The Darknet's Biggest Criminal Businesses – The 5 Crimes That Keep Coming Back
Aug 10, 2026
When Silk Road appeared in 2011, the darknet was still largely unknown outside a relatively small community.
Today, the situation is completely different.
Markets have come and gone. Forums have disappeared. Administrators have been arrested. Billions of dollars in cryptocurrency have moved through illicit services.
Yet the same types of crime keep returning.
Shut down one market and another appears.
Arrest one group and another takes its place.
So what are people actually doing illegally on the darknet?
Here are five of the biggest areas.
1. Drug Trafficking – Still the Darknet's Biggest Marketplace Business
If there's one crime historically associated with darknet markets, it's drugs.
Cannabis.
Cocaine.
MDMA.
Amphetamine and methamphetamine.
LSD and other psychedelics.
Prescription drugs.
Opioids.
The products change from country to country, but the business model has remained remarkably similar since Silk Road.
A vendor creates a listing. A buyer places an order. Cryptocurrency is used for payment, and the product is usually delivered through the ordinary postal system.
That's the strange part.
The transaction may happen through Tor, but eventually something physical has to leave someone's hands and arrive at someone else's address.
And that's where anonymity starts becoming much more difficult.
Postal inspections, undercover purchases, fingerprints, CCTV, packaging materials and seized computers have all helped investigators identify darknet vendors.
Historically, the dominance of drugs isn't even close in some datasets. A UN study examining nearly 139,000 listings across four major darknet markets found approximately 68% were drug-related. More recent blockchain research still describes illicit drugs as the traditional core business of darknet marketplaces.
The technology has changed.
The basic business hasn't.
2. Stolen Data – Your Identity Has Become a Product
The second economy is less visible but potentially affects far more ordinary people.
Stolen information.
Email credentials.
Passwords.
Payment information.
Personal records.
Compromised accounts.
Corporate credentials.
Instead of stealing money directly, criminals can steal the information needed for somebody else to do it.
Entire underground services exist to sell this material.
And one stolen credential can pass through several different hands.
One criminal steals it.
Another sells it.
Someone else buys it.
And a fourth person may eventually use it for fraud.
Europol's 2025 cybercrime assessment described stolen data as a fundamental commodity powering everything from online fraud to ransomware and extortion.
That's what makes this business different from selling drugs.
The victim may not even realize they've been robbed until months later.
3. Fraud and Scams – The Business That Has Become Industrial
Fraud has always existed online.
What has changed is the scale.
Fake investment schemes.
Phishing.
Impersonation.
Romance scams.
Payment fraud.
Fake cryptocurrency platforms.
Social engineering.
Some operations now function less like groups of criminals and more like companies, complete with managers, call centres, technical departments and money-laundering networks.
And AI is making this easier.
Voice cloning, generated identities and deepfake material can make an ordinary scam considerably more convincing.
The numbers have become enormous. Chainalysis estimates that approximately $17 billion was stolen through cryptocurrency scams and fraud during 2025, with impersonation scams showing particularly rapid growth.
Not all of that activity happens on the darknet—the majority of victims may encounter scammers on the ordinary internet—but darknet forums and underground services can provide stolen identities, compromised accounts and other infrastructure that feeds the wider fraud economy.
The darknet isn't necessarily where the victim gets scammed.
Sometimes it's where the criminal buys the tools.
4. Hacking, Malware and Ransomware Services – Crime for Hire
This is where the underground economy becomes particularly interesting.
You don't necessarily need to be an expert hacker anymore.
Someone else can provide part of the operation.
Underground communities advertise or trade things such as malware, compromised credentials, access to breached systems and other cybercrime services.
That has created a kind of criminal supply chain.
One person finds a vulnerability.
Another gains access.
Another steals information.
Another deploys ransomware.
Another handles extortion.
And someone else launders the proceeds.
Modern ransomware operations can therefore resemble partnerships rather than a single hacker attacking a company.
Europol's latest assessments describe cyber-attacks, online fraud and the infrastructure enabling them as major parts of the contemporary cybercrime landscape.
And when investigators dismantle one service, another often appears.
It's become an ecosystem.
5. Money Laundering and Criminal Financial Services – Following the Money
Every successful criminal business eventually has the same problem.
