Dark markets are commercial websites specialised in trading illicit goods. They are accessible via darknets (e.g., Tor) and vary in specialization, technology, and primary supported language. Silk Road, the first modern dark market launched in 2011, limited its sales to drugs while other dark markets allow the trading of weapons, fake IDs and stolen credit cards [1, 2]. Most markets facilitate trading between buyers and vendors of illicit goods, but some of them involve a single vendor only. Regardless of these differences, Bitcoin is the universally accepted currency, occasionally together with other cryptocurrencies.
Operating outside of law, dark markets do not offer any protection to customers or vendors. This has led to the proliferation of scam sales and market hacks. Furthermore, markets may suddenly disappear, causing significant losses to users. For example, Silk Road was shut down in 2013 by the FBI  and in the same year Sheep Marketplace market was closed by its own administrator, who vanished with million US dollars subtracted to its users . Following these events, markets tried to prevent closure by deploying technologies such as IP, multisig and rely more often on escrow services. IP is an anonymous network layer designed to overcome censorship and multisig enables users to authorise a transaction through multi signatures. Tumblers (also known as mixers) are services which obscure the trail back to Bitcoin payments. Escrow services guarantee that markets do not hold users money, instead a trusted third party holds the money until users confirm they have received the shipment. Despite the introduction of these measures, market closures continued to occur, both to police seizures and scams.
However, this uncertainty has not prevented a steady growth of both users and revenue of dark markets. As of today, there are at least active dark markets . The difficulty to identify relevant transactions from the Bitcoin blockchain has made it hard to quantify market volume [8, 10, 11, 12]
but the European authorities estimated dark markets drug sales fromto to be million dollars per year. A later study estimated that, in early 2016, dark markets drug sales were between million and million dollars per year. . Recently, the market Berlusconi known mostly for selling stolen IDs was seised by the Italian police who estimated their annual transaction with million euros .
The growth and resilience of the dark markets have attracted the attention of the scientific community. The above mentioned difficulty to identify relevant transactions [8, 10, 11, 12] has forced researchers to rely mostly on data scraped from dark markets websites [11, 13] (but dark markets administrators actively fight web scraping, seen as a threat), or users surveys [14, 15]. Police shutdowns were shown to correlate with a sudden increase in drug listings in co-existing markets [16, 17], while the most comprehensive study on closures covered markets concluding ‘that the effect of law enforcement takedowns is mixed as best’  and a recent analysis of a large police operation identified an impact of closures on the drugs’ supply and demand but not the prices . Recent research on how to attribute Bitcoin anonymised addresses to named entities [18, 19, 20] has not been applied yet to investigate the dynamics of dark markets, and only in few cases identifying dark-market related transactions has been the focus of research .
Here, we investigate the dynamics of market closures by looking at markets in the period between June to July . We do so by investigating a novel dataset of Bitcoin transactions involving dark markets assembled on the basis of the most recent identification methods [22, 23, 24]. For the first time, we quantify the overall activity of the major dark markets, in terms of number of users and total volume traded. We reveal that the closure of a dark market, due to a police raid or an exit scam, affects only temporarily the market ecosystem activity, suggesting that dark markets are resilient. We provide the first systematic investigation of dark market users migration following an unexpected closure, and show that closures affects mostly low-active users, with highly-active users migrating quickly to a new market. Finally, we show that migrant users tend to coordinate, with 66% of them choosing the same new market, which is in most cases the one with largest volume.
Dark markets operate typically as an eBay for illicit goods where vendors advertise their products and consumers request the shipment through the website. Transactions flow from buyers to the dark market that then sends the money to sellers after buyers confirmation of receiving the goods. Consumers may leave reviews that contribute to vendors’ reputation . After multiple scam closures, nowadays dark markets rely often on escrow systems. The dark market does not keep buyers’ bitcoins in local addresses but instead sends it to an escrow service. After the buyer’s confirmation, the escrow service transfer the money to the seller.
Our analysis relies on a novel dataset of dark market transactions on the Bitcoin blockchain. The ledger of Bitcoin transactions (the blockchain) is publicly available and can be retrieved through Bitcoin core  or a third-party API such as Blockchain.com . It consists of the entire list of transaction records, including time, transferred amount, origin and destination addresses. Addresses are identifiers of alphanumeric characters that can be generated at no cost by any user of Bitcoin, such that a single Bitcoin wallet can be associated to multiple addresses. In fact, to ensure privacy and security, most Bitcoin software and websites help users generate a new address for each transaction. Thus, blockchain data has to be pre-processed to map groups of addresses to individual users.
