Emergence and structure of decentralised trade networks around dark web marketplaces

11/02/2021
by   Matthieu Nadini, et al.
0

Dark web marketplaces (DWMs) are online platforms that facilitate illicit trade among millions of users generating billions of dollars in annual revenue. Recently, two interview-based studies have suggested that DWMs may also promote the emergence of direct user-to-user (U2U) trading relationships. Here, we quantify the scale of, and thoroughly investigate, U2U trading around DWMs by analysing 31 million Bitcoin transactions among users of 40 DWMs between June 2011 and Jan 2021. We find that half of the DWM users trade through U2U pairs generating a total trading volume greater than DWMs themselves. We then show that hundreds of thousands of DWM users form stable trading pairs that are persistent over time. Users in stable pairs are typically the ones with the largest trading volume on DWMs. Then, we show that new U2U pairs often form while both users are active on the same DWM, suggesting the marketplace may serve as a catalyst for new direct trading relationships. Finally, we reveal that stable U2U pairs tend to survive DWM closures and that they were not affected by COVID-19, indicating that their trading activity is resilient to external shocks. Our work unveils sophisticated patterns of trade emerging in the dark web and highlights the importance of investigating user behaviour beyond the immediate buyer-seller network on a single marketplace.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

page 19

12/27/2018

Understanding What Drives Bitcoin Trading Activities

Cryptocurrencies have gained tremendous popularity over the past few yea...
02/13/2021

Detecting and Quantifying Wash Trading on Decentralized Cryptocurrency Exchanges

Cryptoassets such as cryptocurrencies and tokens are increasingly traded...
01/12/2022

The Recurrent Reinforcement Learning Crypto Agent

We demonstrate an application of online transfer learning as a digital a...
03/23/2018

Edgeworth trading on networks

We define a class of pure exchange Edgeworth trading processes that unde...
12/04/2020

Economics of Mobile Data Trading Market

To exploit users' heterogeneous data demands, several mobile network ope...
06/01/2021

Mapping the NFT revolution: market trends, trade networks and visual features

Non Fungible Tokens (NFTs) are digital assets that represent objects lik...
09/22/2021

Who are the arbitrageurs? Empirical evidence from Bitcoin traders in the Mt. Gox exchange platform

We mine the leaked history of trades on Mt. Gox, the dominant Bitcoin ex...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

Introduction

Since the launch of Silk Road, the first modern dark web marketplace (DWM), in 2011 [1] millions of buyers and sellers have traded in the dark web. DWMs have became popular because their users can anonymously access them through ad-hoc browsers, such as The Onion Router (Tor) [2], and trade goods using cryptocurrencies, such as Bitcoin [3]. They offer a variety of illicit goods including drugs, firearms, credit cards dumps, and fake IDs [4]. DWMs could represent a threat for the regular economy and public health. For instance, during the COVID-19 pandemic, DWMs sold COVID-19 related goods (e.g., masks and COVID-19 tests) that were in shortage in regulated marketplaces as well as unapproved vaccines and fake treatments [5, 6, 7]. Law enforcement agencies have therefore targeted DWMs and users trading on them, performing dozens of arrests and seizing millions of US dollars worth of Bitcoin [8, 9, 10]. Despite police raids and unexpected closures, DWM trading volume has been steadily increasing and exceeded $1.5 billion for the first time in 2020 [11].

DWM users display complex trading patterns within the marketplace environment. For example, users migrate to alternative DWMs when a DWM that they trade on close [12, 13]. Such migration of users is aided by communication via online forums and chats on the dark web [14, 15]. However, little is known about how DWM users trade and transact outside the DWMs. On the one hand, some recent works have shown that a significant number of DWM users trade drugs and other illicit goods using social media platforms, such as Facebook, Telegram, and Reddit [16, 17, 18, 19, 20]. Moreover, several qualitative, interview-based studies have shown that DWM users form direct trading relationships with other users, starting user-to-user (U2U) pairs that bypass the intermediary role of DWMs [21, 22]. Past research has also found that sellers on regulated online marketplaces and social medial platforms may decide to use intermediaries, such Facebook groups or Instagram, to find new customers, and may start direct U2U trading with potential buyers [23]. In this paper, we look closely at patterns of U2U trading relationships among DWM users.