What do you do with the money?
Stealing $1 million is one thing.
Using that $1 million without attracting attention is something completely different.
That's why underground financial services matter.
Cryptocurrency exchangers, laundering networks and other intermediaries can be used to move criminal proceeds between wallets, currencies and jurisdictions.
Ironically, cryptocurrency has also become one of law enforcement's most useful sources of evidence.
Bitcoin transactions don't disappear.
Years later, investigators can potentially revisit old blockchain activity and connect wallets to identities using information obtained from exchanges, seized computers or other investigations.
Privacy-focused cryptocurrencies such as Monero make this type of blockchain analysis considerably more difficult, which is one reason some darknet markets have moved away from Bitcoin.
Chainalysis estimated that darknet markets alone received just over $2 billion worth of Bitcoin on-chain during 2024, even after years of international law-enforcement disruption.
So money laundering isn't just another crime surrounding the darknet.
It's the infrastructure that allows many of the other crimes to become profitable.
The Darknet Has Changed
There's an important difference between the darknet of 2011 and the darknet of today.
Silk Road was largely a marketplace.
The modern underground is an ecosystem.
A stolen password might be sold on one platform.
Used to compromise a company by someone else.
The stolen data might then be used for extortion.
The proceeds might be converted into cryptocurrency.
Another service may then be used to move the money.
Different criminals.
Different countries.
Different websites.
One chain.
Europol's 2026 assessment says encryption, proxy services and AI are further expanding what cybercriminal networks can do, while law enforcement is increasingly targeting the infrastructure connecting these different activities rather than concentrating on individual criminals alone.
And darknet markets themselves remain surprisingly resilient. The UN's 2026 World Drug Report says their average lifespan between 2010 and 2023 was only about 1 year and 4 months, usually ending through law-enforcement action, exit scams, voluntary closure or hacking. Yet replacements continue appearing.
Maybe that's the most interesting thing about darknet crime.
The individual sites aren't particularly resilient.
The ecosystem is.
Discussion
Ten years from now, do you think traditional darknet marketplaces will still exist—or will encrypted messaging, decentralized platforms and private transactions eventually make the classic Tor marketplace obsolete?When Silk Road appeared in 2011, the darknet was still largely unknown outside a relatively small community.
Today, the situation is completely different.
Markets have come and gone. Forums have disappeared. Administrators have been arrested. Billions of dollars in cryptocurrency have moved through illicit services.
Yet the same types of crime keep returning.
Shut down one market and another appears.
Arrest one group and another takes its place.
So what are people actually doing illegally on the darknet?
Here are five of the biggest areas.
1. Drug Trafficking – Still the Darknet's Biggest Marketplace Business
If there's one crime historically associated with darknet markets, it's drugs.
Cannabis.
Cocaine.
MDMA.
Amphetamine and methamphetamine.
LSD and other psychedelics.
Prescription drugs.
Opioids.
The products change from country to country, but the business model has remained remarkably similar since Silk Road.
A vendor creates a listing. A buyer places an order. Cryptocurrency is used for payment, and the product is usually delivered through the ordinary postal system.
That's the strange part.
The transaction may happen through Tor, but eventually something physical has to leave someone's hands and arrive at someone else's address.
And that's where anonymity starts becoming much more difficult.
Postal inspections, undercover purchases, fingerprints, CCTV, packaging materials and seized computers have all helped investigators identify darknet vendors.
Historically, the dominance of drugs isn't even close in some datasets. A UN study examining nearly 139,000 listings across four major darknet markets found approximately 68% were drug-related. More recent blockchain research still describes illicit drugs as the traditional core business of darknet marketplaces.
The technology has changed.
The basic business hasn't.
2. Stolen Data – Your Identity Has Become a Product
The second economy is less visible but potentially affects far more ordinary people.
Stolen information.
Email credentials.
Passwords.
Payment information.
Personal records.
Compromised accounts.
Corporate credentials.
Instead of stealing money directly, criminals can steal the information needed for somebody else to do it.
Entire underground services exist to sell this material.
And one stolen credential can pass through several different hands.
One criminal steals it.
Another sells it.
Someone else buys it.
