Introduction
Since the launch of Silk Road, the first modern dark web marketplace (DWM), in 2011 [1] millions of buyers and sellers have traded in the dark web. DWMs have became popular because their users can anonymously access them through adhoc browsers, such as The Onion Router (Tor) [2], and trade goods using cryptocurrencies, such as Bitcoin [3]. They offer a variety of illicit goods including drugs, firearms, credit cards dumps, and fake IDs [4]. DWMs could represent a threat for the regular economy and public health. For instance, during the COVID19 pandemic, DWMs sold COVID19 related goods (e.g., masks and COVID19 tests) that were in shortage in regulated marketplaces as well as unapproved vaccines and fake treatments [5, 6, 7]. Law enforcement agencies have therefore targeted DWMs and users trading on them, performing dozens of arrests and seizing millions of US dollars worth of Bitcoin [8, 9, 10]. Despite police raids and unexpected closures, DWM trading volume has been steadily increasing and exceeded $1.5 billion for the first time in 2020 [11].
DWM users display complex trading patterns within the marketplace environment. For example, users migrate to alternative DWMs when a DWM that they trade on close [12, 13]. Such migration of users is aided by communication via online forums and chats on the dark web [14, 15]. However, little is known about how DWM users trade and transact outside the DWMs. On the one hand, some recent works have shown that a significant number of DWM users trade drugs and other illicit goods using social media platforms, such as Facebook, Telegram, and Reddit [16, 17, 18, 19, 20]. Moreover, several qualitative, interviewbased studies have shown that DWM users form direct trading relationships with other users, starting usertouser (U2U) pairs that bypass the intermediary role of DWMs [21, 22]. Past research has also found that sellers on regulated online marketplaces and social medial platforms may decide to use intermediaries, such Facebook groups or Instagram, to find new customers, and may start direct U2U trading with potential buyers [23]. In this paper, we look closely at patterns of U2U trading relationships among DWM users.
The starting point for this paper is identifying U2U networks around DWMs. We analyse 40 DWMs for a 10year time period spanning from June 18, 2011 to January 31, 2021. Our dataset covers all major DWMs that have ever existed, as identified by the European Monitoring Centre, Europol, the World Health Organization, and independent researchers [24, 25, 26]. Our analysis focuses on Bitcoin – the most popular cryptocurrency on DWMs [27, 28] as well as in the regulated economy [29, 30]. We focus on two kinds of transactions, occurring (i) between the user and a DWM and (ii) between two users of the same DWM. The result is 40 distinct marketplace ego networks containing userDWM and U2U transactions, whose typical structure is depicted in Figure 1(a). In each network, links are directed and the arrows point at the receiver of Bitcoin. Since users often migrate from one DWM to another [12] and become users of multiple DWMs, the 40 ego networks are not isolated, and can be combined to form one full network, as shown in Figure 1(b).
Previous analyses of U2U trading relationships around DWMs include only two studies [21, 22] based on unstructured [21] or semistructured [22] interviews of 17 users of Silk Road and 13 DWMs sellers, respectively. Here, we dramatically extend previous work by exploring the collective emergence and structure of U2U pairs. First, we observe that the U2U network, formed by all transactions between pairs of users, has a larger trading volume than DWMs themselves. We then identify stable U2U trading relationships, which represent a subset of persistent pairs in our dataset [31, 32] forming the backbone
of the U2U network. We find that 137,667 (i.e., 1.7% out of 7.85 million total) pairs are stable, generating a total trading volume of $1.5 billion (i.e., 5% out of $30 billion total volume). We then explore the behaviour of users forming stable U2U pairs. We reveal that stable U2U pairs play a crucial role for marketplaces by spending significantly more time and generating far greater transaction volume with DWMs than other users. By analysing the temporal evolution of stable pairs, we unveil that DWMs acted as meeting points for 37,192 (out of around 16 million users), whose trading volume is estimated to be $417 million. Importantly, these newly formed pairs persist in time and transact for several months even after the closure of the DWM that spurred their formation. Finally, we observe that COVID19 only had a temporary impact on the evolution of stable U2U pairs, which continued to increase their trading volume throughout 2020.
Results
Large number of U2U transactions
Ego networks.
We start our analysis by measuring the extent of the U2U network around each DWM. The percentages of users forming U2U pairs vary across DWMs, with a median value of 38% (min 23%, max 68%). The variance in the percentages of users with U2U pairs is shown by Figure
2(a), which shows that the number of users with U2U pairs obeys an almost linear relationship with the number of users interacting with a DWM, having an exponent equal to 1.06 and . The total trading volume users sent to the marketplace is obviously equivalent to the one they receive from it (twosided Wilcoxon test [33]: , ). Importantly, the total trading volume users sent to a DWM (and consequently the one that they receive from it) is always less than the one exchanged through U2U transactions, as shown in Figure 2(b).Full network.
Similar results hold for the full network, confirming that the formation of U2U pairs is a pervasive phenomenon around DWMs. The total trading volume users sent to DWMs is $3.8 billion, received from DWMs $3.7 billion, while the volume exchanged through U2U pairs reaches $30 billion. In Figure 8, we illustrate the number of transactions, trading volume, and lifespan of U2U pairs. In all cases we observe familiar fattailed distributions.
We then consider the temporal evolution of transactions. We look at the trading volume over time in Figure 2(c), where we observe that U2U transactions have consistently involved greater monthly volume than the volume sent to all DWMs since 2011. This underlines the economic importance of U2U transactions in the Bitcoin ecosystem relative to DWMs.
