Sites in the deep web where criminals trade are called dark web marketplaces: online shops on the Tor network that sell stolen data, malware, fake documents, drugs and other illegal goods for cryptocurrency. Strictly, the dark web is the small, hidden part of the deep web, and this page lists the best-known of these sites and how each one ended. It is a status list for defenders. It names no live addresses and gives no buying guidance.
What are the sites in the deep web where criminals trade?
A dark web marketplace, also called a darknet market or deep web black market, works like a small online store. Vendors post listings. Buyers pay into the market’s wallet. The market holds the money until the buyer confirms delivery, then pays the vendor. This holding step is called escrow. Reviews and vendor ratings build trust between strangers.
Three things keep these sites running: the Tor network, which hides where the server is; cryptocurrency, which moves money without a bank; and review forums, where users compare vendors and warn each other about scams. Police target all three, and that is why most markets live for a short time.
For a security team the interesting part is not the drugs. It is the data and tools: leaked card details, stolen logins, access to company networks, exploit kits and hackers for hire. Law enforcement and threat intelligence teams watch these markets because the listings and the chat around them show what criminals are doing right now. Our guide to the dark web explains the wider picture.
Dark market list: which sites in the deep web are seized, closed or gone?
The table below lists the best-known markets of the last decade and how each one ended. Dates come from law enforcement announcements and press reports. “Closed” means the site went offline. It does not mean the people behind it stopped.
| Market | Status | What happened |
|---|---|---|
| Silk Road | Seized | The FBI shut it down in October 2013 and arrested its creator. |
| Hansa | Seized | Dutch police ran it in secret for a month, then closed it on 20 July 2017. |
| AlphaBay | Seized, then a copy relaunched | Taken down in July 2017. A former admin relaunched a version in August 2021. |
| Dream Market | Closed by its operators | Shut down on 30 April 2019. |
| Wall Street Market | Seized | A German-led operation took it down in May 2019. |
| DarkMarket | Seized | German police dismantled it in January 2021. |
| Hydra | Seized | German police with US partners shut down the largest Russian-language market on 5 April 2022. |
| Versus | Closed by its operators | Shut down in May 2022 after details of a serious flaw were leaked. |
| Genesis Market | Seized | The FBI and Dutch police led Operation Cookie Monster on 4 April 2023. It sold stolen logins. |
| Monopoly Market | Seized | Europol announced its takedown with Operation SpecTor in May 2023. |
| Tor2door | Gone | Went offline in September 2023 and the operators went silent. Widely believed to be an exit scam. |
| Kingdom Market | Seized | German police took its servers from 16 December 2023. |
Two names people search for
AlphaBay was taken down in July 2017, and the version relaunched in 2021 is not the original operation. Awazon is also a frequent search, but we could not find a law enforcement notice or other primary source that confirms what the market was or how it ended, so we give it no status. Treat any site using that name, or any old market name, as unverified: lookalike sites are common and they steal logins and funds.
How did these markets end?
Law enforcement seizures
Silk Road was the first market to pair the darknet with Bitcoin. Ross Ulbricht created it in January 2011. By the time it was shut down in October 2013, more than $200 million in illegal goods had been sold on it, according to U.S. authorities.
The pattern since then is the same. Police find a server, watch quietly, then act. In Operation Bayonet in 2017, Dutch police ran Hansa under their own control for a month while the FBI and others took down AlphaBay. AlphaBay’s alleged founder was arrested in Thailand and died in custody a week later.
Seizures also produce arrests of ordinary buyers and vendors. Operation Dark HunTor in October 2021 led to 150 arrests. Operation SpecTor in May 2023 led to 288. Operation RapTor in May 2025 led to 270 arrests in ten countries, based on data from earlier takedowns of Nemesis, Tor2door, Bohemia and Kingdom Market.
Exit scams
An exit scam is when the operators take the money held in escrow and disappear. Incognito Market did this in March 2024 and kept the funds of its users. Abacus went offline in early July 2025 and analysts suspect the same. Tor2door vanished in September 2023. Buyers and vendors are criminals dealing with criminals, so they have no one to complain to.
Closures by the operators
Some markets close on their own. Dream Market announced its closing and shut on 30 April 2019. Versus went down in May 2022 after exploit details were published on a darknet forum, because the operators judged it too risky to continue.
Why a closed market still matters to you
Takedowns do not end the trade. Users and vendors move. After the Archetyp takedown in June 2025, analysts saw vendors pointing to other markets as likely successors, and one of them, Abacus, went offline within weeks. The criminals stay and the shops change.
Seized servers also hold evidence. Police use customer lists, wallets and chat logs to find people months or years later. That is why we do not publish a list of markets that are open today. The list changes weekly, lookalike sites steal logins and funds, and a list of addresses helps buyers more than it helps defenders.
How do data breaches feed dark web markets?
Markets and forums thrive on stolen data from large breaches. Three well-known examples from 2024 show the scale:
National Public Data breach (2024)
In April 2024, a data broker, National Public Data, suffered a major breach. A hacker group claimed it held 2.9 billion records. The data included names, addresses, Social Security numbers and phone numbers. The hacker group known as USDoD listed this data for sale on a dark web forum.
Dell customer data breach (2024)
In early 2024, Dell notified customers of a breach, and a hacker claimed approximately 49 million customer records were taken. Dell said the exposed data covered customer names, addresses and order details, and no payment information. The hacker advertised the records on a cybercrime forum. Such data can be used for targeted scams and phishing.
Ticketmaster data breach (2024)
In May 2024, Live Nation told the SEC it had found unauthorized activity in a third-party cloud database holding data mostly from its Ticketmaster subsidiary. A criminal threat actor then offered what it said was user data for sale on the dark web.
What should defenders do about dark web markets?
You do not need to visit these sites. You need to know when your data appears on them and act fast. Credentials are the fastest-moving item: stolen logins, such as the ones Genesis Market sold, often lead directly to account takeover.
- Monitor for your brandTrack your domains, email addresses, executive names and product names on markets, forums and leak sites.
- Reset exposed credentialsForce a password reset and end active sessions when a login is found for sale.
- Turn on multi-factor authenticationStolen passwords alone then lose most of their value.
- Check third partiesA supplier breach can put your data on sale. Ask vendors how they would tell you.
- Keep evidenceSave listing details so legal and law enforcement teams can act. Do not buy back your own data.
To go deeper, read how analysts gather this intelligence in OSINT tools for the dark web, which forums and leak sites matter in deep web websites for threat intelligence, and the tools and search engines used to find them in our list of dark web sites, onion search engines and the Hidden Wiki. For the Telegram side of the trade, see Telegram marketplaces.
Conclusion
Dark web markets come and go. Silk Road, AlphaBay, Hydra, Kingdom, Nemesis and Archetyp are all gone, and the next market is already taking their place. The stolen data they carry is the lasting problem. Watch for your own data, fix exposed credentials fast, and let your threat intelligence team do the reading. To see how that works in practice, Request a demo.