Western darknet marketplace, Si Market, which now hosts more than 40 vendors specializing in the sale of psychedelics, cannabis, and cannabis-related products.
The use of crypto in vendor shop drug sales surged in 2024
The use of cryptocurrency in vendor shop drug sales saw a significant surge over the past year. TRM Labs is the only blockchain intelligence provider with a specialist category unique to individual drug vendors — and this year, we saw incoming volumes sent to illicit vendor shops more than double. In 2023, these addresses received over USD 289 million. In 2024, this figure skyrocketed to over USD 600 million. This dramatic increase may reflect the decentralization of the drug trade away from traditional darknet markets, as vendors grow more adept at operating across multiple platforms on both the clearnet and darknet — including e-commerce websites and social media platforms.
Arrest of Telegram founder sparks platform migrations for drug vendors
The arrest of Telegram’s founder, Pavel Durov, in August 2024 triggered a notable shift in the operational dynamics of the platform's drug vendors.
Historically, Telegram has been a favored platform for selling drugs — due to its security and public perception of non-cooperation with law enforcement, as well as strict access controls for groups and channels. However, Durov's arrest has heightened fears that Telegram will now provide data on its users to law enforcement. Consequently, many vendors are migrating to alternative platforms, including Signal, Session, and WhatsApp. This exodus is expected to continue as Telegram enforces stricter measures to curtail criminal activities on its network and provide new opportunities for interdiction.
Chinese drug precursor manufacturers are adapting to intensified law enforcement efforts
Incoming crypto volumes to Chinese drug precursor manufacturers have seen a significant decline, from USD 27.6 million in 2023 to USD 17.0 million in 2024. This drop may be driven in part by stronger actions from the Chinese government following the Biden-Xi summit of November 2023. The summit resulted in the Chinese Communist Party (CCP) banning a range of fentanyl precursors and shutting down some suppliers, followed by a further ban of several nitazenes and analogs in July 2024. As a result, drug precursor manufacturers have begun to shift to new analogs and substances, while adopting alternative methods to cryptocurrency to obscure their financial footprints.
TRM has observed that these manufacturers have adapted their practices in response to intensified law enforcement efforts. Specifically, these manufacturers are becoming increasingly cautious about sharing cryptocurrency addresses in direct communications with buyers. This shift stems from the demonstrated efficacy of blockchain analysis in tracing illicit transactions and aiding investigations.
Looking ahead
The evolving landscape of crypto crime in 2024 highlights a complex interplay between advancing security measures and increasingly adaptive illicit actors. While efforts to curb illegal activities have shown promising results, threat actors continue to innovate — exploiting vulnerabilities within decentralized finance, blockchain infrastructure, and emerging technologies.
A key theme throughout the year has been the resilience and adaptability of illicit networks. Sanctioned entities, terrorist organizations, and ransomware groups have shifted tactics in response to global crackdowns, embracing new technologies and methods to obscure their activities. This adaptability underscores the need for constant evolution in enforcement strategies and international cooperation.
The expanding use of cryptocurrencies by terrorist organizations and state-sponsored actors illustrates the dual-edged nature of technological innovations — providing both opportunity and risk. Ransomware actors and fraudsters are leveraging technological advancements, including cross-chain bridges and artificial intelligence, to bypass detection and scale their operations.
And the fragmentation of illicit markets, particularly in drug sales, signals a shift toward decentralization — with criminal enterprises moving away from traditional darknet marketplaces toward more agile and resilient platforms. This shift presents both new challenges and opportunities for disruption.
Ultimately, the fight against crypto crime requires a proactive, collaborative approach. Regulatory bodies, law enforcement agencies, and private sector partners must continue to adapt, innovate, and cooperate to outpace increasingly sophisticated threat actors. Central to this effort is the use of advanced blockchain intelligence tools, which provide critical insights for tracing illicit transactions, identifying threat actors, and supporting enforcement actions. The progress made in disrupting illicit networks demonstrates the impact of collective action, but sustained vigilance and adaptability — empowered by cutting-edge blockchain analytics — will be essential to securing the crypto ecosystem in the years ahead.
Get your copy of the complete 2025 Crypto Crime Report here.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