(a) Marketplace ego network
(b) Full network
Figure 1: Ego and full networks. (a) Schematic representation of an ego network surrounding a dark web marketplace (“DWM”, in red). The DWM interacts with its users (“U”, in black), which make user-to-user (U2U) pairs, represented with arrows and their respective users. (b) Multiple ego networks may be aggregated to form the full network.

The starting point for this paper is identifying U2U networks around DWMs. We analyse 40 DWMs for a 10-year time period spanning from June 18, 2011 to January 31, 2021. Our dataset covers all major DWMs that have ever existed, as identified by the European Monitoring Centre, Europol, the World Health Organization, and independent researchers [24, 25, 26]. Our analysis focuses on Bitcoin – the most popular cryptocurrency on DWMs [27, 28] as well as in the regulated economy [29, 30]. We focus on two kinds of transactions, occurring (i) between the user and a DWM and (ii) between two users of the same DWM. The result is 40 distinct marketplace ego networks containing user-DWM and U2U transactions, whose typical structure is depicted in Figure 1(a). In each network, links are directed and the arrows point at the receiver of Bitcoin. Since users often migrate from one DWM to another [12] and become users of multiple DWMs, the 40 ego networks are not isolated, and can be combined to form one full network, as shown in Figure 1(b).

Previous analyses of U2U trading relationships around DWMs include only two studies [21, 22] based on unstructured [21] or semi-structured [22] interviews of 17 users of Silk Road and 13 DWMs sellers, respectively. Here, we dramatically extend previous work by exploring the collective emergence and structure of U2U pairs. First, we observe that the U2U network, formed by all transactions between pairs of users, has a larger trading volume than DWMs themselves. We then identify stable U2U trading relationships, which represent a subset of persistent pairs in our dataset [31, 32] forming the backbone

of the U2U network. We find that 137,667 (i.e., 1.7% out of 7.85 million total) pairs are stable, generating a total trading volume of $1.5 billion (i.e., 5% out of $30 billion total volume). We then explore the behaviour of users forming stable U2U pairs. We reveal that stable U2U pairs play a crucial role for marketplaces by spending significantly more time and generating far greater transaction volume with DWMs than other users. By analysing the temporal evolution of stable pairs, we unveil that DWMs acted as meeting points for 37,192 (out of around 16 million users), whose trading volume is estimated to be $417 million. Importantly, these newly formed pairs persist in time and transact for several months even after the closure of the DWM that spurred their formation. Finally, we observe that COVID-19 only had a temporary impact on the evolution of stable U2U pairs, which continued to increase their trading volume throughout 2020.

Results

Large number of U2U transactions

Ego networks.

We start our analysis by measuring the extent of the U2U network around each DWM. The percentages of users forming U2U pairs vary across DWMs, with a median value of 38% (min 23%, max 68%). The variance in the percentages of users with U2U pairs is shown by Figure 

2(a), which shows that the number of users with U2U pairs obeys an almost linear relationship with the number of users interacting with a DWM, having an exponent equal to 1.06 and . The total trading volume users sent to the marketplace is obviously equivalent to the one they receive from it (two-sided Wilcoxon test [33]: , ). Importantly, the total trading volume users sent to a DWM (and consequently the one that they receive from it) is always less than the one exchanged through U2U transactions, as shown in Figure 2(b).

Figure 2: User-DWM and U2U transactions. (a) Total number of users interacting with a DWM against the total number of them forming U2U transactions. The dotted line corresponds to the result of a fitted power law function. (b) Trading volume in dollars sent to a DWM compared with the total trading volume in its surrounding U2U transactions. The dashed line is the bisector and allows to easily compare the two trading volumes. (c) Total monthly trading volume sent to all DWMs and exchanged in all unique U2U pairs. We do not include the trading volume received from DWMs because it is equivalent as the volume sent to DWMs.