Behaviour of the U2U network
Henceforth, we are going to analyse users by focusing on the following groups: users who do not form stable U2U pairs; users who form stable U2U pairs, of which there are users who met outside DWMs and users who met inside DWMs (see the nomenclature in Table 2). We start by focusing our attention on identifying stable U2U pairs, i.e., persistent pairs of the U2U network. To this end, we use the evolving activitydriven model [31] to extract them in a statisticallyprincipled way (see Methods). We find 137,667 stable U2U pairs formed by 106,648 users and generating a trading volume equal to $1.5 billion. Stable pairs produce five times more transactions per pair than nonstable pairs (twosided MannWhitneyU test [34]: MNU, ) corresponding to a 5.34 times larger trading volume (MNU, ), see Figure 9. Stable pairs, despite representing less than 2% of the total number of U2U pairs, generate a disproportionate amount of trading volume.
The high activity of users forming stable U2U pairs is not limited to the U2U network, as they are also the most active in trading with DWMs. Users in stable U2U pairs spend a median number of 41 days on DWMs versus a median of only one day for users without stable pairs. The two resulting distributions are significantly different (twosided KolmogorovSmirnov test [35]: KS , ), see the inset of Figure 3. When we look at the trading volume with DWMs, we find qualitatively similar results. Users in stable U2U pairs transact a median of $400 with DWMs, while other users transact only $56. The two resulting distributions are significantly different (KS , ), see Figure 3. These results hold not only for full network but for every DWM in our data, see Figure 10 and 11.
U2U network evolution
Formation of U2U stable pairs.









We compare the time in which the first transaction between a pair of users occur with the time in which these users interact with the same DWM. Each row in the figure indicates a possible temporal sequence, which we classify in two groups: users who met outside the DWM (first two columns) and users who met inside the DWM (last column).
Having mapped the behaviour of stable pairs, we now consider their temporal evolution. More specifically, we ask: How do stable pairs form? Do DWMs spur their creation? One possible hypothesis is that users meet for the first time while active on a DWM, i.e., after they have both traded with that DWM, see Table 1 and the nomenclature in Table 2. This can be considered as a plausible, and conservative, proxy for users who met inside a DWM (see Methods). A total of 37,129 users have met at least one other user inside a DWM. Their trading volume is about $417 million, and the percentage of users who met inside a DWM is proportional to the trading volume sent to DWMs (Spearman [36]: , ), see Fig 12, meaning that large DWMs are more likely to favour the encounter of users than smaller DWMs. Importantly, users who met inside a DWM transact more than those meeting outside them. In particular, users who met inside a DWM trade a median of $2,212 between themselves, almost twice the $1,379 for users meeting outside the DWM (MNU, ). Moreover, users who met inside a DWM tend to make transactions significantly longer with median of 61 days than users meeting outside with a median of 50 days (MNU , ).
Resilience of U2U stable pairs.
Thus far, we have shown that users involved in stable trading relationships are also very active on DWMs, where they may meet new trading partners. But are DWMs and the U2U network truly interdependent? In particular, do stable pairs need the DWMs to survive? To answer these questions, we look at market closures, previously investigated to show how active users migrate to other existing DWMs [12]. Our dataset includes 33 closure events, which we study independently from one another by considering the evolution of the respective 33 marketplace ego networks. We find that nonstable U2U pairs sharply stop interacting immediately after DWM closure therefore their existence is highly sensitive to the presence of the DWM. On the other hand, the trading volume of stable U2U pairs is only marginally affected by the disappearance of the DWM. As a result, while prior to DWM closure nonstable U2U pairs generate an overall trading volume that is 10 times higher than that of stable U2U pairs (since nonstable pairs are far more prevalent), within a few weeks after DWM closure the pattern is reversed: stable U2U pairs generate more trade volume than nonstable U2U pairs. Indeed, trading patterns of stable pairs are not significantly influenced by DWMs closure, see Figure 4.
We have shown that the U2U network is resilient to shortlasting external shocks, namely the closure of a marketplace, and it does not need the centralised structure of DWMs to survive. What about longlasting systemic stress? To answer this question, we consider the impact that the COVID19 pandemic has had on the evolution of stable U2U pairs. Previous studies reported that COVID19 had a strong impact on DWMs, with reported delays and damage to the shipping infrastructure due to border closures [37, 38]. We start by investigating the number of new stable U2U pairs and their trading volume. Users in stable pairs meeting both inside and outside DWMs have been growing over the last two years. In 2020, a total of 6,778 pairs of users in stable pairs met inside a DWM, corresponding to the 192% of 2019 and to the 255% of 2018, see Figure 13(a). Pairs of users in stable pairs meeting inside a DWM traded for a total of $145 million in 2020, which corresponds to the 252% of 2019, and the 593% of 2018, see Figure 13(b). We see similar trends for stable U2U pairs meeting outside any DWMs. The impact of the COVID19 pandemic has, however, had different phases, determined by the number and level of measures introduced around the world. For users in stable pairs who met both inside or outside DWMs, we find that during the first lockdowns in 2020 trading volume fell with respect to January of the same year, suggesting that they were negatively impacted by COVID19 restrictions. After that, trading volume sharply increased over all 2020, see Figure 14. The number of stable U2U pairs created each day was, however, steady over time during 2020, even though more U2U pairs were created compared to the same period of 2019, see Figure 15. Overall, stable U2U pairs have shown resilience to the systemic stress caused by COVID19, suggesting, once again, that these trading relationships are fundamentally independent from the underlying DWMs.
