Collective Dynamics of Dark Web Marketplaces

11/21/2019 ∙ by Abeer ElBahrawy, et al. ∙ 0

Dark markets are commercial websites that use Bitcoin to sell or broker transactions involving drugs, weapons, and other illicit goods. Being illegal, they do not offer any user protection, and several police raids and scams have caused large losses to both customers and vendors over the past years. However, this uncertainty has not prevented a steady growth of the dark market phenomenon and a proliferation of new markets. The origin of this resilience have remained unclear so far, also due to the difficulty of identifying relevant Bitcoin transaction data. Here, we investigate how the dark market ecosystem re-organises following the disappearance of a market, due to factors including raids and scams. To do so, we analyse 24 episodes of unexpected market closure through a novel datasets of 133 million Bitcoin transactions involving 31 dark markets and their users, totalling 4 billion USD. We show that coordinated user migration from the closed market to coexisting markets guarantees overall systemic resilience beyond the intrinsic fragility of individual markets. The migration is swift, efficient and common to all market closures. We find that migrants are on average more active users in comparison to non-migrants and move preferentially towards the coexisting market with the highest trading volume. Our findings shed light on the resilience of the dark market ecosystem and we anticipate that they may inform future research on the self-organisation of emerging online markets.



There are no comments yet.


page 4

page 7

page 14

page 15

page 16

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.


Dark markets are commercial websites specialised in trading illicit goods. They are accessible via darknets (e.g., Tor) and vary in specialization, technology, and primary supported language. Silk Road, the first modern dark market launched in 2011, limited its sales to drugs while other dark markets allow the trading of weapons, fake IDs and stolen credit cards [1, 2]. Most markets facilitate trading between buyers and vendors of illicit goods, but some of them involve a single vendor only. Regardless of these differences, Bitcoin is the universally accepted currency, occasionally together with other cryptocurrencies.

Operating outside of law, dark markets do not offer any protection to customers or vendors. This has led to the proliferation of scam sales and market hacks. Furthermore, markets may suddenly disappear, causing significant losses to users. For example, Silk Road was shut down in 2013 by the FBI [3] and in the same year Sheep Marketplace market was closed by its own administrator, who vanished with million US dollars subtracted to its users [4]. Following these events, markets tried to prevent closure by deploying technologies such as IP[5], multisig[6] and rely more often on escrow services[7]. IP is an anonymous network layer designed to overcome censorship and multisig enables users to authorise a transaction through multi signatures. Tumblers (also known as mixers) are services which obscure the trail back to Bitcoin payments. Escrow services guarantee that markets do not hold users money, instead a trusted third party holds the money until users confirm they have received the shipment. Despite the introduction of these measures, market closures continued to occur, both to police seizures and scams.

However, this uncertainty has not prevented a steady growth of both users and revenue of dark markets. As of today, there are at least active dark markets [8]. The difficulty to identify relevant transactions from the Bitcoin blockchain has made it hard to quantify market volume [8, 10, 11, 12]

but the European authorities estimated dark markets drug sales from

to to be million dollars per year. A later study estimated that, in early 2016, dark markets drug sales were between million and million dollars per year. [9]. Recently, the market Berlusconi known mostly for selling stolen IDs was seised by the Italian police who estimated their annual transaction with million euros [2].

The growth and resilience of the dark markets have attracted the attention of the scientific community. The above mentioned difficulty to identify relevant transactions [8, 10, 11, 12] has forced researchers to rely mostly on data scraped from dark markets websites [11, 13] (but dark markets administrators actively fight web scraping, seen as a threat), or users surveys [14, 15]. Police shutdowns were shown to correlate with a sudden increase in drug listings in co-existing markets [16, 17], while the most comprehensive study on closures covered markets concluding ‘that the effect of law enforcement takedowns is mixed as best’ [11] and a recent analysis of a large police operation identified an impact of closures on the drugs’ supply and demand but not the prices [13]. Recent research on how to attribute Bitcoin anonymised addresses to named entities [18, 19, 20] has not been applied yet to investigate the dynamics of dark markets, and only in few cases identifying dark-market related transactions has been the focus of research [21].