Full network.

Similar results hold for the full network, confirming that the formation of U2U pairs is a pervasive phenomenon around DWMs. The total trading volume users sent to DWMs is $3.8 billion, received from DWMs $3.7 billion, while the volume exchanged through U2U pairs reaches $30 billion. In Figure 8, we illustrate the number of transactions, trading volume, and lifespan of U2U pairs. In all cases we observe familiar fat-tailed distributions.

We then consider the temporal evolution of transactions. We look at the trading volume over time in Figure 2(c), where we observe that U2U transactions have consistently involved greater monthly volume than the volume sent to all DWMs since 2011. This underlines the economic importance of U2U transactions in the Bitcoin ecosystem relative to DWMs.

Behaviour of the U2U network

Henceforth, we are going to analyse users by focusing on the following groups: users who do not form stable U2U pairs; users who form stable U2U pairs, of which there are users who met outside DWMs and users who met inside DWMs (see the nomenclature in Table 2). We start by focusing our attention on identifying stable U2U pairs, i.e., persistent pairs of the U2U network. To this end, we use the evolving activity-driven model [31] to extract them in a statistically-principled way (see Methods). We find 137,667 stable U2U pairs formed by 106,648 users and generating a trading volume equal to $1.5 billion. Stable pairs produce five times more transactions per pair than non-stable pairs (two-sided Mann-Whitney-U test [34]: MNU, ) corresponding to a 5.34 times larger trading volume (MNU, ), see Figure 9. Stable pairs, despite representing less than 2% of the total number of U2U pairs, generate a disproportionate amount of trading volume.

Figure 3: Role of users forming stable U2U pairs. (Main) PDFs of trading volume that users exchange with any DWMs. (Inset) PDFs of time spent by users on any DWMs. These distributions are explored for each of the 40 DWMs under consideration in Figure 10 and 11, respectively. Vertical lines represent median values of the respective distributions.

The high activity of users forming stable U2U pairs is not limited to the U2U network, as they are also the most active in trading with DWMs. Users in stable U2U pairs spend a median number of 41 days on DWMs versus a median of only one day for users without stable pairs. The two resulting distributions are significantly different (two-sided Kolmogorov-Smirnov test [35]: KS , ), see the inset of Figure 3. When we look at the trading volume with DWMs, we find qualitatively similar results. Users in stable U2U pairs transact a median of $400 with DWMs, while other users transact only $56. The two resulting distributions are significantly different (KS , ), see Figure 3. These results hold not only for full network but for every DWM in our data, see Figure 10 and 11.

U2U network evolution

Formation of U2U stable pairs.

Table 1: Formation mechanism of stable U2U pairs.

We compare the time in which the first transaction between a pair of users occur with the time in which these users interact with the same DWM. Each row in the figure indicates a possible temporal sequence, which we classify in two groups: users who met outside the DWM (first two columns) and users who met inside the DWM (last column).

Having mapped the behaviour of stable pairs, we now consider their temporal evolution. More specifically, we ask: How do stable pairs form? Do DWMs spur their creation? One possible hypothesis is that users meet for the first time while active on a DWM, i.e., after they have both traded with that DWM, see Table 1 and the nomenclature in Table 2. This can be considered as a plausible, and conservative, proxy for users who met inside a DWM (see Methods). A total of 37,129 users have met at least one other user inside a DWM. Their trading volume is about $417 million, and the percentage of users who met inside a DWM is proportional to the trading volume sent to DWMs (Spearman [36]: , ), see Fig 12, meaning that large DWMs are more likely to favour the encounter of users than smaller DWMs. Importantly, users who met inside a DWM transact more than those meeting outside them. In particular, users who met inside a DWM trade a median of $2,212 between themselves, almost twice the $1,379 for users meeting outside the DWM (MNU, ). Moreover, users who met inside a DWM tend to make transactions significantly longer with median of 61 days than users meeting outside with a median of 50 days (MNU , ).