Discussion and Conclusion
In this paper, we revealed the prevalence and structure of a large network of direct transactions between users who trade on the same DWM. We showed that some of the links of this usertouser (U2U) network are ephemeral while other persist in time. We highlighted that a significant fraction of stable U2U pairs formed as their members were trading with the same DWM, suggesting that DWMs may play a role in promoting the formation of stable U2U pairs. We showed that the relationships between users forming stable pairs persist even after the DWM shuts down and are not significantly affected by COVID19, suggesting overall resilience of stable pairs to external shocks.
Our study has several limitations. In particular, our dataset does not include any attributes related to either users or their Bitcoin transactions, such as, whether the transaction represents an actual purchase or not. Moreover, we do not have information about which users trade with other users on the same DWM. Finally, our coverage of DWMs, albeit extensive, may lack information on other DWMs where users could have met.
Our work has several policy implications. Our findings suggest that DWMs are much more than mere marketplaces [39]. DWMs are also communication platforms, where users can meet and chat with other users either directly – using Whatsapp, phone, or email – or through specialised forums. These direct interactions may favour the emergence of decentralised trade networks that bypass the intermediary role of the marketplace, similar to what is currently happening on Facebook, Telegram, and Reddit [16, 23, 17, 18, 19, 20], where users post products, negotiate item prices, and then trade directly without an intermediary. We estimate that the trading volume of U2U pairs meeting on DWMs is increasing, reaching a peak in 2020 (during the COVID19 pandemic). Indeed, our results support recent recommendations of paying attention to single sellers rather than entire DWMs [40]. Law enforcement agencies, however, have only recently started targeting single sellers. The first operation took place in 2018 and successfully led to the arrest of 35 sellers [41], while the largest operation to date occurred in 2020 and led to 179 arrests in six different countries [42]. Our study indicates that a much higher number of highly active DWM users, on the order of tens of thousands, is involved in transactions with other DWM users.
Overall, our study provides a first step towards the understanding of how users of DWMs collectively behave outside organised marketplace. We believe that the results might suggest to researchers, practitioners, and law enforcement agencies that a shift in the attention from the evolution of DWMs to the behaviour of their users might facilitate the design of more appropriate strategies to counteract online trading of illicit goods.
Competing interests
The authors declare that they have no competing interests.
Author’s contributions
M.N., A.Br., A.E., P.G., A.T., and A.Ba. designed the research; A.E. and P.G., acquired, prepared, and cleansed the data. M.N. and A.Br. performed the measurements. M.N., A.Br., A.E., P.G., A.T., and A.Ba. analysed the data. M.N., A.Br., P.G., A.T., and A.Ba. wrote the manuscript. M.N., A.Br., A.E., P.G., A.T., and A.Ba. discussed the results and commented on the manuscript.
Acknowledgements
M.N., A.Br., A.T., and A.Ba. were supported by ESRC as part of UK Research and Innovation’s rapid response to COVID19, through grant ES/V00400X/1.
Data availability
All data needed to evaluate the conclusions in the paper are present in the paper. Additional data related to this paper may be requested from the authors.
Data and methods
Additional considerations on our data and methods are available in Section 1.
Data preprocessing.
We consider only a subset of the transactions in our dataset. Namely, the ones made by the 40 entities representing the 40 DWMs under consideration, which directly interact with more than 16 million other entities, who are the users of these DWMs. Users interacting with other users form U2U pairs and we include them in our dataset. We instead discard single Bitcoin transactions below $0.01 or above $100,000, which are unlikely to show real purchases and minimise false positives. They may be attributed to a residual amount of Bitcoins in an address or transactions between two business partners where no good is actually given in return, respectively. The analysed dataset includes about 31 million transactions among more than 16 million users. Finally, we note that the same user can interact in multiple DWMs [12, 13]. By definition, users that interact among themselves form U2U transactions. If the pair of users interact with multiple DWMs these U2U transactions are included in all relative DWMs and counted multiple times. Therefore, the simple sum of all U2U transactions of each DWM is more than the sum of all unique U2U transactions. We count a total of 11 million transactions around all DWMs, that goes down to 9.9 million when multiple counting is avoided. Similarly, the simple sum of the single trading volumes surrounding all DWMs amounts to $33 billion, while the overall trading volume in all unique U2U pairs is $30 billion. Among the 40 large DWMs under consideration, 17 participate in at least one transaction in either 2020 or 2021, while the remaining 23 closed before 2020. Notably, our dataset includes Silk Road (the first modern DWM) [1], Alphabay (once the leading DWM) [43], and Hydra (currently the largest DWM in Russia) [12]. Other general statistics about our dataset can be found in the Section 3.
Detection of the U2U network.
The detection of stable U2U pairs in the full network is done by using the evolving activitydriven model [31], which introduced a statisticallyprincipled methodology to detect the network backbone against what expected from a proper null model. If a U2U pair occurs significantly more than what expected from the null model, it is labeled as stable, otherwise as nonstable. The evolving activitydriven model is an appropriate methodology for large temporal networks [32] and it is implemented in the Python 3 pip library TemporalBackbone [44], where default parameter values have been used. As input parameter, we considered the full network, comprehending transactions from/to DWMs and U2U transactions between users (see Section 4).
Users who met inside a DWM.