. The pre-processing relies on state-of-the-art heuristics[21, 18, 19, 20, 27], including co-spending clustering, intelligence-based clustering, behavioural clustering and entity identification through direct interaction . These techniques rely on the observation of patterns in the Bitcoin protocol transactions and users behaviour. Chainalysis Identification of addresses related to illicit activities has been relied upon in many law enforcement investigations [28, 29]. Due to this critical use of data, rigorous investigation and avoidance of false positives is crucial. If an address can not be identified or clustered with certainty the address will be tagged unnamed. This means that some addresses might belong to a dark market but are not labelled as one (see more information on our dataset in Appendix 1.1, Figure 9).
We considered the entire transaction data of dark markets (see Appendix 1) between June th, and July th, . This dataset includes the major markets on the darknet as identified by law enforcement agencies reports [30, 3] and the World Health Organization . We also considered the transactions of the users who interacted with one of these markets (dark market’s nearest neighbours) after their first interaction with a dark market. Thus, each market ecosystem can be represented as an egocentric network  of radius , where the market is the central node, its nearest neighbours represent market users, and direct edges represent transaction occurring either between the market and one of its neighbours, or between two neighbours. Figure 1 shows a schematic representation of our dataset, where transactions within the square are the ones included in the dataset. After removing transactions to/from cryptocurrency exchanges, the dataset contains million transactions among over million users. The total number of addresses which directly interacted with dark markets is million. The volume of transactions sent and received by dark markets addresses amount to billion dollars.
In order to gain information on the analysed markets, we collected additional data from the Gwern archive on dark markets closures . We also relied on law enforcement documents on closures, and online forums [30, 31, 33] dedicated to discussing dark markets to compile comprehensive information (see Appendix 1). Out of the selected markets, performed exit scam, were raided, were voluntarily closed by their administrators, and are still active. Our dataset includes markets in Russian language, and the others are in English. Out of the markets, are markets dedicated to fake and stolen IDs and credit cards. The primary currency on these market is Bitcoin. In Figure 2, we present the lifetime of the selected markets and the reason behind their closure.
After removing transactions to/from cryptocurrency exchanges, the dataset contains transactions among users. The total number of users which directly interacted with dark market is . The volume of transactions sent and received by dark markets addresses amount to billion dollars, while the one received by dark markets address is USD billion. Table 2 reports characteristics of the markets considered, including overall number of users and transaction volume. The most active market in terms of number of users and traded volume is by far AlphaBay, followed by Hydra.
The capacity of the dark market ecosystem to recover following the closure of a market can be studied quantifying the evolution of the total volume traded by dark markets in time. Despite recurrent closures, we find that the number of markets has been relatively stable from (see Figure 3A). In addition, despite closures, the total weekly volume sent/received by dark market addresses has grown from until the end of (see Figure 3B). In fact, Moving Average Convergence Divergence (MACD) analysis  reveals that, following each dark market closure, the overall dark markets volume drops, but it recovers quickly after, typically within days, see Appendix 1. Starting from the end of , however, we observe a decrease in the total volume traded. It is important to note that, here, we considered the total volume (in American dollars) sent/received across the entire dark market egocentric network (See Figure 1).
The observation that dark markets are resilient to closure suggests that users may move to other markets [13, 35]. We refer to this phenomenon as migration. In fact, migration was observed  after the closure of the AlphaBay market when other markets, namely Hansa Market and Dream market, experienced an abnormal spike in activity. In this section, we provide the first systematic investigation of dark market users migration, by studying the effects of multiple closures. We identify migrant users in the following way. For each market that was shut down, we identify users who started trading with another coexisting market following the closure. Thus, users who were already trading on multiple markets before closure are not considered migrants. Figure 4 shows the flows of migrant users between markets. The overall picture reveals a common behaviour across all closures since after each closure there is a flow of migrants to other coexisting markets.
An important question is which fraction of users involved in illicit trading continue to exchange with dark markets following a closure. The answer needs to consider that a large number of users interact only once across their life time. For example, a study based on data up to found that most of the minted Bitcoins were accumulated in addresses which never sent . In our dataset of the users interacted only once. To identify users who stop trading with dark markets due to a market closure, we compute the fraction of “returning users” over time, meaning the fraction of all users active in a given week that are active also in the following week. After computing the fraction of returning users over time, we normalise it by the fraction of returning users at the time of closure (so that the normalised value of returning at that day is ). Then, we consider the median across market closures. We find that, days after the closure of a dark market, only of the expected number of returning users interacts to another market. This result indicates that the closure does have an effect, albeit the vast majority of users seems to behave as normal (from the point of view of the following interaction).
