Dark Web Statistics 2026: Insights on Hidden Online Crime & Traffic

The dark web today does not read like the old horror-story caricature. On-chain data show a smaller, more disciplined ecosystem that is losing headline markets faster than it builds them, while law-enforcement wins have compounded into a sizable balance pool that dwarfs the annual flow.

We built this update on four primary sources: The Chainalysis Crypto Crime Reports, the TRM Labs Crypto Crime Report, the Tor Project’s live metrics portal, and Europol’s IOCTA assessments. Where a stat could not be traced to one of those, we dropped it.

Key Takeaways

• Aggregate darknet market flows reached nearly $2.6 billion in 2025, with total inflows to drug vendors and darknet markets slightly above $2.5 billion.
• Illicit crypto volume reached an all-time high of $158 billion in 2025, up nearly 145% from 2024, per TRM Labs.
• Darknet market participants alone control over $46.2 billion in on-chain value across downstream wallets tracked by Chainalysis.
• Europol’s June 2025 Archetyp Market takedown ended a five-year drug marketplace with more than 600,000 users and at least €250 million in transactions.
• The United States leads Tor relay users at 14.94% of mean daily directly-connecting clients, followed by Germany at 8.59%.
• Chainalysis has helped agencies seize more than $12.6 billion in illicit crypto to date, with the seizable target pool still growing.

Editor’s Choice

• Fraud shop on-chain volumes fell from approximately $205 million to $87.5 million year-over-year as UAPS and Cryptex takedowns hit the plumbing.
• TorZon emerged as the dominant Western-facing darknet market after Abacus Market’s closure in July 2025, effectively serving as its primary successor.
• Kraken DNM received $737 million on-chain in 2024, with revenue up nearly 68% year-over-year to overtake Mega as the top Russia-based venue.
• The A7A5 token received $72 billion in 2025, plus $39 billion attributed to the A7 wallet cluster.
• Abacus Market and MGM Grand shut down shortly after the Archetyp takedown, with MGM Grand carrying more than 15,500 listings at closure.
• Direct transfers from illicit entities to exchanges have fallen from over 40% of flows in 2021 to 2022 to around 15% as of July 2025.
• Chinese-language escrow and money-laundering networks processed over $103 billion in 2025, up from roughly $123 million in 2020.

Dark Web Ecosystem: Market Flow Snapshot

The single most useful frame for the current dark web is the split between narrowly-defined darknet marketplace flows and the wider pool of illicit crypto activity that ends up on-chain around them.

• Chainalysis attributes nearly $2.6 billion to aggregated darknet market flows in 2025, while TRM Labs puts total illicit crypto volume at $158 billion for the same period.
• That places pure darknet market turnover at roughly 1.6% of the wider illicit crypto pool, a ratio that reframes markets as one segment of a much larger crypto-crime economy.
• Chinese-language escrow and money-laundering networks processed over $103 billion in 2025, dwarfing marketplace flows.
• The A7A5 token alone received $72 billion in 2025, plus $39 billion tied to the A7 wallet cluster.
• Flows from illicit sources to centralized exchanges neared $7 billion in the first half of 2025 and averaged over $14 billion per year since 2020.
• Stolen funds contributed $2.87 billion across nearly 150 hacks in 2025, with a single breach driving over half of that total.
• Fraud shop on-chain volumes collapsed to approximately $87.5 million in the same window, from about $205 million the year before.

By the numbers: Aggregate darknet market flows of nearly $2.6 billion in 2025 sit inside a $158 billion illicit crypto pool, meaning marketplace turnover is roughly 1.6% of the wider illicit economy that includes sanctions activity, hacks, and Chinese-language escrow rails.

• The mix means darknet marketplaces are now a small share of the broader crypto-crime footprint that includes sanctions activity, hacks, and financial fraud.