And a fourth person may eventually use it for fraud.
Europol's 2025 cybercrime assessment described stolen data as a fundamental commodity powering everything from online fraud to ransomware and extortion.
That's what makes this business different from selling drugs.
The victim may not even realize they've been robbed until months later.
3. Fraud and Scams – The Business That Has Become Industrial
Fraud has always existed online.
What has changed is the scale.
Fake investment schemes.
Phishing.
Impersonation.
Romance scams.
Payment fraud.
Fake cryptocurrency platforms.
Social engineering.
Some operations now function less like groups of criminals and more like companies, complete with managers, call centres, technical departments and money-laundering networks.
And AI is making this easier.
Voice cloning, generated identities and deepfake material can make an ordinary scam considerably more convincing.
The numbers have become enormous. Chainalysis estimates that approximately $17 billion was stolen through cryptocurrency scams and fraud during 2025, with impersonation scams showing particularly rapid growth.
Not all of that activity happens on the darknet—the majority of victims may encounter scammers on the ordinary internet—but darknet forums and underground services can provide stolen identities, compromised accounts and other infrastructure that feeds the wider fraud economy.
The darknet isn't necessarily where the victim gets scammed.
Sometimes it's where the criminal buys the tools.
4. Hacking, Malware and Ransomware Services – Crime for Hire
This is where the underground economy becomes particularly interesting.
You don't necessarily need to be an expert hacker anymore.
Someone else can provide part of the operation.
Underground communities advertise or trade things such as malware, compromised credentials, access to breached systems and other cybercrime services.
That has created a kind of criminal supply chain.
One person finds a vulnerability.
Another gains access.
Another steals information.
Another deploys ransomware.
Another handles extortion.
And someone else launders the proceeds.
Modern ransomware operations can therefore resemble partnerships rather than a single hacker attacking a company.
Europol's latest assessments describe cyber-attacks, online fraud and the infrastructure enabling them as major parts of the contemporary cybercrime landscape.
And when investigators dismantle one service, another often appears.
It's become an ecosystem.
5. Money Laundering and Criminal Financial Services – Following the Money
Every successful criminal business eventually has the same problem.
What do you do with the money?
Stealing $1 million is one thing.
Using that $1 million without attracting attention is something completely different.
That's why underground financial services matter.
Cryptocurrency exchangers, laundering networks and other intermediaries can be used to move criminal proceeds between wallets, currencies and jurisdictions.
Ironically, cryptocurrency has also become one of law enforcement's most useful sources of evidence.
Bitcoin transactions don't disappear.
Years later, investigators can potentially revisit old blockchain activity and connect wallets to identities using information obtained from exchanges, seized computers or other investigations.
Privacy-focused cryptocurrencies such as Monero make this type of blockchain analysis considerably more difficult, which is one reason some darknet markets have moved away from Bitcoin.
Chainalysis estimated that darknet markets alone received just over $2 billion worth of Bitcoin on-chain during 2024, even after years of international law-enforcement disruption.
So money laundering isn't just another crime surrounding the darknet.
It's the infrastructure that allows many of the other crimes to become profitable.
The Darknet Has Changed
There's an important difference between the darknet of 2011 and the darknet of today.
Silk Road was largely a marketplace.
The modern underground is an ecosystem.
A stolen password might be sold on one platform.
Used to compromise a company by someone else.
The stolen data might then be used for extortion.
The proceeds might be converted into cryptocurrency.
Another service may then be used to move the money.
Different criminals.
Different countries.
Different websites.
One chain.
Europol's 2026 assessment says encryption, proxy services and AI are further expanding what cybercriminal networks can do, while law enforcement is increasingly targeting the infrastructure connecting these different activities rather than concentrating on individual criminals alone.
And darknet markets themselves remain surprisingly resilient. The UN's 2026 World Drug Report says their average lifespan between 2010 and 2023 was only about 1 year and 4 months, usually ending through law-enforcement action, exit scams, voluntary closure or hacking. Yet replacements continue appearing.
Maybe that's the most interesting thing about darknet crime.
The individual sites aren't particularly resilient.
The ecosystem is.