Here, we investigate the dynamics of market closures by looking at markets in the period between June to July . We do so by investigating a novel dataset of Bitcoin transactions involving dark markets assembled on the basis of the most recent identification methods [22, 23, 24]. For the first time, we quantify the overall activity of the major dark markets, in terms of number of users and total volume traded. We reveal that the closure of a dark market, due to a police raid or an exit scam, affects only temporarily the market ecosystem activity, suggesting that dark markets are resilient. We provide the first systematic investigation of dark market users migration following an unexpected closure, and show that closures affects mostly low-active users, with highly-active users migrating quickly to a new market. Finally, we show that migrant users tend to coordinate, with 66% of them choosing the same new market, which is in most cases the one with largest volume.


Dark markets operate typically as an eBay for illicit goods where vendors advertise their products and consumers request the shipment through the website. Transactions flow from buyers to the dark market that then sends the money to sellers after buyers confirmation of receiving the goods. Consumers may leave reviews that contribute to vendors’ reputation [7]. After multiple scam closures, nowadays dark markets rely often on escrow systems. The dark market does not keep buyers’ bitcoins in local addresses but instead sends it to an escrow service. After the buyer’s confirmation, the escrow service transfer the money to the seller.

Our analysis relies on a novel dataset of dark market transactions on the Bitcoin blockchain. The ledger of Bitcoin transactions (the blockchain) is publicly available and can be retrieved through Bitcoin core [25] or a third-party API such as [26]. It consists of the entire list of transaction records, including time, transferred amount, origin and destination addresses. Addresses are identifiers of alphanumeric characters that can be generated at no cost by any user of Bitcoin, such that a single Bitcoin wallet can be associated to multiple addresses. In fact, to ensure privacy and security, most Bitcoin software and websites help users generate a new address for each transaction. Thus, blockchain data has to be pre-processed to map groups of addresses to individual users.

We used data pre-processed by Chainalysis following the approach detailed in [22, 23, 24]

. The pre-processing relies on state-of-the-art heuristics

[21, 18, 19, 20, 27], including co-spending clustering, intelligence-based clustering, behavioural clustering and entity identification through direct interaction [23]. These techniques rely on the observation of patterns in the Bitcoin protocol transactions and users behaviour. Chainalysis Identification of addresses related to illicit activities has been relied upon in many law enforcement investigations [28, 29]. Due to this critical use of data, rigorous investigation and avoidance of false positives is crucial. If an address can not be identified or clustered with certainty the address will be tagged unnamed. This means that some addresses might belong to a dark market but are not labelled as one (see more information on our dataset in Appendix 1.1, Figure 9).

We considered the entire transaction data of dark markets (see Appendix 1) between June th, and July th, . This dataset includes the major markets on the darknet as identified by law enforcement agencies reports [30, 3] and the World Health Organization [31]. We also considered the transactions of the users who interacted with one of these markets (dark market’s nearest neighbours) after their first interaction with a dark market. Thus, each market ecosystem can be represented as an egocentric network [32] of radius , where the market is the central node, its nearest neighbours represent market users, and direct edges represent transaction occurring either between the market and one of its neighbours, or between two neighbours. Figure 1 shows a schematic representation of our dataset, where transactions within the square are the ones included in the dataset. After removing transactions to/from cryptocurrency exchanges, the dataset contains million transactions among over million users. The total number of addresses which directly interacted with dark markets is million. The volume of transactions sent and received by dark markets addresses amount to billion dollars.

Figure 1: Dark market ego-network. Our dataset includes transaction between addresses belonging to a dark market (in red) and its nearest neighbours (in black), as well as the transactions between nearest neighbours and “other” Bitcoin addresses (in grey). Any transaction between two “other” nodes is excluded from our dataset. In this schematic representation, the dotted square includes transactions present in our dataset.

In order to gain information on the analysed markets, we collected additional data from the Gwern archive on dark markets closures [1]. We also relied on law enforcement documents on closures, and online forums [30, 31, 33] dedicated to discussing dark markets to compile comprehensive information (see Appendix 1). Out of the selected markets, performed exit scam, were raided, were voluntarily closed by their administrators, and are still active. Our dataset includes markets in Russian language, and the others are in English. Out of the markets, are markets dedicated to fake and stolen IDs and credit cards. The primary currency on these market is Bitcoin. In Figure 2, we present the lifetime of the selected markets and the reason behind their closure.

Figure 2: Dark markets lifetime. Each bar corresponds to a different dark market (see y-axis labels). Bars are coloured according to the reason behind closure: raided by the police (black), exit scam (dark blue), voluntary closure (blue). Light blue bars correspond to markets that are still active in November .