Figure 4: Resilience of stable U2U pairs after DWMs closure.

Trading volume of U2U pairs surrounding active DWMs. (Main) U2U pairs meet who met inside aa DWM. (Inset) U2U pairs meet outside them. Curves indicate the median value while bands represent the 95% confidence interval. Day zero corresponds to the day when the market closed. Negative and positive numbers indicate the days prior and after the closure, respectively. Only the 33 DWMs closed are considered in the analysis.

Resilience of U2U stable pairs.

Thus far, we have shown that users involved in stable trading relationships are also very active on DWMs, where they may meet new trading partners. But are DWMs and the U2U network truly interdependent? In particular, do stable pairs need the DWMs to survive? To answer these questions, we look at market closures, previously investigated to show how active users migrate to other existing DWMs [12]. Our dataset includes 33 closure events, which we study independently from one another by considering the evolution of the respective 33 marketplace ego networks. We find that non-stable U2U pairs sharply stop interacting immediately after DWM closure therefore their existence is highly sensitive to the presence of the DWM. On the other hand, the trading volume of stable U2U pairs is only marginally affected by the disappearance of the DWM. As a result, while prior to DWM closure non-stable U2U pairs generate an overall trading volume that is 10 times higher than that of stable U2U pairs (since non-stable pairs are far more prevalent), within a few weeks after DWM closure the pattern is reversed: stable U2U pairs generate more trade volume than non-stable U2U pairs. Indeed, trading patterns of stable pairs are not significantly influenced by DWMs closure, see Figure 4.

We have shown that the U2U network is resilient to short-lasting external shocks, namely the closure of a marketplace, and it does not need the centralised structure of DWMs to survive. What about long-lasting systemic stress? To answer this question, we consider the impact that the COVID-19 pandemic has had on the evolution of stable U2U pairs. Previous studies reported that COVID-19 had a strong impact on DWMs, with reported delays and damage to the shipping infrastructure due to border closures [37, 38]. We start by investigating the number of new stable U2U pairs and their trading volume. Users in stable pairs meeting both inside and outside DWMs have been growing over the last two years. In 2020, a total of 6,778 pairs of users in stable pairs met inside a DWM, corresponding to the 192% of 2019 and to the 255% of 2018, see Figure 13(a). Pairs of users in stable pairs meeting inside a DWM traded for a total of $145 million in 2020, which corresponds to the 252% of 2019, and the 593% of 2018, see Figure 13(b). We see similar trends for stable U2U pairs meeting outside any DWMs. The impact of the COVID-19 pandemic has, however, had different phases, determined by the number and level of measures introduced around the world. For users in stable pairs who met both inside or outside DWMs, we find that during the first lockdowns in 2020 trading volume fell with respect to January of the same year, suggesting that they were negatively impacted by COVID-19 restrictions. After that, trading volume sharply increased over all 2020, see Figure 14. The number of stable U2U pairs created each day was, however, steady over time during 2020, even though more U2U pairs were created compared to the same period of 2019, see Figure 15. Overall, stable U2U pairs have shown resilience to the systemic stress caused by COVID-19, suggesting, once again, that these trading relationships are fundamentally independent from the underlying DWMs.

Discussion and Conclusion

In this paper, we revealed the prevalence and structure of a large network of direct transactions between users who trade on the same DWM. We showed that some of the links of this user-to-user (U2U) network are ephemeral while other persist in time. We highlighted that a significant fraction of stable U2U pairs formed as their members were trading with the same DWM, suggesting that DWMs may play a role in promoting the formation of stable U2U pairs. We showed that the relationships between users forming stable pairs persist even after the DWM shuts down and are not significantly affected by COVID-19, suggesting overall resilience of stable pairs to external shocks.

Our study has several limitations. In particular, our dataset does not include any attributes related to either users or their Bitcoin transactions, such as, whether the transaction represents an actual purchase or not. Moreover, we do not have information about which users trade with other users on the same DWM. Finally, our coverage of DWMs, albeit extensive, may lack information on other DWMs where users could have met.