Discussion:
Ten years from now, do you think traditional darknet marketplaces will still exist—or will encrypted messaging, decentralized platforms and private transactions eventually make the classic Tor marketplace obsolete?
Today, the situation is completely different.
Markets have come and gone. Forums have disappeared. Administrators have been arrested. Billions of dollars in cryptocurrency have moved through illicit services.
Yet the same types of crime keep returning.
Shut down one market and another appears.
Arrest one group and another takes its place.
So what are people actually doing illegally on the darknet?
Here are five of the biggest areas.
1. Drug Trafficking – Still the Darknet's Biggest Marketplace Business
If there's one crime historically associated with darknet markets, it's drugs.
Cannabis.
Cocaine.
MDMA.
Amphetamine and methamphetamine.
LSD and other psychedelics.
Prescription drugs.
Opioids.
The products change from country to country, but the business model has remained remarkably similar since Silk Road.
A vendor creates a listing. A buyer places an order. Cryptocurrency is used for payment, and the product is usually delivered through the ordinary postal system.
That's the strange part.
The transaction may happen through Tor, but eventually something physical has to leave someone's hands and arrive at someone else's address.
And that's where anonymity starts becoming much more difficult.
Postal inspections, undercover purchases, fingerprints, CCTV, packaging materials and seized computers have all helped investigators identify darknet vendors.
Historically, the dominance of drugs isn't even close in some datasets. A UN study examining nearly 139,000 listings across four major darknet markets found approximately 68% were drug-related. More recent blockchain research still describes illicit drugs as the traditional core business of darknet marketplaces.
The technology has changed.
The basic business hasn't.
2. Stolen Data – Your Identity Has Become a Product
The second economy is less visible but potentially affects far more ordinary people.
Stolen information.
Email credentials.
Passwords.
Payment information.
Personal records.
Compromised accounts.
Corporate credentials.
Instead of stealing money directly, criminals can steal the information needed for somebody else to do it.
Entire underground services exist to sell this material.
And one stolen credential can pass through several different hands.
One criminal steals it.
Another sells it.
Someone else buys it.
And a fourth person may eventually use it for fraud.
Europol's 2025 cybercrime assessment described stolen data as a fundamental commodity powering everything from online fraud to ransomware and extortion.
That's what makes this business different from selling drugs.
The victim may not even realize they've been robbed until months later.
3. Fraud and Scams – The Business That Has Become Industrial
Fraud has always existed online.
What has changed is the scale.
Fake investment schemes.
Phishing.
Impersonation.
Romance scams.
Payment fraud.
Fake cryptocurrency platforms.
Social engineering.
Some operations now function less like groups of criminals and more like companies, complete with managers, call centres, technical departments and money-laundering networks.
And AI is making this easier.
Voice cloning, generated identities and deepfake material can make an ordinary scam considerably more convincing.
The numbers have become enormous. Chainalysis estimates that approximately $17 billion was stolen through cryptocurrency scams and fraud during 2025, with impersonation scams showing particularly rapid growth.
Not all of that activity happens on the darknet—the majority of victims may encounter scammers on the ordinary internet—but darknet forums and underground services can provide stolen identities, compromised accounts and other infrastructure that feeds the wider fraud economy.
The darknet isn't necessarily where the victim gets scammed.
Sometimes it's where the criminal buys the tools.
4. Hacking, Malware and Ransomware Services – Crime for Hire
This is where the underground economy becomes particularly interesting.
You don't necessarily need to be an expert hacker anymore.
Someone else can provide part of the operation.
Underground communities advertise or trade things such as malware, compromised credentials, access to breached systems and other cybercrime services.
That has created a kind of criminal supply chain.
One person finds a vulnerability.
Another gains access.
Another steals information.
Another deploys ransomware.
Another handles extortion.
And someone else launders the proceeds.
Modern ransomware operations can therefore resemble partnerships rather than a single hacker attacking a company.
Europol's latest assessments describe cyber-attacks, online fraud and the infrastructure enabling them as major parts of the contemporary cybercrime landscape.
And when investigators dismantle one service, another often appears.
It's become an ecosystem.
5. Money Laundering and Criminal Financial Services – Following the Money
Every successful criminal business eventually has the same problem.
What do you do with the money?
Stealing $1 million is one thing.