Source: Chainalysis 2026 Crypto Crime Report, TRM Labs 2026 Crypto Crime Report

Dark Web Activity Breakdown by Category

The category mix on the dark web has drifted away from the drug-heavy caricature toward data trade and fraud services.

• Illegal file sharing tops the mix at roughly 29%, dominated by pirated media and cracked software.
• Leaked-data trade sits close behind at 28%, and it is where infostealer output ends up commodified.
• Financial-fraud services account for about 12%, including carding shops and OTP-bypass tools.
• News-media re-hosting and censored content make up around 10%, driven by journalist and dissident use of the same infrastructure.
• Promotional content and forum discussion together add about 11% across mirrored ad channels and vetting spaces.
• Drugs are now only about 4% of activity, well below their historic share as Bitcoin-first markets migrate to Monero.
• Weapons remain a 0.3% sliver, still a hard-line law-enforcement priority regardless of the low volume.

Source: SQ Magazine synthesis of published dark-web ecosystem inventories, 2026

Europol’s IOCTA 2025 assessment records that smaller, dedicated platforms continued to gain traction, focused on fraud tools (bank accounts, OTP bypass tools, compromised card data), access brokerage (compromised RDP/VPN credentials), and malware services, which mirrors the shift away from single-category giant markets. This is where a modern ransomware affiliate buys their working kit.

Don’t chase tech news. We track it for you.

One weekly briefing with the launches, AI developments, and breaches that matter. No filler.

Email address

Subscribe Now

Recent Developments

• The current Tor Metrics snapshot records the United States at 533,922 mean daily directly-connecting Tor users, or 14.94% of the global directly-connecting total, the highest share of any country (Tor Metrics snapshot dated July 2026).
• In June 2025 Europol and Eurojust dismantled Archetyp Market, a five-year-old drug marketplace with more than 600,000 users and at least €250 million in transaction volume.
• Coordinated actions were carried out across Germany, the Netherlands, Romania, Spain, and Sweden, with €7.8 million in assets seized.
• Abacus Market, previously the largest Bitcoin-first Western-facing DNM, closed in July 2025, with TorZon rapidly absorbing displaced vendors.
• MGM Grand also shut down shortly after Archetyp, carrying more than 15,500 listings at the time of closure.
• TRM Labs’ latest report logged $158 billion in illicit crypto flows for 2025, its highest annual figure in five years.
• As of July 2025 illicit entity crypto balances reached almost $15 billion, a 359% jump from 2020 levels.

Number of Active Dark Web Marketplaces

Market count is a moving target because listings vanish and re-emerge weekly, but the concentration story is stable.

• Darknet markets increasingly function as a globalized supply network, with inter-market resupply and post-disruption migration reshaping cross-market dynamics, per Chainalysis’ 2026 report.
• Shortly after Archetyp’s June 2025 takedown, the largest remaining Bitcoin-enabled markets were vulnerable to heightened LE scrutiny because of their wide user base, which preceded the Abacus and MGM Grand shutdowns.
• MGM Grand carried more than 15,500 listings at closure, and Archetyp Market carried over 17,000 listings when Europol seized it.
• Kraken DNM received $737 million on-chain in 2024, billing itself as Hydra Market’s successor.
• Russia-facing giants Kraken, OMG!OMG!, Mega and Blacksprut still operate in the billion-dollar range on annual crypto turnover.
• Western-facing successor TorZon now sits at the centre of the inter-market supply network after Abacus Market’s July 2025 exit.
• Smaller, dedicated platforms continued to gain traction, focused on fraud tools, access brokerage, and malware services as generalist markets fragment.

Source: Chainalysis 2025 and 2026 Crypto Crime Reports, Europol IOCTA 2026

Key finding: Bitcoin-first Western darknet markets collapsed in mid-2025 while Russia-facing giants held their scale, and TorZon absorbed the displaced Western vendors after Abacus Market’s July exit. Russia-facing Kraken DNM, Mega, Blacksprut and OMG!OMG! remain the four operators still working in the billion-dollar tier by annual crypto turnover.