After removing transactions to/from cryptocurrency exchanges, the dataset contains transactions among users. The total number of users which directly interacted with dark market is . The volume of transactions sent and received by dark markets addresses amount to billion dollars, while the one received by dark markets address is USD billion. Table 2 reports characteristics of the markets considered, including overall number of users and transaction volume. The most active market in terms of number of users and traded volume is by far AlphaBay, followed by Hydra.

Market resilience

The capacity of the dark market ecosystem to recover following the closure of a market can be studied quantifying the evolution of the total volume traded by dark markets in time. Despite recurrent closures, we find that the number of markets has been relatively stable from (see Figure 3A). In addition, despite closures, the total weekly volume sent/received by dark market addresses has grown from until the end of (see Figure 3B). In fact, Moving Average Convergence Divergence (MACD) analysis [34] reveals that, following each dark market closure, the overall dark markets volume drops, but it recovers quickly after, typically within days, see Appendix 1. Starting from the end of , however, we observe a decrease in the total volume traded. It is important to note that, here, we considered the total volume (in American dollars) sent/received across the entire dark market egocentric network (See Figure 1).

Figure 3: Dark markets resilience. (A) The total number of active dark markets across time. (B) The total volume (in USD) exchanged by dark markets addresses. (C) The number of unique users interacting with dark markets. Dashed lines represent market closure due to law enforcement raid (in red), or any other reason (in black). Values are calculated using a time window of one week.

User migration

The observation that dark markets are resilient to closure suggests that users may move to other markets [13, 35]. We refer to this phenomenon as migration. In fact, migration was observed [36] after the closure of the AlphaBay market when other markets, namely Hansa Market and Dream market, experienced an abnormal spike in activity. In this section, we provide the first systematic investigation of dark market users migration, by studying the effects of multiple closures. We identify migrant users in the following way. For each market that was shut down, we identify users who started trading with another coexisting market following the closure. Thus, users who were already trading on multiple markets before closure are not considered migrants. Figure 4 shows the flows of migrant users between markets. The overall picture reveals a common behaviour across all closures since after each closure there is a flow of migrants to other coexisting markets.

Figure 4: Migration of users following a dark market closure. Flows of users migrating to another coexisting market following a closure. The arrowhead points to the direction of migration, and the width of the arrow represent the number of users. Markets are ordered clockwise according to the closing date in ascending order starting from Silk Road Marketplace.

An important question is which fraction of users involved in illicit trading continue to exchange with dark markets following a closure. The answer needs to consider that a large number of users interact only once across their life time. For example, a study based on data up to found that most of the minted Bitcoins were accumulated in addresses which never sent [19]. In our dataset of the users interacted only once. To identify users who stop trading with dark markets due to a market closure, we compute the fraction of “returning users” over time, meaning the fraction of all users active in a given week that are active also in the following week. After computing the fraction of returning users over time, we normalise it by the fraction of returning users at the time of closure (so that the normalised value of returning at that day is ). Then, we consider the median across market closures. We find that, days after the closure of a dark market, only of the expected number of returning users interacts to another market. This result indicates that the closure does have an effect, albeit the vast majority of users seems to behave as normal (from the point of view of the following interaction).

Who is migrating?

The observation that some users stop trading following a dark market closure but the total volume traded in dark markets does not decrease could indicate that migrant users are on average more active than others.

We test this hypothesis by computing the activity of migrant users before and after closure. We refer to the first dark market a user was interacting with as its home market. For all users (migrant and non-migrant), we measure the total volume exchanged with any other user in our dataset including the home market. We find that the median volume exchanged by migrant users is larger than the volume exchanged by non-migrant users (see Figure 5A), with the median volume exchanged summing to USD for migrant users and to USD for non-migrant users. The mean on the other hand is USD and USD for migrant and non-migrant users respectively (see Appendix 1 for the spending distribution of migrant and non-migrants). Similar conclusions can be drawn by considering the volume exchanged with the home market only, which has median value of USD and for non-migrant users and USD for migrant users and a mean value of USD and USD for migrant and non-migrant users respectively (see Figure 5B).

The activity distribution of migrants is significantly different from the non-migrant users’ distribution (using Kolmogorov–Smirnov test, , see Table 3 in Appendix 1).