Using that $1 million without attracting attention is something completely different.
That's why underground financial services matter.
Cryptocurrency exchangers, laundering networks and other intermediaries can be used to move criminal proceeds between wallets, currencies and jurisdictions.
Ironically, cryptocurrency has also become one of law enforcement's most useful sources of evidence.
Bitcoin transactions don't disappear.
Years later, investigators can potentially revisit old blockchain activity and connect wallets to identities using information obtained from exchanges, seized computers or other investigations.
Privacy-focused cryptocurrencies such as Monero make this type of blockchain analysis considerably more difficult, which is one reason some darknet markets have moved away from Bitcoin.
Chainalysis estimated that darknet markets alone received just over $2 billion worth of Bitcoin on-chain during 2024, even after years of international law-enforcement disruption.
So money laundering isn't just another crime surrounding the darknet.
It's the infrastructure that allows many of the other crimes to become profitable.
The Darknet Has Changed
There's an important difference between the darknet of 2011 and the darknet of today.
Silk Road was largely a marketplace.
The modern underground is an ecosystem.
A stolen password might be sold on one platform.
Used to compromise a company by someone else.
The stolen data might then be used for extortion.
The proceeds might be converted into cryptocurrency.
Another service may then be used to move the money.
Different criminals.
Different countries.
Different websites.
One chain.
Europol's 2026 assessment says encryption, proxy services and AI are further expanding what cybercriminal networks can do, while law enforcement is increasingly targeting the infrastructure connecting these different activities rather than concentrating on individual criminals alone.
And darknet markets themselves remain surprisingly resilient. The UN's 2026 World Drug Report says their average lifespan between 2010 and 2023 was only about 1 year and 4 months, usually ending through law-enforcement action, exit scams, voluntary closure or hacking. Yet replacements continue appearing.
Maybe that's the most interesting thing about darknet crime.
The individual sites aren't particularly resilient.
The ecosystem is.
Discussion
Ten years from now, do you think traditional darknet marketplaces will still exist—or will encrypted messaging, decentralized platforms and private transactions eventually make the classic Tor marketplace obsolete?When Silk Road appeared in 2011, the darknet was still largely unknown outside a relatively small community.
Today, the situation is completely different.
Markets have come and gone. Forums have disappeared. Administrators have been arrested. Billions of dollars in cryptocurrency have moved through illicit services.
Yet the same types of crime keep returning.
Shut down one market and another appears.
Arrest one group and another takes its place.
So what are people actually doing illegally on the darknet?
Here are five of the biggest areas.
1. Drug Trafficking – Still the Darknet's Biggest Marketplace Business
If there's one crime historically associated with darknet markets, it's drugs.
Cannabis.
Cocaine.
MDMA.
Amphetamine and methamphetamine.
LSD and other psychedelics.
Prescription drugs.
Opioids.
The products change from country to country, but the business model has remained remarkably similar since Silk Road.
A vendor creates a listing. A buyer places an order. Cryptocurrency is used for payment, and the product is usually delivered through the ordinary postal system.
That's the strange part.
The transaction may happen through Tor, but eventually something physical has to leave someone's hands and arrive at someone else's address.
And that's where anonymity starts becoming much more difficult.
Postal inspections, undercover purchases, fingerprints, CCTV, packaging materials and seized computers have all helped investigators identify darknet vendors.
Historically, the dominance of drugs isn't even close in some datasets. A UN study examining nearly 139,000 listings across four major darknet markets found approximately 68% were drug-related. More recent blockchain research still describes illicit drugs as the traditional core business of darknet marketplaces.
The technology has changed.
The basic business hasn't.
2. Stolen Data – Your Identity Has Become a Product
The second economy is less visible but potentially affects far more ordinary people.
Stolen information.
Email credentials.
Passwords.
Payment information.
Personal records.
Compromised accounts.
Corporate credentials.
Instead of stealing money directly, criminals can steal the information needed for somebody else to do it.
Entire underground services exist to sell this material.
And one stolen credential can pass through several different hands.
One criminal steals it.
Another sells it.
Someone else buys it.
And a fourth person may eventually use it for fraud.