We determine whether U2U pairs meet while active on a DWM by looking at the time occurrence of their first U2U transaction. This transaction can occur at three different moment in time. (i) At
, before both users interact with the same DWM (occurring at and , respectively), as shown on the left hand side of Table 1. (ii) At , when only one user has interacted with a specific DWM and the other user will do so at a later time, as in the middle column of Table 1. (iii) At , when both users have interacted with the same DWM, as in the right column of Table 1. We classify these three chain of events in two groups. One group includes all pairs that meet outside any DWMs, which includes case (i) and case (ii), and the other group users that meet inside a DWM, described by case (iii). This last case constitute a conservative proxy for users that meet who met inside aa DWM. The proxy admits the possibility of false positives, since it consider users who met inside a the same DWM without having interacted on it, as well as false negatives, since it does not take into account users who met inside a DWM without having ever interacted on it. The latter is arguably more significant, since it is possible that only one of the two users (the seller) has actually engaged in transactions with the DWM, while the other user, after seeing the seller’s profile on a DWM, has established a direct contact, through Whatsapp, email, or phone.Nomenclature of all groups considered.
We provide the definition of all considered groups in Table 2.
References
 [1] Nicolas Christin. Traveling the Silk Road: A measurement analysis of a large anonymous online marketplace. In Proceedings of the 22nd international conference on World Wide Web, pages 213–224, 2013.
 [2] Roger Dingledine, Nick Mathewson, and Paul Syverson. Tor: The secondgeneration onion router. Technical report, Naval Research Lab Washington DC, 2004.
 [3] Satoshi Nakamoto. Bitcoin: A peertopeer electronic cash system. Technical report, Manubot, 2008.
 [4] Gwern. Darknet market mortality risks. https://www.gwern.net/DNMsurvival Accessed October 27, 2021, 2019.
 [5] Roderic Broadhurst, Matthew Ball, and Chuxuan Jiang. Availability of COVID19 related products on Tor darknet markets. Australian Institute of Criminology, April 2020.

[6]
Alberto Bracci, Matthieu Nadini, Maxwell Aliapoulios, Damon McCoy, Ian Gray,
Alexander Teytelboym, Angela Gallo, and Andrea Baronchelli.
Dark Web Marketplaces and COVID19: Before the vaccine.
EPJ Data Science
, 10, 2021.  [7] Alberto Bracci, Matthieu Nadini, Maxwell Aliapoulios, Damon McCoy, Ian Gray, Alexander Teytelboym, Angela Gallo, and Andrea Baronchelli. Dark Web Marketplaces and COVID19: The vaccines. arXiv preprint arXiv:2102.05470, 2021. (+) Contributed equally.
 [8] Europol. Operation Onymous. https://www.europol.europa.eu/activitiesservices/europolinaction/operations/operationonymous Accessed October 27, 2021, 2014.
 [9] Darknet takedown: Authorities shutter online criminal market AlphaBay. https://www.fbi.gov/news/stories/alphabaytakedown Accessed October 27, 2021, 2017. FBI.
 [10] Chris Isidore. Feds seize 1 billion in Bitcoins they say were stolen from silk road. https://edition.cnn.com/2020/11/06/business/bitcoinseizedsilkroadulbricht/index.html Accessed January 4, 2021, 2020. CNN.
 [11] Chainalysis. The Chainalysis 2021 crypto crime report. https://go.chainalysis.com/2021CryptoCrimeReport.html Accessed October 27, 2021, 2021.
 [12] Abeer ElBahrawy, Laura Alessandretti, Leonid Rusnac, Daniel Goldsmith, Alexander Teytelboym, and Andrea Baronchelli. Collective dynamics of dark web marketplaces. Scientific reports, 10(1):1–8, 2020.
 [13] Naoki Hiramoto and Yoichi Tsuchiya. Measuring dark web marketplaces via bitcoin transactions: From birth to independence. Forensic Science International: Digital Investigation, 35:301086, 2020.
 [14] Julia Buxton and Tim Bingham. The rise and challenge of dark net drug markets. Policy brief, 7:1–24, 2015.
 [15] Alexia Maddox, Monica J Barratt, Matthew Allen, and Simon Lenton. Constructive activism in the dark web: cryptomarkets and illicit drugs in the digital ‘demimonde’. Information, Communication & Society, 19(1):111–126, 2016.
 [16] Atte Oksanen, Bryan Lee Miller, Iina Savolainen, Anu Sirola, Jakob Demant, Markus Kaakinen, and Izabela Zych. Illicit drug purchases via social media among american young people. In International Conference on HumanComputer Interaction, pages 278–288. Springer, 2020.
 [17] German police seized nine telegrambased drug markets. https://darknetlive.com/post/germanpoliceseizedninetelegrambaseddrugmarkets/ Accessed October 27, 2021, 2020. DarknetLive.
 [18] YikHei Sung, WingHo Lee, Franco KaWah Leung, and Jonathan J Fong. Prevalence of illegal turtle trade on social media and implications for wildlife trade monitoring. Biological Conservation, 261:109245, 2021.
 [19] Andrew Childs, Melissa Bull, and Ross Coomber. Beyond the dark web: Navigating the risks of cannabis supply over the surface web. Drugs: Education, Prevention and Policy, pages 1–12, 2021.
 [20] K Hazel Kwon and Chun Shao. Dark knowledge and platform governance: A case of an illicit ecommerce community in reddit. American Behavioral Scientist, 65(6):779–799, 2021.
 [21] Monica J Barratt, Simon Lenton, Alexia Maddox, and Matthew Allen. “what if you live on top of a bakery and you like cakes?”—drug use and harm trajectories before, during and after the emergence of silk road. International Journal of Drug Policy, 35:50–57, 2016.