Figure 5: Migrants are more active than other users. (A) Total volume exchanged by migrant users (orange box-plots) and non-migrant users (blue box-plots) before the closure of their home market. (B)

Volume exchanged by migrant users (orange box-plots) and non-migrant users (blue box-plots) with their home market. The horizontal line in each box represents the median. The lower box boundary shows the first quartile, and the upper one shows the third quartile. The whiskers show the minimum and maximum values within the

lower and upper interquartile range.

Coordination in the dark

In our dataset, in all cases but one, users could choose between at least two surviving markets when their home market closed. A natural question is therefore how migrant users decide where to migrate.

In Figure 6, we show the evolution of the trading volume shares of the shut down market and the top two destination markets in the periods preceding and following a closure. We find that the top two destination markets experience an increase in share starting days after the closure, and saturating after about days to around .

Figure 6: Migration decision and impact. (A) The median share (across closures) of a closed market (blue market), the top destination market for the migrant users (orange line) and the second top destination for migrant users (green line). The shaded area represents the

interquartile range. Value are computed using a rolling window of one week. Figures B-D show the probability of a market to be chosen for migration given its rank at the time of coexisting market closure in comparison to the random model. Markets are ranked in descending order according to (

B) the number of overlapping users they have with the closed market excluding Russian markets (C) the total trading volume in USD and (D) the total trading volume in USD excluding Russian markets from the ranking. The random model in the figures B-D represent a model where users can move to any existent market with equal probability.

We investigate the characteristics of the first destination market for migrant users, by ranking coexisting markets according to the total trading volume in USD at the time of closure and the total number of common users between the shut down and the coexisting market before closure. We find that, regardless of the reason behind closure, users do not migrate randomly and chose to move to the market with the highest trading volume which, in some cases, is also the market with the highest number of common users.

Focusing on the first week after closure, we find that, on average, one market absorbs of all migrant users. Only of the users migrate to more than one coexisting market simultaneously after the closure. What is this market? Figure 6A shows that, in of the closures considered, it is the one sharing the larger number of common users with the closed market, while the chances that users select the second and the third rank is . Users do not choose to migrate to markets with rank lower than the third.

Figure 6B shows that, when markets are ranked according to the volume of their transactions, the second-largest is preferred in the majority of cases (). However, a closer look at the data reveals that the Russian market occupies often the top ranks in terms of volume but it tends not to be the preferred migration harbour, probably due language and geographical barriers. Excluding the Russian market from the ranking, in fact, we find that the largest market is selected of the times (see Figure 6C).

We compare the users’ decisions with a null random model, where at each closure users move with equal probability to any of the existent markets. The random probability of rank to be chosen for migration after closures is equal to

where is the number of coexisting markets at the time of closure . We find that the results of the random procedure are significantly different from actual data, confirm the existence of a strong coordination between users (see Figure 6)


Considering a novel dataset of Bitcoin transactions for large dark markets and their users, we investigated how the darknet market ecosystem is affected by the unexpected closure of a market in the period between and . The markets under study differed in speciality, language, and date of creation, and of them were closed abruptly due to reasons including police raids and scams. We found that the total volume traded on dark markets drops only temporarily following a dark market closure, revealing that the ecosystem exhibits a remarkable resilience. We identified the origin of this resilience, by focusing on individual users, and unveiled a swift and ubiquitous phenomenon of migration between recently closed markets and other coexisting ones. We found that migrants are more active in terms of total transaction volume compared to users who do not migrate, that they tend to privilege the same unique market as destination and that this is generally the biggest market in terms of the total trading volume. Our findings shed new light on the consequences of sudden closure and/or police raids on dark market, which had been previously raised in the literature and among law enforcement entities [30, 9, 13]. Interesting future research directions include the role of market closure on the emergence of new markets, refining the analysis to investigate whether scam closures and police raids may have so-far neglected effects on user migration, and broaden the research to include the effect of online forums on the performance of existing markets as well as on the migration choices after a closure [33].

Authors contribution

A.E., L.A., A.T. and A.B. designed the research; L.R. acquired the data. L.R. and A.E. prepared and cleansed the data, A.E. performed the measurements. A.E., L.A., D.G., A.T. and A.B. analysed the data. A.E., L.A., A.T. and A.B. wrote the manuscript. All authors discussed the results and commented on the manuscript.

