Blockchain analytics firm Chainalysis has compiled a new report regarding crypto crime, crime involving cryptography, with a particular focus on Darknet marketplaces and fraud stores that have been fighting for users in the wake of the Hydra collapse.
More specifically, it emerges that 2022 saw a decline in revenue from the previous year for Darknet marketplaces and fraud stores. Indeed, total darknet market revenues for 2022 ended at $1.5 billion, down from $3.1 billion in 2021.
Not only that, four of the top five Darknet marketplaces with the highest earnings in 2022 were conventional drug-focused Darknet marketplaces, while only one, Brian Dumps, was a fraud store.
Crypto crime according to Chainalysis: Hydra closes and Darknets fall
Hydra Market led the way once again, with the highest-earning Darknet market in 2022. Even though it was sanctioned by OFAC and shut down in a joint US-Germany operation in April.
No other market beat the revenue advantage accumulated in those four months. All gained their initial market share in the wake of Hydra’s collapse, with on-chain data suggesting that these markets made concerted efforts to attract former Hydra users and suppliers.
Hydra’s closure caused an industry-wide decline in Darknet market revenues, with average daily revenues for all markets dropping from $4.2 million just before its closure and $447,000 immediately thereafter.
Even though the collective revenue of the drug markets did not fully recover, it slowly returned to previous levels in the second half of 2022. Whereas fraud stores continued to decline.
Fraud stores
Fraud stores are a unique segment of Darknet marketplaces that sell stolen data such as compromised credit card information and other forms of personally identifiable information (PII) that can be used for fraudulent activities.
This decline was partly triggered by the closure of major fraud stores such as Bypass Shop, which was shut down in March. Brian Dumps, the largest fraud store overall for the year, also appears to have been disrupted, as its revenue dropped to almost zero in October, although it is unclear exactly why.
While Darknet markets have largely recovered since Hydra’s closure and fraud stores have not, single seller stores have shown a different trend. Single vendor stores are independent stores set up by individual drug vendors that typically gather a large customer base on a larger traditional Darknet marketplace.
The creation of a single vendor store allows them to save on the fees that would normally go to the administrators of a traditional Darknet marketplace.
Throughout 2022, we have observed a negative relationship between funds sent to regular Darknet marketplaces and funds sent to single vendor stores. For example, we see an increase in single vendor store revenue starting in March, around the same time that traditional Darknet marketplace revenue started to decline.
Similarly, single vendor store revenues declined as traditional Darknet markets recovered from June through the end of the year.
After Hydra, the battle for market dominance
Before law enforcement shut down Hydra, it was the largest Darknet market in the world. Prior to its demise, Hydra Marketplace captured 93.3% of all economic value received in the 2022 Darknet marketplace ecosystem.
The Russia-based Darknet Marketplace enabled the sale of drugs and offered money laundering services to cybercriminals. In the wake of Hydra’s collapse, several markets gained revenue, but three in particular dominated: Blacksprut, OMG!OMG! market, and Mega Darknet market.Â
Interestingly, each of the three led the market at different times, although OMG’s period of dominance immediately after the Hydra collapse was the strongest any of the three has ever had.
For most of April and May, OMG captured well over 50% of the total market share, peaking at 65.2% on 23 April. It also operated virtually unchallenged by its competitors, indicating its potential as Hydra’s successor.
In June, OMG suffered a Distributed Denial of Service (DDoS) attack, which likely caused vendors and customers to migrate to Mega Darknet Market and Blacksprut Market at that time.
Similarly, Blacksprut was hacked in late November, which coincides with its decline from its peak revenue share of 68.5% a few weeks earlier. Given the illicit nature of Darknet marketplaces, it is not surprising that providers and users would seek to leave a marketplace that has suffered a data breach.
Chainalysis: crypto crime continues after Hydra, let’s see how
If we dig deeper into how Hydra’s three major successor markets fought for position after Hydra’s closure. We find that capturing the specific customers who previously relied on Hydra was key to the battle.
We can investigate this by using on-chain data to see where former Hydra users migrated after the market closed. For this analysis, we will divide the rest of 2022 after the Hydra shutdown on 5 April into two time periods.
Specifically, one is OMG dominance: the 50-day period immediately following Hydra’s closure, when OMG captured nearly 100% of the Darknet market share.
Then, the post-OMG dominance: the rest of 2022, in which OMG became one of the three important markets along with Blacksprut and Mega. Like the vast majority of all Darknet market users, Hydra’s former counterparts in all categories. Both retail drug buyers and criminal consumers. Transacted almost exclusively with OMG during OMG’s period of dominance.
In the post-OMG dominance period, OMG retained a number of those former Hydra counterparts. But lost a significant share of their illicit activity to the other two markets in all categories.
Two main conclusions can be drawn from this. First, indications are that these three markets launched cryptocurrency laundering services similar to those offered by Hydra, which would explain why so many of Hydra’s criminal users migrated to those markets.
The second aspect is how dominant OMG was among Hydra’s counterparts immediately after Hydra shut down. This is particularly interesting given the connections between OMG and Hydra.