Europol's 2025 cybercrime assessment described stolen data as a fundamental commodity powering everything from online fraud to ransomware and extortion.
That's what makes this business different from selling drugs.
The victim may not even realize they've been robbed until months later.
3. Fraud and Scams – The Business That Has Become Industrial
Fraud has always existed online.
What has changed is the scale.
Fake investment schemes.
Phishing.
Impersonation.
Romance scams.
Payment fraud.
Fake cryptocurrency platforms.
Social engineering.
Some operations now function less like groups of criminals and more like companies, complete with managers, call centres, technical departments and money-laundering networks.
And AI is making this easier.
Voice cloning, generated identities and deepfake material can make an ordinary scam considerably more convincing.
The numbers have become enormous. Chainalysis estimates that approximately $17 billion was stolen through cryptocurrency scams and fraud during 2025, with impersonation scams showing particularly rapid growth.
Not all of that activity happens on the darknet—the majority of victims may encounter scammers on the ordinary internet—but darknet forums and underground services can provide stolen identities, compromised accounts and other infrastructure that feeds the wider fraud economy.
The darknet isn't necessarily where the victim gets scammed.
Sometimes it's where the criminal buys the tools.
4. Hacking, Malware and Ransomware Services – Crime for Hire
This is where the underground economy becomes particularly interesting.
You don't necessarily need to be an expert hacker anymore.
Someone else can provide part of the operation.
Underground communities advertise or trade things such as malware, compromised credentials, access to breached systems and other cybercrime services.
That has created a kind of criminal supply chain.
One person finds a vulnerability.
Another gains access.
Another steals information.
Another deploys ransomware.
Another handles extortion.
And someone else launders the proceeds.
Modern ransomware operations can therefore resemble partnerships rather than a single hacker attacking a company.
Europol's latest assessments describe cyber-attacks, online fraud and the infrastructure enabling them as major parts of the contemporary cybercrime landscape.
And when investigators dismantle one service, another often appears.
It's become an ecosystem.
5. Money Laundering and Criminal Financial Services – Following the Money
Every successful criminal business eventually has the same problem.
What do you do with the money?
Stealing $1 million is one thing.
Using that $1 million without attracting attention is something completely different.
That's why underground financial services matter.
Cryptocurrency exchangers, laundering networks and other intermediaries can be used to move criminal proceeds between wallets, currencies and jurisdictions.
Ironically, cryptocurrency has also become one of law enforcement's most useful sources of evidence.
Bitcoin transactions don't disappear.
Years later, investigators can potentially revisit old blockchain activity and connect wallets to identities using information obtained from exchanges, seized computers or other investigations.
Privacy-focused cryptocurrencies such as Monero make this type of blockchain analysis considerably more difficult, which is one reason some darknet markets have moved away from Bitcoin.
Chainalysis estimated that darknet markets alone received just over $2 billion worth of Bitcoin on-chain during 2024, even after years of international law-enforcement disruption.
So money laundering isn't just another crime surrounding the darknet.
It's the infrastructure that allows many of the other crimes to become profitable.
The Darknet Has Changed
There's an important difference between the darknet of 2011 and the darknet of today.
Silk Road was largely a marketplace.
The modern underground is an ecosystem.
A stolen password might be sold on one platform.
Used to compromise a company by someone else.
The stolen data might then be used for extortion.
The proceeds might be converted into cryptocurrency.
Another service may then be used to move the money.
Different criminals.
Different countries.
Different websites.
One chain.
Europol's 2026 assessment says encryption, proxy services and AI are further expanding what cybercriminal networks can do, while law enforcement is increasingly targeting the infrastructure connecting these different activities rather than concentrating on individual criminals alone.
And darknet markets themselves remain surprisingly resilient. The UN's 2026 World Drug Report says their average lifespan between 2010 and 2023 was only about 1 year and 4 months, usually ending through law-enforcement action, exit scams, voluntary closure or hacking. Yet replacements continue appearing.
Maybe that's the most interesting thing about darknet crime.
The individual sites aren't particularly resilient.
The ecosystem is.
Discussion:
Ten years from now, do you think traditional darknet marketplaces will still exist—or will encrypted messaging, decentralized platforms and private transactions eventually make the classic Tor marketplace obsolete?