Data and materials availability

All data needed to evaluate the conclusions in the paper are present in the paper. Additional data related to this paper may be requested from the authors.


  • [1] Gwern., 2019. Accessed: 3 July 2019.
  • [2] Pierluigi Paganini. Italian police shut down darkweb berlusconi market and arrested admins., 2019. Accessed: 8 Novemeber 2019.
  • [3] United states of america : Vs. ross william ulbricht. smb/UlbrichtCriminalComplaint.pdf, 2019. Accessed: 10 July 2019.
  • [4] Coindesk., 2019. Accessed: 28 August 2019.
  • [5] Bassam Zantout, Ramzi Haraty, et al. I2p data communication system. In Proceedings of ICN, pages 401–409. Citeseer, 2011.
  • [6] Vitalik Buterin. Bitcoin multisig wallet: the future of bitcoin. Bitcoin Magazine URL: https://bitcoinmagazine. com/11108/multisig-future-bitcoin, 2014.
  • [7] Frank Wehinger. The dark net: Self-regulation dynamics of illegal online markets for identities and related services. In 2011 European Intelligence and Security Informatics Conference, pages 209–213. IEEE, 2011.
  • [8] Nicolas Christin. Traveling the silk road: A measurement analysis of a large anonymous online marketplace. In Proceedings of the 22nd international conference on World Wide Web, pages 213–224. ACM, 2013.
  • [9] United Nations Office on Drugs and Crime. World drug report 2018. United Nations Publications, 2018.
  • [10] Judith Aldridge and David Décary-Hétu. Not an’ebay for drugs’: the cryptomarket’silk road’as a paradigm shifting criminal innovation. Available at SSRN 2436643, 2014.
  • [11] Kyle Soska and Nicolas Christin. Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. In 24th USENIX Security Symposium (USENIX Security 15), pages 33–48, 2015.
  • [12] Diana S Dolliver. Evaluating drug trafficking on the tor network: Silk road 2, the sequel. International Journal of Drug Policy, 26(11):1113–1123, 2015.
  • [13] David Décary-Hétu and Luca Giommoni. Do police crackdowns disrupt drug cryptomarkets? a longitudinal analysis of the effects of operation onymous. Crime, Law and Social Change, 67(1):55–75, 2017.
  • [14] Monica J Barratt, Jason A Ferris, and Adam R Winstock. Use of silk r oad, the online drug marketplace, in the united kingdom, a ustralia and the united states. Addiction, 109(5):774–783, 2014.
  • [15] Marie Claire Van Hout and Tim Bingham. ‘silk road’, the virtual drug marketplace: A single case study of user experiences. International Journal of Drug Policy, 24(5):385–391, 2013.
  • [16] Joe Van Buskirk, Amanda Roxburgh, Michael Farrell, and Lucy Burns. The closure of the s ilk r oad: what has this meant for online drug trading? Addiction, 109(4):517–518, 2014.
  • [17] Julia Buxton and Tim Bingham. The rise and challenge of dark net drug markets. Policy brief, 7:1–24, 2015.
  • [18] Paolo Tasca, Adam Hayes, and Shaowen Liu. The evolution of the bitcoin economy: extracting and analyzing the network of payment relationships. The Journal of Risk Finance, 19(2):94–126, 2018.
  • [19] Dorit Ron and Adi Shamir. Quantitative analysis of the full bitcoin transaction graph. In International Conference on Financial Cryptography and Data Security, pages 6–24. Springer, 2013.
  • [20] Martin Harrigan and Christoph Fretter. The unreasonable effectiveness of address clustering. In 2016 Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC/ATC/ScalCom/CBDCom/IoP/SmartWorld), pages 368–373. IEEE, 2016.
  • [21] Sarah Meiklejohn, Marjori Pomarole, Grant Jordan, Kirill Levchenko, Damon McCoy, Geoffrey M Voelker, and Stefan Savage. A fistful of bitcoins: characterizing payments among men with no names. In Proceedings of the 2013 conference on Internet measurement conference, pages 127–140. ACM, 2013.
  • [22]

    Danny Yuxing Huang, Maxwell Matthaios Aliapoulios, Vector Guo Li, Luca Invernizzi, Elie Bursztein, Kylie McRoberts, Jonathan Levin, Kirill Levchenko, Alex C Snoeren, and Damon McCoy.