Our work has several policy implications. Our findings suggest that DWMs are much more than mere marketplaces [39]. DWMs are also communication platforms, where users can meet and chat with other users either directly – using Whatsapp, phone, or email – or through specialised forums. These direct interactions may favour the emergence of decentralised trade networks that bypass the intermediary role of the marketplace, similar to what is currently happening on Facebook, Telegram, and Reddit [16, 23, 17, 18, 19, 20], where users post products, negotiate item prices, and then trade directly without an intermediary. We estimate that the trading volume of U2U pairs meeting on DWMs is increasing, reaching a peak in 2020 (during the COVID-19 pandemic). Indeed, our results support recent recommendations of paying attention to single sellers rather than entire DWMs [40]. Law enforcement agencies, however, have only recently started targeting single sellers. The first operation took place in 2018 and successfully led to the arrest of 35 sellers [41], while the largest operation to date occurred in 2020 and led to 179 arrests in six different countries [42]. Our study indicates that a much higher number of highly active DWM users, on the order of tens of thousands, is involved in transactions with other DWM users.

Overall, our study provides a first step towards the understanding of how users of DWMs collectively behave outside organised marketplace. We believe that the results might suggest to researchers, practitioners, and law enforcement agencies that a shift in the attention from the evolution of DWMs to the behaviour of their users might facilitate the design of more appropriate strategies to counteract online trading of illicit goods.

Competing interests

The authors declare that they have no competing interests.

Author’s contributions

M.N., A.Br., A.E., P.G., A.T., and A.Ba. designed the research; A.E. and P.G., acquired, prepared, and cleansed the data. M.N. and A.Br. performed the measurements. M.N., A.Br., A.E., P.G., A.T., and A.Ba. analysed the data. M.N., A.Br., P.G., A.T., and A.Ba. wrote the manuscript. M.N., A.Br., A.E., P.G., A.T., and A.Ba. discussed the results and commented on the manuscript.

Acknowledgements

M.N., A.Br., A.T., and A.Ba. were supported by ESRC as part of UK Research and Innovation’s rapid response to COVID-19, through grant ES/V00400X/1.

Data availability

All data needed to evaluate the conclusions in the paper are present in the paper. Additional data related to this paper may be requested from the authors.

Data and methods

Additional considerations on our data and methods are available in Section 1.

Data preprocessing.

We consider only a subset of the transactions in our dataset. Namely, the ones made by the 40 entities representing the 40 DWMs under consideration, which directly interact with more than 16 million other entities, who are the users of these DWMs. Users interacting with other users form U2U pairs and we include them in our dataset. We instead discard single Bitcoin transactions below $0.01 or above $100,000, which are unlikely to show real purchases and minimise false positives. They may be attributed to a residual amount of Bitcoins in an address or transactions between two business partners where no good is actually given in return, respectively. The analysed dataset includes about 31 million transactions among more than 16 million users. Finally, we note that the same user can interact in multiple DWMs [12, 13]. By definition, users that interact among themselves form U2U transactions. If the pair of users interact with multiple DWMs these U2U transactions are included in all relative DWMs and counted multiple times. Therefore, the simple sum of all U2U transactions of each DWM is more than the sum of all unique U2U transactions. We count a total of 11 million transactions around all DWMs, that goes down to 9.9 million when multiple counting is avoided. Similarly, the simple sum of the single trading volumes surrounding all DWMs amounts to $33 billion, while the overall trading volume in all unique U2U pairs is $30 billion. Among the 40 large DWMs under consideration, 17 participate in at least one transaction in either 2020 or 2021, while the remaining 23 closed before 2020. Notably, our dataset includes Silk Road (the first modern DWM) [1], Alphabay (once the leading DWM) [43], and Hydra (currently the largest DWM in Russia) [12]. Other general statistics about our dataset can be found in the Section 3.