 [22] Rasmus Munksgaard, James Martin, et al. How and why vendors sell on cryptomarkets. Trends and Issues in Crime and Criminal Justice, 608:1, 2020.
 [23] Silje Anderdal Bakken and Jakob Johan Demant. Sellers’ risk perceptions in public and private social media drug markets. International Journal of Drug Policy, 73:255–262, 2019.
 [24] European Monitoring Centre for Drugs, Drug Addiction, and Europol. Drugs and the darknet: Perspectives for enforcement, research and policy, 2017.
 [25] World Health Organization. World drug report 2019. United Nations publication, Sales No. E, 19, 2019.
 [26] Gwern. Updated: list of dark net markets (Tor & I2P). https://www.gwern.net/docs/sr/20190422deepdotwebdnmlist.html Accessed October 27, 2021, 2020.
 [27] Seunghyeon Lee, Changhoon Yoon, Heedo Kang, Yeonkeun Kim, Yongdae Kim, Dongsu Han, Sooel Son, and Seungwon Shin. Cybercriminal minds: An investigative study of cryptocurrency abuses in the dark web. In Network and Distributed System Security Symposium, pages 1–15. Internet Society, 2019.
 [28] Sean Foley, Jonathan R Karlsen, and Tālis J Putniņš. Sex, drugs, and Bitcoin: How much illegal activity is financed through cryptocurrencies? The Review of Financial Studies, 32(5):1798–1853, 2019.
 [29] Aaron W Baur, Julian Bühler, Markus Bick, and Charlotte S Bonorden. Cryptocurrencies as a disruption? Empirical findings on user adoption and future potential of Bitcoin and co. In Conference on eBusiness, eServices and eSociety, pages 63–80. Springer, 2015.
 [30] Ed Saiedi, Anders Broström, and Felipe Ruiz. Global drivers of cryptocurrency infrastructure adoption. Small Business Economics, pages 1–54, 2020.
 [31] Matthieu Nadini, Christian Bongiorno, Alessandro Rizzo, and Maurizio Porfiri. Detecting network backbones against time variations in node properties. Nonlinear Dynamics, 99(1):855–878, 2020.
 [32] Matthieu Nadini, Alessandro Rizzo, and Maurizio Porfiri. Reconstructing irreducible links in temporal networks: which tool to choose depends on the network size. Journal of Physics: Complexity, 1(1):015001, 2020.
 [33] Frank Wilcoxon. Individual Comparisons by Ranking Methods. In Breakthroughs in Statistics, pages 196–202. Springer, 1992.

[34]
Henry B Mann and Donald R Whitney.
On a test of whether one of two random variables is stochastically larger than the other.
The Annals of Mathematical Statistics, pages 50–60, 1947.  [35] Frank J Massey Jr. The KolmogorovSmirnov test for goodness of fit. Journal of the American statistical Association, 46(253):68–78, 1951.
 [36] Charles Spearman. The proof and measurement of association between two things. AppletonCenturyCrofts, 1961.
 [37] Andréanne Bergeron, David DécaryHétu, and Luca Giommoni. Preliminary findings of the impact of COVID19 on drugs crypto markets. International Journal of Drug Policy, 83:102870, 2020.
 [38] Covid is causing shipping issues, but natural competitive forces are causing darknet market consolidation. https://blog.chainalysis.com/reports/darknetmarketscryptocurrency2020 Accessed October 27, 2021, 2020. Chainalysis Team.
 [39] Abhineet Gupta, Sean B Maynard, and Atif Ahmad. The dark web phenomenon: A review and research agenda. arXiv preprint arXiv:2104.07138, 2021.
 [40] Martin HortonEddison, Patrick Shortis, Judith Aldridge, and Fernando Caudevilla. Drug cryptomarkets in the 2020s: Policy, enforcement, harm, and resilience. Global Drug Policy Observatory, 2021.
 [41] Office of Public Affairs. First nationwide undercover operation targeting darknet vendors results in arrests of more than 35 individuals selling illicit goods and the seizure of weapons, drugs and more than $23.6 million. https://www.justice.gov/opa/pr/firstnationwideundercoveroperationtargetingdarknetvendorsresultsarrestsmore35 Accessed October 27, 2021, 2018. Department of Justice, United States.
 [42] Europol Team. International sting against dark web vendors leads to 179 arrests. https://www.europol.europa.eu/newsroom/news/internationalstingagainstdarkwebvendorsleadsto179arrests Accessed October 27, 2021, 2020. Europol.
 [43] Joe Van Buskirk, Sundresan Naicker, RB Bruno, C Breen, and A Roxburgh. Drugs and the internet. The National Illicit Drug Indicators Project, 2016.
 [44] Matthieu Nadini. Temporalbackbone. https://pypi.org/project/TemporalBackbone/ Accessed October 27, 2021, 2021. Python pip 3 library: A tool to detect the backbone in temporal networks.
 [45] Chainalysis. The 2021 global crypto adoption index: Worldwide adoption jumps over 880% with p2p platforms driving cryptocurrency usage in emerging markets. https://blog.chainalysis.com/reports/2021globalcryptoadoptionindex Accessed October 27, 2021, 2020.
 [46] Merve Can Kus Khalilov and Albert Levi. A survey on anonymity and privacy in Bitcoinlike digital cash systems. IEEE Communications Surveys & Tutorials, 20(3):2543–2585, 2018.
 [47] Darknetlive. https://darknetlive.com/markets/darkbay/ Accessed October 27, 2021, 2020.