    Tracking ransomware end-to-end. In 2018 IEEE Symposium on Security and Privacy (SP), pages 618–631. IEEE, 2018.
  • [23] Mikkel Alexander Harlev, Haohua Sun Yin, Klaus Christian Langenheldt, Raghava Mukkamala, and Ravi Vatrapu.

    Breaking bad: De-anonymising entity types on the bitcoin blockchain using supervised machine learning.

    In Proceedings of the 51st Hawaii International Conference on System Sciences, 2018.
  • [24] Daniel Goldsmith, Kim Grauer, and Yonah Shmalo. Analyzing hack subnetworks in the bitcoin transaction graph. arXiv preprint arXiv:1910.13415, 2019.
  • [25] Bitcoin. bitcoin-core., 2019. Accessed: 3 July 2019.
  • [26] BLOCKCHAIN., 2019. Accessed: 3 July 2019.
  • [27] Elli Androulaki, Ghassan O Karame, Marc Roeschlin, Tobias Scherer, and Srdjan Capkun. Evaluating user privacy in bitcoin. In International Conference on Financial Cryptography and Data Security, pages 34–51. Springer, 2013.
  • [28] LILY HAY NEWMAN. How a bitcoin trail led to a massive dark web child-porn site takedown., 2019.
  • [29] YoonJae Chung. Cracking the code: How the us government tracks bitcoin transactions. ANALYSIS OF APPLIED MATHEMATICS, page 152, 2019.
  • [30] European Monitoring Centre for Drugs and Drug Addiction. DRUGS AND THE DARKNET: PERSPECTIVES FOR ENFORCEMENT, RESEARCH AND POLICY. European Monitoring Centre for Drugs and Drug Addiction, 2017.
  • [31] United Nations Office on Drugs and Crime. World drug report 2019. United Nations Publications, 2019.
  • [32] Peter V Marsden. Egocentric and sociocentric measures of network centrality. Social networks, 24(4):407–422, 2002.
  • [33] Maryam Zamani, Fereshteh Rabbani, Attila Horicsányi, Anna Zafeiris, and Tamas Vicsek. Differences in structure and dynamics of networks retrieved from dark and public web forums. Physica A: Statistical Mechanics and its Applications, 525:326–336, 2019.
  • [34] Gerald Appel. The moving average convergence-divergence method. Great Neck, NY: Signalert, pages 1647–1691, 1979.
  • [35] Scott W Duxbury and Dana L Haynie. Building them up, breaking them down: Topology, vendor selection patterns, and a digital drug market’s robustness to disruption. Social Networks, 52:238–250, 2018.
  • [36] Martin Dittus., 2019. Accessed: 28 August 2019.
  • [37] Julia Heidemann, Mathias Klier, and Florian Probst. Identifying key users in online social networks: A pagerank based approach. 2010.
  • [38] Michael Fleder, Michael S Kester, and Sudeep Pillai. Bitcoin transaction graph analysis. arXiv preprint arXiv:1502.01657, 2015.
  • [39] Wikipedia Now Accepts Bitcoin Donations., 2019. Accessed: 1 October 2019.
  • [40] Chainalysis, inc., 2019. Accessed: 10 July 2019.

1 Appendix

1.1 Clustering techniques

In Bitcoin, multiple addresses can belong to one user; grouping these addresses reduces the complexity of the ledger and Bitcoin anonymity [19]. Clustering techniques rely on how Bitcoin’s protocol works, users behaviour on the blockchain, Bitcoin’s transaction graph structure and finally, machine learning. Methods relying on Bitcoin’s protocol specifically exploit what is known as change addresses: Bitcoins available in an address have to be spent as a whole. Figure 7 shows an example of a change address. User A’s wallet has two addresses, one contains BTC and another has BTC. User would like to transfer BTC to user , as shown in Figure 7A. After transferring the BTC to , the change (BTC) will not stay in the same address. Bitcoin protocol will create another address, also assigned to , where the BTC change will be stored. By observing this pattern, a heuristic technique proposed in [27] suggests that these addresses can be grouped, as they belong to one user.

Figure 7: How Bitcoin’s protocol handles transactions with change. (A) A transaction between users and user , where wants to transfer Bitcoins to . User has two addresses, one with Bitcoin and the other with Bitcoins. User has one address, containing Bitcoin. (B) How a transaction is conducted under Bitcoin protocol. User first address transfers Bitcoin to user first address. The change of Bitcoin does not stay in User A first address , but appears, instead, as another transaction to a new address. The dotted boundaries in both figures represent a grouping of these addresses, as they belong to one user. A solid arrow represents an executed Bitcoin transaction, while the dotted arrow represents a desired transaction.