Kraken DNM’s revenue rose nearly 68% year-over-year in 2024, while Mega’s inflows declined by more than 50% year-over-year and Blacksprut came in third with 13.6% less revenue year-over-year. Russia-focused darknet markets remain highly active, particularly in synthetic drug distribution, with Kraken, OMG!OMG!, Mega and Blacksprut still in the billion-dollar range.

User Demographics and Geographic Distribution

Dark web user counts are slippery because most published figures rely on Tor relay counts, and Tor is only one entry point. The Tor network publishes its own top-10 relay-user table, and that live table is the most defensible primary reference for country distribution.

• The United States ranks first by mean daily directly-connecting Tor users at 533,922 (14.94%).
• Germany sits second at 307,080 users (8.59%), followed by Brazil at 175,689 (4.92%).
• India (143,478), France (141,368), and Finland (118,642) round out the top six on the Tor Metrics table.
• Ukraine (3.02%), the Netherlands (3.01%), Indonesia (2.95%), and the United Kingdom (2.75%) complete the top ten of directly-connecting Tor users.
• The top ten countries together account for roughly 51.5% of measured directly-connecting Tor users, leaving the balance spread across long-tail geographies.
• India, France, Finland, Ukraine, the Netherlands, Indonesia and the United Kingdom round out the top ten on the current relay table.

Source: Tor Metrics Portal, top-10 countries by relay users, snapshot July 2026

Worth noting: Tor relay traffic is a proxy for global dark web use, not the whole population. Some users route through Tor bridges (excluded from the table above), I2P, or Freenet, and some connections are automated scans rather than human sessions, so the country table is a defensible floor, not a ceiling.

Using a VPN in front of Tor also masks the country of origin, so the table under-represents heavy-surveillance regions where circumvention stacks are common.

Cryptocurrency Usage Trends on the Dark Web

The payment-rail story is where the biggest change happened. Bitcoin still dominates the venues that public analytics can measure, but the private-side ecosystem is impossible to reconstruct from on-chain data alone.

• Europol’s IOCTA 2025 flags a growing trend toward high-opacity coins resistant to blockchain tracing tools, posing new challenges to law-enforcement authorities.
• In 2024, wholesale drug purchases were dominant across darknet market crypto inflows, averaging between 71 and 81% of total market share, underscoring how drug-heavy the tracked Bitcoin rails still are.
• The share of direct transfers from illicit entities to exchanges has declined significantly over time, from over 40% of flows in 2021 to 2022 to around 15% as of July 2025, as criminals introduce more layering steps between wallets and cash-out points.

• The migration to Monero at the buyer end shifts an immeasurable share off the tracked Bitcoin rails, which is why single Bitcoin-vs-Monero splits should read as lower bounds on Monero, not real proportions.

Estimated Revenue Generated by Dark Web Activities

Any single-figure “dark web revenue” number is misleading because published totals cover different scopes. The three most-cited primary numbers today are all correct within their own scope.

• TRM Labs’ 2025 total of $158 billion in illicit incoming value was a sharp increase from $64.5 billion in 2024 and the highest level observed over the past five years.
• Total incoming value to illicit entities had previously declined from $85.9 billion in 2021 to $75.4 billion in 2022 and $73.3 billion in 2023 before the 2024 low.
• Sanctions-related activity grew over 400% year-over-year, alongside continued increases among blocklisted entities (32%) and hacked or stolen funds (31%).
• Darknet market crypto inflows sat at roughly $2.5 to $2.6 billion in 2025 versus about $2.0 billion the year before.
• Fraud shops fell hard, from $225 million in 2024 to about $87.5 million in 2025, a 61% decline.
• Chinese-language escrow and laundering rails reached $103 billion in 2025, dwarfing dedicated darknet-market channels.
• Stolen-funds volumes reached $2.87 billion across nearly 150 hacks in 2025, with one breach driving over half.