 [48] Anthony Cuthbertson. Coronavirus: dark web market bans drug dealers selling fake COVID19 vaccines. https://www.independent.co.uk/lifestyle/gadgetsandtech/news/coronavirusvaccinecuredarkwebdrugsmarketcovid19a9442671.html Accessed October 27, 2021, 2020. Independent.
 [49] Frank Wehinger. The dark net: Selfregulation dynamics of illegal online markets for identities and related services. In 2011 European Intelligence and Security Informatics Conference, pages 209–213. IEEE, 2011.
 [50] Kyle Soska and Nicolas Christin. Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. In 24th USENIX security symposium (USENIX security 15), pages 33–48, 2015.
 [51] Emcdda special report: COVID19 and drugs – drug supply via darknet markets. https://www.emcdda.europa.eu/publications/adhoc/covid19anddrugsdrugsupplyviadarknetmarkets_en Accessed October 27, 2021, 2020. European Monitoring Centre for Drugs and Drug Addiction (EMCDDA).
 [52] Dread forum. https://onion.live/site/dreadforum Accessed via Tor browser October 27, 2021, 2020.
 [53] Raptor.life. Your most trusted darknet markets links directory. https://raptor.life/index.php Accessed October 27, 2021, 2020.
 [54] Darknetlive. https://darknetlive.com/ Accessed October 27, 2021, 2020.
 [55] Dark.fail. https://dark.fail/ Accessed October 27, 2021, 2020.
 [56] Monica J Barratt, Jason A Ferris, and Adam R Winstock. Use of Silk Road, the online drug marketplace, in the United Kingdom, Australia and the United States. Addiction, 109(5):774–783, 2014.
 [57] James Martin. Lost on the Silk Road: Online drug distribution and the cryptomarket. Criminology & Criminal Justice, 14(3):351–367, 2014.
 [58] Judith Aldridge and David DécaryHétu. Not an Ebay for drugs: The cryptomarket Silk Road as a paradigm shifting criminal innovation. Available at SSRN 2436643, 2014.
 [59] James Martin. Drugs on the dark net: How cryptomarkets are transforming the global trade in illicit drugs. Springer, London, UK, 2014.
 [60] Malte Möser, Kyle Soska, Ethan Heilman, Kevin Lee, Henry Heffan, Shashvat Srivastava, Kyle Hogan, Jason Hennessey, Andrew Miller, Arvind Narayanan, et al. An empirical analysis of traceability in the monero blockchain. Proceedings on Privacy Enhancing Technologies, 2018(3):143–163, 2018.
 [61] Bitcoincore. https://bitcoin.org/en/bitcoincore/ Accessed October 27, 2021, 2020.
 [62] Blockchain.com. www.blockchain.com Accessed October 27, 2021, 2020. Daily Mail.
 [63] Dorit Ron and Adi Shamir. Quantitative analysis of the full Bitcoin transaction graph. In International Conference on Financial Cryptography and Data Security, pages 6–24. Springer, 2013.
 [64] Elli Androulaki, Ghassan O Karame, Marc Roeschlin, Tobias Scherer, and Srdjan Capkun. Evaluating user privacy in Bitcoin. In International Conference on Financial Cryptography and Data Security, pages 34–51. Springer, 2013.
 [65] Paolo Tasca, Adam Hayes, and Shaowen Liu. The evolution of the Bitcoin economy. The Journal of Risk Finance, 2018.
 [66] Martin Harrigan and Christoph Fretter. The unreasonable effectiveness of address clustering. In 2016 Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC/ATC/ScalCom/CBDCom/IoP/SmartWorld), pages 368–373. IEEE, 2016.
 [67] Sarah Meiklejohn, Marjori Pomarole, Grant Jordan, Kirill Levchenko, Damon McCoy, Geoffrey M Voelker, and Stefan Savage. A fistful of Bitcoins: Characterizing payments among men with no names. In Proceedings of the 2013 conference on Internet measurement conference, pages 127–140, 2013.
 [68] Wikipedia now accepts bitcoin donations. https://www.coindesk.com/wikipedianowacceptsbitcoindonations Accessed October 27, 2021, 2014. Coindesk.
 [69] Chainalysis, inc. https://www.chainalysis.com/ Accessed October 27, 2021, 2020.
 [70] YoonJae Chung. Cracking the code: How the us government tracks Bitcoin transactions. Analysis Of Applied Mathematics, page 152, 2019.
 [71] Chainalysis. Chainalysis in action: How law enforcement used blockchain analysis to follow funds and identify the twitter hackers. https://blog.chainalysis.com/reports/chainalysisdojtwitterhack2020 Accessed October 27, 2021, 2020.
 [72] Jeffrey D Scargle, Jay P Norris, Brad Jackson, and James Chiang. Studies in astronomical time series analysis. VI. Bayesian block representations. The Astrophysical Journal, 764(2):167, 2013.
1 Additional data and methods
Identification of real identities performing Bitcoin transactions.
The trading volume of DWMs has been steadily increasing and exceeded $1.5 billion for the first time in 2020 [11]. The vast majority of such trading has occurred in Bitcoin, which is the most popular cryptocurrency to date. Its worldwide adoption has further increased in 2021, jumping over 880% with respect to 2020 [45]
. Bitcoin allows users to use pseudonym (public address) instead of their real identities. Users can create a new pseudonym at each transaction, requiring only a computer and an internet connection. However, various heuristics exist to cluster addresses together to recover the real identity behind pseudonyms
[46]. In our dataset, this process is done by Chainalysis Inc. (see Section 2). In the dataset, real entities represent DWMs, users of DWMs, or other entities interacting with these users. Transactions to and from Bitcoin trading exchanges are removed, because our primary interest entails the study of direct interactions between DWMs and single users. The dataset comprises of 40 DWMs, for a total of 149 transactions among 57 million real entities. Each Bitcoin transaction has an associated timestamp , indicating the time at which the transaction occurred. The dataset is sparse, with 54.6% of all entities performing a transaction only. The conversion from Bitcoin to dollars is done using the price of Bitcoin at the time of the transaction.Evaluation of coefficients of the trend line in Figure 2(a).