Since users can have multiple addresses, they can use multiple of these addresses to transfer Bitcoins in a single transaction. For example, Figure 8A shows a case where user controls different addresses. Each address has a different amount of Bitcoins, , and respectively. User wants to transfer Bitcoins to user , and two addresses will be used to complete the transaction as shown in Figure 8B. This observation allows the grouping of these two addresses as a single user [27].

Figure 8: Sending from multiple inputs in Bitcoin (A) A desired transaction between users and , where wants to send Bitcoins to user . User has different addresses with , and Bitcoins respectively. User has one address containing Bitcoin. (B) How the transaction will be conducted under the Bitcoin protocol. User will use two addresses to complete the transaction. Both addresses will send to one address belonging to user . The dotted boundaries in both figures represent a grouping of these addresses as they belong to one user. The solid arrows represent an already executed Bitcoin transaction while the dotted arrow represents a desired transaction.

The work in [21] challenged these heuristics, showing the possibility of having false positives and not taking into consideration changes in the protocol. The work suggests instead a manual process, where the behaviour of each entity is investigated. Page rank (network centrality measure [37]) was also used to identify important addresses [38]; however, the addresses were already grouped using the heuristics introduced by [27]. Machine learning was also shown to identify addresses which should be grouped as one with accuracy.

Mapping addresses to an actual identity is more challenging. Some entities already publish their public key for donation and payment, such as Wikimedia Foundation [39]. The only research that introduced a method for mapping a collection of addresses to a real-world identity is [21], through direct interaction with the address. In this work, researchers directly engaged in transactions with different services including mining pools, exchanges, dark markets and gambling websites.

The introduction of these heuristics did not only challenge Bitcoin’s anonymity but also eased the regulation of Bitcoin. Companies specialising in blockchain analytics started to capitalise on these heuristics and provide tools for exchanges and law enforcement entities to facilitate regulatory efforts. For our analysis of dark markets, our data was provided by Chainalysis [40], which is a blockchain analytics company. Chainalysis aided several investigations led by different law enforcement entities, including the United States Internal Revenue Service (IRS) [29].

Our dataset sampling approach (from the entire Bitcoin transactions) deploys a complex network perspective. Transactions on the blockchain can be modelled as a directed weighted graph where a node represents a user, and a directed edge between two nodes and represents a transaction from user to user . Depending on the clustering algorithm, a node can represent one address or multiple addresses. A node can also be labelled as a specific entity or unlabelled (unnamed). Figure 9 shows a sketch of the network and the different possible meanings of a node. For example in Figure 9, the black unnamed node on the right side is a representation of two different addresses clustered together, however, they were not attributed to an entity thus remained unnamed.

Figure 9: A dark market’s Bitcoin transaction network. A schematic representation of our dataset as a complex network. Nodes represent users, and a direct edge between two nodes represents a transaction in the direction of the edge. Nodes can represent different abstractions as shown by the dotted rhombus. Starting from the right side, the unnamed black node represents a cluster of two different addresses which, however, was not attributed to a specific entity. The dark market node(in dark red, Silk Road Market), is a representation of addresses and attributed by the algorithm to the market. The black named node on the left side of Silk Road Market node is a representation of addresses and named to belong to a specific entity. Finally, the black unnamed node at the bottom left side of the figure, represents one address.

Dark markets information

In this section we provide data on each market understudy. Table 1 shows general information on the dark markets included in our dataset.