Figure 5: U2U network. The U2U network is formed by the entire set of interacting users (black and gray arrows with their respective users). Using the evolving activity-driven model [31], U2U pairs are divided in either stable (black arrows and respective users) or non-stable (gray arrows and respective users).

Detection of the U2U network.

The detection of stable U2U pairs in the full network is done by using the evolving activity-driven model [31], which introduced a statistically-principled methodology to detect the network backbone against what expected from a proper null model. If a U2U pair occurs significantly more than what expected from the null model, it is labeled as stable, otherwise as non-stable. The evolving activity-driven model is an appropriate methodology for large temporal networks [32] and it is implemented in the Python 3 pip library TemporalBackbone [44], where default parameter values have been used. As input parameter, we considered the full network, comprehending transactions from/to DWMs and U2U transactions between users (see Section 4).

Users who met inside a DWM.

We determine whether U2U pairs meet while active on a DWM by looking at the time occurrence of their first U2U transaction. This transaction can occur at three different moment in time. (i) At

, before both users interact with the same DWM (occurring at and , respectively), as shown on the left hand side of Table 1. (ii) At , when only one user has interacted with a specific DWM and the other user will do so at a later time, as in the middle column of Table 1. (iii) At , when both users have interacted with the same DWM, as in the right column of Table 1. We classify these three chain of events in two groups. One group includes all pairs that meet outside any DWMs, which includes case (i) and case (ii), and the other group users that meet inside a DWM, described by case (iii). This last case constitute a conservative proxy for users that meet who met inside aa DWM. The proxy admits the possibility of false positives, since it consider users who met inside a the same DWM without having interacted on it, as well as false negatives, since it does not take into account users who met inside a DWM without having ever interacted on it. The latter is arguably more significant, since it is possible that only one of the two users (the seller) has actually engaged in transactions with the DWM, while the other user, after seeing the seller’s profile on a DWM, has established a direct contact, through Whatsapp, email, or phone.

Nomenclature of all groups considered.

We provide the definition of all considered groups in Table 2.

max width= Group Description Number of users 1. Users who do not form stable U2U pairs Users that form neither stable U2U pair nor U2U pairs 15,875,877 2. Users who form stable U2U pairs Users who form at least one stable U2U pair as detected by our chosen metholodogy [31] 106,648 2a. Users who met outside DWMs Users that form stable pairs and met at least one other user following the chain of events in Table 1 (first two columns) 88,828 2b. Users who met inside a DWM Users that form stable pairs and met at least one other user following the chain of events in Table 1 (last column) 37,129

Table 2: Nomenclature. Definitions of all groups the users are divided to based on their behaviour. Number of users in each group is given in the last column.

References

  • [1] Nicolas Christin. Traveling the Silk Road: A measurement analysis of a large anonymous online marketplace. In Proceedings of the 22nd international conference on World Wide Web, pages 213–224, 2013.
  • [2] Roger Dingledine, Nick Mathewson, and Paul Syverson. Tor: The second-generation onion router. Technical report, Naval Research Lab Washington DC, 2004.
  • [3] Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system. Technical report, Manubot, 2008.
  • [4] Gwern. Darknet market mortality risks. https://www.gwern.net/DNM-survival Accessed October 27, 2021, 2019.
  • [5] Roderic Broadhurst, Matthew Ball, and Chuxuan Jiang. Availability of COVID-19 related products on Tor darknet markets. Australian Institute of Criminology, April 2020.
  • [6] Alberto Bracci, Matthieu Nadini, Maxwell Aliapoulios, Damon McCoy, Ian Gray, Alexander Teytelboym, Angela Gallo, and Andrea Baronchelli. Dark Web Marketplaces and COVID-19: Before the vaccine.