Who is migrating?
The observation that some users stop trading following a dark market closure but the total volume traded in dark markets does not decrease could indicate that migrant users are on average more active than others.
We test this hypothesis by computing the activity of migrant users before and after closure. We refer to the first dark market a user was interacting with as its home market. For all users (migrant and non-migrant), we measure the total volume exchanged with any other user in our dataset including the home market. We find that the median volume exchanged by migrant users is larger than the volume exchanged by non-migrant users (see Figure 5A), with the median volume exchanged summing to USD for migrant users and to USD for non-migrant users. The mean on the other hand is USD and USD for migrant and non-migrant users respectively (see Appendix 1 for the spending distribution of migrant and non-migrants). Similar conclusions can be drawn by considering the volume exchanged with the home market only, which has median value of USD and for non-migrant users and USD for migrant users and a mean value of USD and USD for migrant and non-migrant users respectively (see Figure 5B).
Coordination in the dark
In our dataset, in all cases but one, users could choose between at least two surviving markets when their home market closed. A natural question is therefore how migrant users decide where to migrate.
In Figure 6, we show the evolution of the trading volume shares of the shut down market and the top two destination markets in the periods preceding and following a closure. We find that the top two destination markets experience an increase in share starting days after the closure, and saturating after about days to around .
We investigate the characteristics of the first destination market for migrant users, by ranking coexisting markets according to the total trading volume in USD at the time of closure and the total number of common users between the shut down and the coexisting market before closure. We find that, regardless of the reason behind closure, users do not migrate randomly and chose to move to the market with the highest trading volume which, in some cases, is also the market with the highest number of common users.
Focusing on the first week after closure, we find that, on average, one market absorbs of all migrant users. Only of the users migrate to more than one coexisting market simultaneously after the closure. What is this market? Figure 6A shows that, in of the closures considered, it is the one sharing the larger number of common users with the closed market, while the chances that users select the second and the third rank is . Users do not choose to migrate to markets with rank lower than the third.
Figure 6B shows that, when markets are ranked according to the volume of their transactions, the second-largest is preferred in the majority of cases (). However, a closer look at the data reveals that the Russian market occupies often the top ranks in terms of volume but it tends not to be the preferred migration harbour, probably due language and geographical barriers. Excluding the Russian market from the ranking, in fact, we find that the largest market is selected of the times (see Figure 6C).
We compare the users’ decisions with a null random model, where at each closure users move with equal probability to any of the existent markets. The random probability of rank to be chosen for migration after closures is equal to
where is the number of coexisting markets at the time of closure . We find that the results of the random procedure are significantly different from actual data, confirm the existence of a strong coordination between users (see Figure 6)
Considering a novel dataset of Bitcoin transactions for large dark markets and their users, we investigated how the darknet market ecosystem is affected by the unexpected closure of a market in the period between and . The markets under study differed in speciality, language, and date of creation, and of them were closed abruptly due to reasons including police raids and scams. We found that the total volume traded on dark markets drops only temporarily following a dark market closure, revealing that the ecosystem exhibits a remarkable resilience. We identified the origin of this resilience, by focusing on individual users, and unveiled a swift and ubiquitous phenomenon of migration between recently closed markets and other coexisting ones. We found that migrants are more active in terms of total transaction volume compared to users who do not migrate, that they tend to privilege the same unique market as destination and that this is generally the biggest market in terms of the total trading volume. Our findings shed new light on the consequences of sudden closure and/or police raids on dark market, which had been previously raised in the literature and among law enforcement entities [30, 9, 13]. Interesting future research directions include the role of market closure on the emergence of new markets, refining the analysis to investigate whether scam closures and police raids may have so-far neglected effects on user migration, and broaden the research to include the effect of online forums on the performance of existing markets as well as on the migration choices after a closure .
A.E., L.A., A.T. and A.B. designed the research; L.R. acquired the data. L.R. and A.E. prepared and cleansed the data, A.E. performed the measurements. A.E., L.A., D.G., A.T. and A.B. analysed the data. A.E., L.A., A.T. and A.B. wrote the manuscript. All authors discussed the results and commented on the manuscript.
Data and materials availability
All data needed to evaluate the conclusions in the paper are present in the paper. Additional data related to this paper may be requested from the authors.