The coefficients and of the trend line in Figure 2(a) are in good agreement with the empirical data, , and evaluated as follows. First, the equation is transformed to , where and . The linear equation fitted against real data and coefficients and computed by minimizing the sum of squares.
Statistical analysis.
We compare the median of two paired distributions using the twosided Wilcoxon test [33]
. It is a nonparametric statistical test and verifies the null hypothesis that two paired samples come from distributions with the same median. If distributions are not paired, we use the MannWhitneyU test to assess statistical differences of the medians of two distributions
[34]. We compare two distributions using the KolmogorovSmirnov test [35] on two samples. It tests the null hypothesis that 2 independent samples are drawn from the same continuous distribution. We evaluate the correlation between two sets of values using the Spearman rankorder correlation coefficient [36]. It is a correlation coefficient that does not assume normally distributed values and varies between 1 and 1: with 1 implying a negative correlation, 0 no correlation, and 1 a positive correlation.
2 Dark web marketplaces and identification of real identities performing Bitcoin transactions.
2.1 Dark web marketplaces
DWMs are in many ways similar to other online marketplaces. They have strict policies that every user must follow. For instance, in some DWMs are banned categories of products, like human trafficking, contract killing, weapons, or COVID19 fake vaccines [47, 48]. Registration is required for all sellers, and sometimes also for buyers. Certified sellers can advertise their products. They have a reputation, which is based on buyers’ reviews [49, 50]. They are also responsible for delivering the products, sometimes with a tracking number attached, and may offer refunds or reshipment. Buyers are free to look at the listings and sometimes can ask questions directly to the relative seller [51, 6]. Payments are often protected by escrow services. These are thirdparty services, which guarantee that buyers can safely have their money refunded. Users’ on DWMs constitute an active community. Numerous are websites and forums where users can share their experience and get advice on the most trustworthy DWMs and sellers, such as Dread [52], Raptor.life [53], DarkNetLive [54], and DarkFail [55].
DWMs have some unique features as well. They sell several kinds of illicit products, like drugs, fake IDs, and medicines [56, 57, 58]. They are not accessible by standard web searchengines, but operate online in an encrypted part of the Internet [59]. Potential buyers can easily access to DWMs using specialized browsers, like The Onion Router (Tor) [2], and anonymously trade illicit goods using cryptocurrencies, like Bitcoin [3]. Bitcoin is currently the most popular cryptocurrency on DWMs [27, 28, 60] and its adoption is growing in the regular economy as well. Its infrastructure seems to ensure complete anonymity to its users. If a proper technique is adopted, however, there are chances to link the Bitcoin blockchain (that is, the entire Bitcoin transaction history) with the user’s real identity [46]. When the Bitcoin blockchain is successfully linked to a real identity, the records of past, present, and future Bitcoin transactions is traceable, easily accessible, and can be used by companies, law enforcement agencies, and researchers.
2.2 Identification of real identities performing Bitcoin transactions
The raw, anonymized Bitcoin blockchain can be publicly accessed through Bitcoin core [61] or thirdparty APIs such as Blockchain.com [62]. It contains information about origin and destination addresses, as well as time and amount of the transactions. In order to contrast traceability of the real identity, an user is likely to use multiple addresses. A new address is often generated in each transaction. Grouping the addresses in clusters reduces the complexity of the Bitcoin blockchain and challenge users’ anonymity [63]. Given that millions of Bitcoin addresses are currently active and many others are continuously being generated, a clustering approach primarily based on manual annotation is not feasible. Various heuristics, instead, have been proposed[63, 64, 65, 66]. They were successful in grouping Bitcoin addresses and associate them to cluster of real entities. For instance, in [63], the authors were able to find a connection between a set of large transactions and a single one, which was dated in November 2010. In [64], the authors applied to a daily university setting the privacy protocol recommended in Bitcoin transactions, finding that almost 40% of the real identities would be recovered. Another work showed the presence of “super clusters” of entities, which marked macrovariations in the evolution of the Bitcoin economy [65]. The primary reasons behind the effectiveness of heuristic clustering are: “address reuse, avoidable merging, superclusters with high centrality, and the incremental growth of address clusters” [66].