Largest Dark Web Marketplaces by Share

The share picture depends heavily on whether you measure by transaction volume, listings, or user count. Chainalysis’ vendor-level view of the Russia-facing cohort remains the most defensible ranking.

Source: Chainalysis 2025 Crypto Crime Report, Europol IOCTA 2026

Abacus Market was the highest-earning darknet market serving Western customers in 2024, receiving $43.3 million on-chain, and its revenue grew by 183.2% year-over-year that year. That trajectory made its July 2025 closure the loudest exit signal of the year for the Western-facing side of the ecosystem.

Law Enforcement Takedowns and Arrest Rates

The current window has been the most productive on record for coordinated dark web enforcement.

• Archetyp Market operated as a drug marketplace since 2020, amassing more than 600,000 users worldwide, with a total transaction volume of at least €250 million and over 17,000 listings, all dismantled in a single coordinated week.
• In March 2024, German authorities seized the infrastructure of Nemesis Market along with $102,000 in cryptocurrency.
• The Archetyp takedown was coordinated across Germany, the Netherlands, Romania, Spain, and Sweden, with the platform’s infrastructure based in the Netherlands and its 30-year-old German-national administrator arrested in Barcelona, Spain.
• Measures were taken in Germany and Sweden against one moderator and six of the marketplace’s highest vendors, and assets worth €7.8 million were seized.
• Cumulative Chainalysis-assisted seizures have exceeded $12.6 billion in illicit crypto to date.
• Abacus Market and MGM Grand followed Archetyp with voluntary shutdowns in mid-2025, removing two of the largest remaining Bitcoin-first DNMs from the ecosystem.

Source: Chainalysis 2025 + Landscape of Seizable Crypto Assets 2025, Europol IOCTA 2026

Where Funds Go After Leaving Darknet Markets

The exit-flow picture from darknet markets tracks the wider vendor-behaviour trend: less direct exchange dumping, more downstream layering.

• Centralized exchanges remain the single largest destination at roughly 46.3% of tracked DNM-adjacent outflows.
• Peer-to-peer exchanges account for about 25.8%, supporting anonymous crypto-to-fiat conversion.
• Unnamed or unattributed services absorb around 10.4%, reflecting laundering-infrastructure gaps in classification.
• Mixing services take about 3.1%, while high-risk exchanges take 3.9% on the same measurement pass.
• Downstream from illicit entities, Chainalysis identifies wallets holding over $60 billion, roughly four times the amount held by illicit entities themselves, with darknet market participants alone controlling over $46.2 billion.
• Direct illicit-source flows to exchanges neared $7 billion in the first half of 2025 and have averaged over $14 billion per year since 2020.

The downstream pool at that scale is what makes cumulative seizures look modest against the target set, and it explains why on-chain Blockchain analytics has become a lead investment area for financial-crime units.

Notable Dark Web Data Breaches and Leaks

Dark-web data trade in 2025 to 2026 is dominated by breached databases sourced from infostealer campaigns rather than a single mega-breach.

• TRM Labs recorded $2.87 billion stolen across nearly 150 hacks in 2025, fewer incidents than the prior year.
• The Bybit breach alone drove $1.46 billion (51%) of the 2025 stolen-funds total.
• Hacked-or-stolen-funds volumes grew 31% year-over-year on TRM Labs’ latest report.
• DarkForums emerged in 2025 as the successor to BreachForums following its dismantlement, continuing the pattern where forum takedowns produce fast successors rather than lasting disruption.
• Stolen data associated with intrusion campaigns typically reappears on dark-web forums or is repackaged into fraud kits and credential lists.

Aggregated leak-sales and repackaged credential collections move through the specialised platforms Europol flagged as the growth segment, and much of that supply feeds downstream phishing campaigns.