-  Gwern. gwern.net/dnm-survival. https://www.gwern.net/DNM-survival, 2019. Accessed: 3 July 2019.
-  Pierluigi Paganini. Italian police shut down darkweb berlusconi market and arrested admins. https://securityaffairs.co/wordpress/93603/cyber-crime/berlusconi-market-darkweb.html, 2019. Accessed: 8 Novemeber 2019.
-  United states of america : Vs. ross william ulbricht. https://www.cs.columbia.edu/ smb/UlbrichtCriminalComplaint.pdf, 2019. Accessed: 10 July 2019.
-  Coindesk. www.coindesk.com/sheep-marketplace-track-stolen-bitcoins. https://www.coindesk.com/sheep-marketplace-track-stolen-bitcoins, 2019. Accessed: 28 August 2019.
-  Bassam Zantout, Ramzi Haraty, et al. I2p data communication system. In Proceedings of ICN, pages 401–409. Citeseer, 2011.
-  Vitalik Buterin. Bitcoin multisig wallet: the future of bitcoin. Bitcoin Magazine URL: https://bitcoinmagazine. com/11108/multisig-future-bitcoin, 2014.
-  Frank Wehinger. The dark net: Self-regulation dynamics of illegal online markets for identities and related services. In 2011 European Intelligence and Security Informatics Conference, pages 209–213. IEEE, 2011.
-  Nicolas Christin. Traveling the silk road: A measurement analysis of a large anonymous online marketplace. In Proceedings of the 22nd international conference on World Wide Web, pages 213–224. ACM, 2013.
-  United Nations Office on Drugs and Crime. World drug report 2018. United Nations Publications, 2018.
-  Judith Aldridge and David Décary-Hétu. Not an’ebay for drugs’: the cryptomarket’silk road’as a paradigm shifting criminal innovation. Available at SSRN 2436643, 2014.
-  Kyle Soska and Nicolas Christin. Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. In 24th USENIX Security Symposium (USENIX Security 15), pages 33–48, 2015.
-  Diana S Dolliver. Evaluating drug trafficking on the tor network: Silk road 2, the sequel. International Journal of Drug Policy, 26(11):1113–1123, 2015.
-  David Décary-Hétu and Luca Giommoni. Do police crackdowns disrupt drug cryptomarkets? a longitudinal analysis of the effects of operation onymous. Crime, Law and Social Change, 67(1):55–75, 2017.
-  Monica J Barratt, Jason A Ferris, and Adam R Winstock. Use of silk r oad, the online drug marketplace, in the united kingdom, a ustralia and the united states. Addiction, 109(5):774–783, 2014.
-  Marie Claire Van Hout and Tim Bingham. ‘silk road’, the virtual drug marketplace: A single case study of user experiences. International Journal of Drug Policy, 24(5):385–391, 2013.
-  Joe Van Buskirk, Amanda Roxburgh, Michael Farrell, and Lucy Burns. The closure of the s ilk r oad: what has this meant for online drug trading? Addiction, 109(4):517–518, 2014.
-  Julia Buxton and Tim Bingham. The rise and challenge of dark net drug markets. Policy brief, 7:1–24, 2015.
-  Paolo Tasca, Adam Hayes, and Shaowen Liu. The evolution of the bitcoin economy: extracting and analyzing the network of payment relationships. The Journal of Risk Finance, 19(2):94–126, 2018.
-  Dorit Ron and Adi Shamir. Quantitative analysis of the full bitcoin transaction graph. In International Conference on Financial Cryptography and Data Security, pages 6–24. Springer, 2013.
-  Martin Harrigan and Christoph Fretter. The unreasonable effectiveness of address clustering. In 2016 Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC/ATC/ScalCom/CBDCom/IoP/SmartWorld), pages 368–373. IEEE, 2016.
-  Sarah Meiklejohn, Marjori Pomarole, Grant Jordan, Kirill Levchenko, Damon McCoy, Geoffrey M Voelker, and Stefan Savage. A fistful of bitcoins: characterizing payments among men with no names. In Proceedings of the 2013 conference on Internet measurement conference, pages 127–140. ACM, 2013.
Danny Yuxing Huang, Maxwell Matthaios Aliapoulios, Vector Guo Li, Luca Invernizzi, Elie Bursztein, Kylie McRoberts, Jonathan Levin, Kirill Levchenko, Alex C Snoeren, and Damon McCoy.Tracking ransomware end-to-end. In 2018 IEEE Symposium on Security and Privacy (SP), pages 618–631. IEEE, 2018.