The end goal of clustering Bitcoin addresses is to map them to single, real entities, as shown in Figure 6. To achieve this goal, however, heuristic clustering techniques should be improved. Manual annotation has shown a valuable potential [67]. It consists on gathering publicly available Bitcoin addresses, like the Wikimedia Foundation one [68], and engage through direct interaction with unknown Bitcoin addresses. If some real entities are known, it is easier to associate the remaining Bitcoin addresses to other real identities. In the last few years, companies specialising in Bitcoin analytics have started to leverage previous methodologies [63, 64, 65, 66, 67] to unveil real entities. The leading company in analysing Bitcoin transactions on DWMs is Chainalysis Inc. [69], which has also aided several federal investigations. For instance, it supported the United States Internal Revenue Service (IRS) in tracking Bitcoin transactions [70] and the FBI in the Twitter hack [71]. Chainalsysis clusters Bitcoin transactions in groups by combining previous methodologies [63, 64, 65, 66] and real entities are unveiled with an approach similar to [67] (see Section 2 for more details on DWMs and this clustering technique). In the dataset, real entities represent DWMs, users of DWMs, or other real entities interacting with these users. Chainalysis aims at minimizing the false positives, who may lead to wrongly associate a real entity with illicit activities. If a Bitcoin address cannot be uniquely ascribed to a real entity, it is included in our dataset as an independent and unnamed entity. Only a fraction of the entities in our dataset thus represent named and real entities, which identity is known. Given that there are millions of entities in our dataset, it is impossible to identify all the corresponding real identities. After the identification process is completed, to each real entity is associated a string of numbers and the dataset reanonymized. Transactions to and from Bitcoin trading exchanges are also removed, because our primary interest entails the study of direct interactions between real entities.
3 General statistics of the 40 DWMs under consideration
4 Detection of stable pairs in temporal and directed networks
Here, we summarize the metholodogy of detecting the backbone of stable pairs in temporal and undirected networks as introduced in [31], and show how it can be easily adapted to tackle the analysis of directed temporal networks. The methodology follow three sequential steps: (i) determine the interval partition, (ii) estimate models’ parameters, over successive intervals, and (iii) run a statistical filter, which removes all pairs explained by the null hypothesis and retain stable pairs. The analysed temporal network, either directed or undirected, of nodes evolves in an observation window composed of time steps, labeled as . At each time step , entities interact among themselves and form a timevarying network of interactions, described by a binary adjacency matrix that varies in time .
4.1 Temporal and undirected networks
Interval partition.
The overall observation window is divided in successive and disjoint intervals using an auxiliary method, namely, the Bayesian Block method [72]. It takes as input the total number of temporal pairs created in the entire network at time
(1) 
where the superscript “ts” indicates that these variables are estimated from the time series and is the th entry of the estimated adjacency matrix at time . The Bayesian Block method returns the interval partition, which divides the overall time window into disjoint intervals indexed by , that contain a uniform total number of connections. From the knowledge of the interval partition, the length, , of the generic th interval is obtained with the following closure relation: .
Parameter estimation.
According to the null hypothesis, pair of entities and are expected to interact proportional to the their individual activities at time
. That is, the probability that entities
and interact at time is a binomial random variable defined as(2) 
where and are piecewise constant activities, which represent the propensity of creating interactions at time . The estimation of piecewise constant activities is carried out analysing each of the intervals separately. The activity of entity at time is computed through the following frequency count:
(3) 
where and are the total number of pairs generated by entity in the th and the total number of temporal pairs generated in the network in the th interval, respectively. These variables are computed from the adjacency matrix , as, , and . Once the activities are estimated according with Eq. (3), the probability in Eq. (2) can be calculated.
Statistical filter.
The statistical filter compares expected number of connections between entity and entity , , with observations from the time series, . The expected number of connections between entities and in the overall time window is determined by the sum of the binomial random variables given in Eq. (2)
(4) 
where we have used the estimation of activity in Eq. (3) and summed over all intervals. Although the sum of nonidentical binomial random variables in Eq. (4
) is a Poisson binomial distribution, the Poisson distribution is an appropriate approximation for long time series. The probability that the observed weight,
, could be explained by the relative expected weight, in Eq. (4), is computed according to the cumulative function of the Poisson distribution(5) 
where indicates the Poisson distribution with random variable and expected value . Equation (5) represents the pvalue : when the pvalue is below a predefined threshold, the pair is significant and included in the backbone network. The same statistical test is repeated for all pairs of entities observed at least once in the overall temporal evolution.
4.2 Temporal and directed networks
With little modifications, the above methodology can be used to filter temporal and directed networks.
Interval partition.
The interval partition is obtained by using the Bayesian Block method as above. The total number of temporal pairs created in the entire network at time is
(6) 
where not pairs are directed, while in Eq. (1) undirected, thereby explaining the different ranges in the summations.
Parameter estimation.
In directed networks, the probability that entity contacts at random entity at time is defined as
(7) 
where is the activity of entity at time and the attractiveness of entity at time . The activity was already defined in Eq. (2), while the attractiveness represent the propensity of receiving connections at time . If (for all entities in the network and at all time), Eq. (7) becomes equivalent to Eq. (2). However, care should be placed in their interpretation, whereby Eq. (7) generates a directed pair from entity to entity , while Eq. (2) can only lead to an undirected pair.
In the generic th interval, defining the time window , piecewise constant activities and attractivenesses are estimated directly from the time series, similarly to what done in the undirected case in Eq. (3)
(8) 
where , , and , are the total incoming strength of entity in the th interval, outgoing strength of entity in the th interval, and the total number of directed, temporal pairs generated in the network in the th interval, respectively. These variables are computed from the adjacency matrix , that is, , , and . Once the activity and attractiveness are estimated according with Eq. (8), the probability in Eq. (7) can be evaluated.
Statistical filter.
Similar to Eq. (4), the expected number of pairs from entity to entity is computed by summing the probability in Eq. (7) for all time instants
(9) 
The probability that the observed weight, , is explained by the expected weight, in Eq. (9), is computed according to the cumulative function of the Poisson distribution
(10) 
Equation (10) represents the pvalue , which is used to assess whether the directed pair is significant. The same statistical test has to be repeated for directed pairs observed at least once in the overall temporal evolution. For undirected networks, Eq. (10) is equivalent to Eq. (5).