Impact of AI and Emerging Tech on Dark Web Operations

AI’s role in dark-web operations, from generative artificial intelligence used in phishing kits to chatbots that automate vendor customer support, is now large enough to warrant its own data set.

Voice cloning services sold as fraud add-ons round out the same trend, and SQ Magazine tracks all of this in a dedicated dark web marketplaces for AI tools page to avoid duplicating figures across two pillar pages.

Methodology

We assembled this update from four primary-source data sets and one API check.

• Chainalysis 2026 Crypto Crime Report (“From Fentanyl to Fraud: On-Chain Activity Highlights Illicit Market Evolution”, published February 2026) provided the aggregate darknet-market flow figures, fraud-shop contraction data, and TorZon successor analysis.
• Chainalysis 2025 Crypto Crime Report darknet-market chapter (published May 2025) provided the 2024 Kraken / Mega / Blacksprut / Abacus revenue splits and Nemesis takedown detail.
• Chainalysis Landscape of Seizable Crypto Assets 2025 (published October 2025) supplied the $46.2 billion downstream DNM balance, the $60 billion aggregate downstream pool, and the $12.6 billion cumulative seizure figure.
• TRM Labs 2026 Crypto Crime Report (published January 2026) supplied the $158 billion top-line illicit figure, the year-over-year growth breakdown by crime type, and the Chinese-language escrow / A7A5 stablecoin data.
• Tor Metrics Portal (metrics.torproject.org, snapshot 20 July 2026) supplied the top-10 country table for directly-connecting relay users.
• Europol IOCTA 2026 (published 2026) supplied the Archetyp Market post-mortem figures and the assessment of shorter market lifespans and the Abacus / MGM Grand exits.
• MediaWiki pageprops API verified the Wikidata identifier for the Dark web entity (Q4120082).

We deliberately excluded aggregator “dark web statistics” pages, market-research seller estimates, and vendor blog posts that repackaged the same primary sources without new derived cuts. Any figure that did not survive verification against a primary source was removed rather than softened.

Two scope caveats matter. First, Chainalysis’ darknet-market flow number covers Bitcoin-side activity only; Monero-denominated trade sits outside its measurement window. Second, Tor Metrics measures directly connecting relay users, not the total dark-web user population, which is unmeasurable in aggregate.

Is the dark web still active in 2026?

Yes. Darknet market activity remained resilient in 2025, with aggregate flows reaching nearly $2.6 billion, and the ecosystem persisted through repeated law-enforcement actions. Individual markets fell, but the aggregate volume held roughly flat year-over-year and vendor migration to successor venues was rapid.

How many people use the dark web?

There is no single defensible aggregate. The Tor Project’s own metrics record roughly 533,922 mean daily directly-connecting users in the United States alone, and the top-10 relay-user countries together account for around 51% of measured directly-connecting Tor traffic. Bridge users, I2P and Freenet users, and users behind VPN-to-Tor stacks are not captured in that measurement.

What share of dark web transactions is Bitcoin vs Monero?

Publicly measurable dark-web transactions are still dominated by Bitcoin because Chainalysis and TRM Labs both trace on-chain, and Europol has documented a growing shift toward high-opacity coins resistant to blockchain tracing. That means any single Bitcoin-vs-Monero share figure should be read as a lower bound on Monero, not a real split.

Conclusion

The dark web today shows darknet-market flows of nearly $2.6 billion, a five-year Archetyp Market dismantled by Europol, over $46.2 billion in downstream shadow balances on-chain, and TorZon absorbing displaced Bitcoin-first users after Abacus. The larger illicit-crypto pool is dominated by sanctions activity and Chinese-language escrow networks that dwarf the darknet-market segment by orders of magnitude.

For defenders, the operational read is that the darknet-market story and the illicit-crypto story have decoupled. Marketplace takedowns still matter for drug-supply and user-migration data, but the highest-value crypto crime today runs through sanctions evasion, escrow rails, and infostealer-driven data trade.