Mikkel Alexander Harlev, Haohua Sun Yin, Klaus Christian Langenheldt, Raghava
Mukkamala, and Ravi Vatrapu.
Breaking bad: De-anonymising entity types on the bitcoin blockchain using supervised machine learning.In Proceedings of the 51st Hawaii International Conference on System Sciences, 2018.
-  Daniel Goldsmith, Kim Grauer, and Yonah Shmalo. Analyzing hack subnetworks in the bitcoin transaction graph. arXiv preprint arXiv:1910.13415, 2019.
-  Bitcoin. bitcoin-core. https://bitcoin.org/en/bitcoin-core/, 2019. Accessed: 3 July 2019.
-  BLOCKCHAIN. blockchain.com. www.blockchain.com, 2019. Accessed: 3 July 2019.
-  Elli Androulaki, Ghassan O Karame, Marc Roeschlin, Tobias Scherer, and Srdjan Capkun. Evaluating user privacy in bitcoin. In International Conference on Financial Cryptography and Data Security, pages 34–51. Springer, 2013.
-  LILY HAY NEWMAN. How a bitcoin trail led to a massive dark web child-porn site takedown., 2019.
-  YoonJae Chung. Cracking the code: How the us government tracks bitcoin transactions. ANALYSIS OF APPLIED MATHEMATICS, page 152, 2019.
-  European Monitoring Centre for Drugs and Drug Addiction. DRUGS AND THE DARKNET: PERSPECTIVES FOR ENFORCEMENT, RESEARCH AND POLICY. European Monitoring Centre for Drugs and Drug Addiction, 2017.
-  United Nations Office on Drugs and Crime. World drug report 2019. United Nations Publications, 2019.
-  Peter V Marsden. Egocentric and sociocentric measures of network centrality. Social networks, 24(4):407–422, 2002.
-  Maryam Zamani, Fereshteh Rabbani, Attila Horicsányi, Anna Zafeiris, and Tamas Vicsek. Differences in structure and dynamics of networks retrieved from dark and public web forums. Physica A: Statistical Mechanics and its Applications, 525:326–336, 2019.
-  Gerald Appel. The moving average convergence-divergence method. Great Neck, NY: Signalert, pages 1647–1691, 1979.
-  Scott W Duxbury and Dana L Haynie. Building them up, breaking them down: Topology, vendor selection patterns, and a digital drug market’s robustness to disruption. Social Networks, 52:238–250, 2018.
-  Martin Dittus. www.oii.ox.ac.uk/blog/a-distributed-resilience-among-darknet-markets. https://www.oii.ox.ac.uk/blog/a-distributed-resilience-among-darknet-markets/, 2019. Accessed: 28 August 2019.
-  Julia Heidemann, Mathias Klier, and Florian Probst. Identifying key users in online social networks: A pagerank based approach. 2010.
-  Michael Fleder, Michael S Kester, and Sudeep Pillai. Bitcoin transaction graph analysis. arXiv preprint arXiv:1502.01657, 2015.
-  Wikipedia Now Accepts Bitcoin Donations. https://www.coindesk.com/wikipedia-now-accepts-bitcoin-donations, 2019. Accessed: 1 October 2019.
-  Chainalysis, inc. https://www.chainalysis.com/, 2019. Accessed: 10 July 2019.
1.1 Clustering techniques
In Bitcoin, multiple addresses can belong to one user; grouping these addresses reduces the complexity of the ledger and Bitcoin anonymity . Clustering techniques rely on how Bitcoin’s protocol works, users behaviour on the blockchain, Bitcoin’s transaction graph structure and finally, machine learning. Methods relying on Bitcoin’s protocol specifically exploit what is known as change addresses: Bitcoins available in an address have to be spent as a whole. Figure 7 shows an example of a change address. User A’s wallet has two addresses, one contains BTC and another has BTC. User would like to transfer BTC to user , as shown in Figure 7A. After transferring the BTC to , the change (BTC) will not stay in the same address. Bitcoin protocol will create another address, also assigned to , where the BTC change will be stored. By observing this pattern, a heuristic technique proposed in  suggests that these addresses can be grouped, as they belong to one user.
Since users can have multiple addresses, they can use multiple of these addresses to transfer Bitcoins in a single transaction. For example, Figure 8A shows a case where user controls different addresses. Each address has a different amount of Bitcoins, , and respectively. User wants to transfer Bitcoins to user , and two addresses will be used to complete the transaction as shown in Figure 8B. This observation allows the grouping of these two addresses as a single user .