Name Start date End date Closure reason Sales
Abraxas Market scam drugs
Acropolis Market voluntary mixed
Agora Market voluntary mixed
AlphaBay Market raided mixed
Apollon Market active active drugs
Babylon Market raided drugs
Berlusconi Market active active mixed active active credits
Black Bank Market scam mixed
Blue Sky Marketplace raided drugs
Dream Market voluntary mixed
East India Company Market scam drugs
Empire Market active active mixed
Evolution Market scam drugs
German Plaza Market scam mixed
Hansa Market raided drugs
House of Lions Market raided drugs
Hydra Marketplace active active mixed
Middle Earth Marketplace scam mixed
Nucleus Market scam mixed
Olympus Market scam mixed
Oxygen Market scam drugs
Pandora OpenMarket raided drugs
Russian Anonymous Marketplace raided mixed
Sheep Marketplace scam drugs
Silk Road Marketplace raided mixed
Silk Road 2 Market raided mixed
Silk Road 3.1 active active drugs
TradeRoute Market scam mixed
Unicc active active credits
Wall Street Market raided mixed
Table 1: Dark markets information. Information on the selected dark markets included in our dataset. For each market, the table states the name of the market, the start and end dates of its operation, the closure reason (if applicable) and the type of products sold by the market. “Drugs” indicates that the primary products sold on the market are drugs while “credits” indicates the market specializes in fake IDs and credit cards and “mixed” indicates the market sells both types of products

Table 2 show each market total sent and received amount in USD and the number of users sent and received to/from the dark market.

Volume sent
Volume received
Abraxas Market
Acropolis Market
Agora Market
AlphaBay Market
Apollon Market
Babylon Market
Berlusconi Market
Black Bank Market
Blue Sky Marketplace
Dream Market
East India Company Market
Empire Market
Evolution Market
German Plaza Market
Hansa Market
House of Lions Market
Hydra Marketplace
Middle Earth Marketplace
Nucleus Market
Olympus Market
Oxygen Market
Pandora OpenMarket
Russian Anonymous Marketpl.
Sheep Marketplace
Silk Road 2 Market
Silk Road 3.1
Silk Road Marketplace
TradeRoute Market
Wall Street Market
Table 2: Dark markets overall activity. The activity of the dark markets as observed in our dataset. For each market, the table reports the total volume sent and received by dark market addresses. It also reports the total number of users who sent (in-degree) and received (out-degree) Bitcoins to/from dark market addresses.

Moving Average Convergence Divergence Analysis

To further quantify the changes in dark markets traded volume, we calculate the Moving Average Convergence Divergence (MACD) of the weekly trading volume. The MACD is an trading indicator used in stock markets to quantify price movements and fluctuations. It is composed of three time series. Firstly, the MACD, calculated as the difference between the exponential weighted moving average of the trading volume for a period of weeks and the exponential weighted moving average of the trading volume for a period of weeks. Secondly, the signal line, computed as the weeks exponential weighted moving average of the MACD time series. Finally, the last time series, known as the histogram, representing the difference between the MACD and the signal line.

Figure 10 shows the indicator behaviour across time. For each closure, there is a fluctuation in the MACD line and the histogram line indicates a downward change in the overall dark markets volume. However, an upward change can be observed after the closures indicating that dark markets recover.

Figure 10: Moving Average Convergence Divergence (MACD) (A) The MACD (blue line) and MACD signal line (orange line) for dark markets trading volume from till . (B) The MACD histogram (blue line) for the dark markets trading volume from to the end of . (C) The MACD (blue line) and MACD (orange line) signal line for dark markets trading volume from until July, . (D) The MACD histogram (blue line) for the dark markets trading volume from until July, . Vertical dashed lines represent markets closure.

Migrant and non migrants

In the main text we show that for each closed market, migrant users are more active in terms of the total amount they send and received overall, specifically with the closed dark market. In this section, we show the distribution of the migrants and non-migrants activity across all dark markets. Figure 11 shows that activity for migrants overall is higher than the non-migrants.

Figure 11: Migrant vs. non-migrants activity distribution The distribution of the total volume sent and received across all closed dark markets for migrants (orange line) and non migrants (blue line).

Table 3 shows the results of a Kolmogorov smirnov test between the migrant and non migrant activity distribution.

Dark market -value (dark market transactions) -value (all transactions)
Abraxas Market
Agora Market
AlphaBay Market
Babylon Market
Black Bank Market
Blue Sky Marketplace
Dream Market
Evolution Market
German Plaza Market
Hansa Market
Middle Earth Marketplace
Nucleus Market
Olympus Market
Pandora OpenMarket
Russian Anonymous Marketplace
Sheep Marketplace
Silk Road 2 Market
Silk Road Marketplace
TradeRoute Market
Wall Street Market
Table 3: values between the migrants and stayers The table shows the value results from the Kolmogorov smirnov test between the migrant and non migrants users distributions. The table report the results for the transactions to/from dark markets and the results for all the transactions.