The work in  challenged these heuristics, showing the possibility of having false positives and not taking into consideration changes in the protocol. The work suggests instead a manual process, where the behaviour of each entity is investigated. Page rank (network centrality measure ) was also used to identify important addresses ; however, the addresses were already grouped using the heuristics introduced by . Machine learning was also shown to identify addresses which should be grouped as one with accuracy.
Mapping addresses to an actual identity is more challenging. Some entities already publish their public key for donation and payment, such as Wikimedia Foundation . The only research that introduced a method for mapping a collection of addresses to a real-world identity is , through direct interaction with the address. In this work, researchers directly engaged in transactions with different services including mining pools, exchanges, dark markets and gambling websites.
The introduction of these heuristics did not only challenge Bitcoin’s anonymity but also eased the regulation of Bitcoin. Companies specialising in blockchain analytics started to capitalise on these heuristics and provide tools for exchanges and law enforcement entities to facilitate regulatory efforts. For our analysis of dark markets, our data was provided by Chainalysis , which is a blockchain analytics company. Chainalysis aided several investigations led by different law enforcement entities, including the United States Internal Revenue Service (IRS) .
Our dataset sampling approach (from the entire Bitcoin transactions) deploys a complex network perspective. Transactions on the blockchain can be modelled as a directed weighted graph where a node represents a user, and a directed edge between two nodes and represents a transaction from user to user . Depending on the clustering algorithm, a node can represent one address or multiple addresses. A node can also be labelled as a specific entity or unlabelled (unnamed). Figure 9 shows a sketch of the network and the different possible meanings of a node. For example in Figure 9, the black unnamed node on the right side is a representation of two different addresses clustered together, however, they were not attributed to an entity thus remained unnamed.
Dark markets information
In this section we provide data on each market understudy. Table 1 shows general information on the dark markets included in our dataset.
|Name||Start date||End date||Closure reason||Sales|
|Black Bank Market||scam||mixed|
|Blue Sky Marketplace||raided||drugs|
|East India Company Market||scam||drugs|
|German Plaza Market||scam||mixed|
|House of Lions Market||raided||drugs|
|Middle Earth Marketplace||scam||mixed|
|Russian Anonymous Marketplace||raided||mixed|
|Silk Road Marketplace||raided||mixed|
|Silk Road 2 Market||raided||mixed|
|Silk Road 3.1||active||active||drugs|
|Wall Street Market||raided||mixed|
Table 2 show each market total sent and received amount in USD and the number of users sent and received to/from the dark market.
|Black Bank Market|
|Blue Sky Marketplace|
|East India Company Market|
|German Plaza Market|
|House of Lions Market|
|Middle Earth Marketplace|
|Russian Anonymous Marketpl.|
|Silk Road 2 Market|
|Silk Road 3.1|
|Silk Road Marketplace|
|Wall Street Market|
Moving Average Convergence Divergence Analysis
To further quantify the changes in dark markets traded volume, we calculate the Moving Average Convergence Divergence (MACD) of the weekly trading volume. The MACD is an trading indicator used in stock markets to quantify price movements and fluctuations. It is composed of three time series. Firstly, the MACD, calculated as the difference between the exponential weighted moving average of the trading volume for a period of weeks and the exponential weighted moving average of the trading volume for a period of weeks. Secondly, the signal line, computed as the weeks exponential weighted moving average of the MACD time series. Finally, the last time series, known as the histogram, representing the difference between the MACD and the signal line.
Figure 10 shows the indicator behaviour across time. For each closure, there is a fluctuation in the MACD line and the histogram line indicates a downward change in the overall dark markets volume. However, an upward change can be observed after the closures indicating that dark markets recover.
Migrant and non migrants
In the main text we show that for each closed market, migrant users are more active in terms of the total amount they send and received overall, specifically with the closed dark market. In this section, we show the distribution of the migrants and non-migrants activity across all dark markets. Figure 11 shows that activity for migrants overall is higher than the non-migrants.
Table 3 shows the results of a Kolmogorov smirnov test between the migrant and non migrant activity distribution.
|Dark market||-value (dark market transactions)||-value (all transactions)|
|Black Bank Market|
|Blue Sky Marketplace|
|German Plaza Market|
|Middle Earth Marketplace|
|Russian Anonymous Marketplace|
|Silk Road 2 Market|
|Silk Road Marketplace|
|Wall Street Market|