    EPJ Data Science

    , 10, 2021.
  • [7] Alberto Bracci, Matthieu Nadini, Maxwell Aliapoulios, Damon McCoy, Ian Gray, Alexander Teytelboym, Angela Gallo, and Andrea Baronchelli. Dark Web Marketplaces and COVID-19: The vaccines. arXiv preprint arXiv:2102.05470, 2021. (+) Contributed equally.
  • [8] Europol. Operation Onymous. https://www.europol.europa.eu/activities-services/europol-in-action/operations/operation-onymous Accessed October 27, 2021, 2014.
  • [9] Darknet takedown: Authorities shutter online criminal market AlphaBay. https://www.fbi.gov/news/stories/alphabay-takedown Accessed October 27, 2021, 2017. FBI.
  • [10] Chris Isidore. Feds seize 1 billion in Bitcoins they say were stolen from silk road. https://edition.cnn.com/2020/11/06/business/bitcoin-seized-silk-road-ulbricht/index.html Accessed January 4, 2021, 2020. CNN.
  • [11] Chainalysis. The Chainalysis 2021 crypto crime report. https://go.chainalysis.com/2021-Crypto-Crime-Report.html Accessed October 27, 2021, 2021.
  • [12] Abeer ElBahrawy, Laura Alessandretti, Leonid Rusnac, Daniel Goldsmith, Alexander Teytelboym, and Andrea Baronchelli. Collective dynamics of dark web marketplaces. Scientific reports, 10(1):1–8, 2020.
  • [13] Naoki Hiramoto and Yoichi Tsuchiya. Measuring dark web marketplaces via bitcoin transactions: From birth to independence. Forensic Science International: Digital Investigation, 35:301086, 2020.
  • [14] Julia Buxton and Tim Bingham. The rise and challenge of dark net drug markets. Policy brief, 7:1–24, 2015.
  • [15] Alexia Maddox, Monica J Barratt, Matthew Allen, and Simon Lenton. Constructive activism in the dark web: cryptomarkets and illicit drugs in the digital ‘demimonde’. Information, Communication & Society, 19(1):111–126, 2016.
  • [16] Atte Oksanen, Bryan Lee Miller, Iina Savolainen, Anu Sirola, Jakob Demant, Markus Kaakinen, and Izabela Zych. Illicit drug purchases via social media among american young people. In International Conference on Human-Computer Interaction, pages 278–288. Springer, 2020.
  • [17] German police seized nine telegram-based drug markets. https://darknetlive.com/post/german-police-seized-nine-telegram-based-drug-markets/ Accessed October 27, 2021, 2020. DarknetLive.
  • [18] Yik-Hei Sung, Wing-Ho Lee, Franco Ka-Wah Leung, and Jonathan J Fong. Prevalence of illegal turtle trade on social media and implications for wildlife trade monitoring. Biological Conservation, 261:109245, 2021.
  • [19] Andrew Childs, Melissa Bull, and Ross Coomber. Beyond the dark web: Navigating the risks of cannabis supply over the surface web. Drugs: Education, Prevention and Policy, pages 1–12, 2021.
  • [20] K Hazel Kwon and Chun Shao. Dark knowledge and platform governance: A case of an illicit e-commerce community in reddit. American Behavioral Scientist, 65(6):779–799, 2021.
  • [21] Monica J Barratt, Simon Lenton, Alexia Maddox, and Matthew Allen. “what if you live on top of a bakery and you like cakes?”—drug use and harm trajectories before, during and after the emergence of silk road. International Journal of Drug Policy, 35:50–57, 2016.
  • [22] Rasmus Munksgaard, James Martin, et al. How and why vendors sell on cryptomarkets. Trends and Issues in Crime and Criminal Justice, 608:1, 2020.
  • [23] Silje Anderdal Bakken and Jakob Johan Demant. Sellers’ risk perceptions in public and private social media drug markets. International Journal of Drug Policy, 73:255–262, 2019.
  • [24] European Monitoring Centre for Drugs, Drug Addiction, and Europol. Drugs and the darknet: Perspectives for enforcement, research and policy, 2017.
  • [25] World Health Organization. World drug report 2019. United Nations publication, Sales No. E, 19, 2019.
  • [26] Gwern. Updated: list of dark net markets (Tor & I2P). https://www.gwern.net/docs/sr/2019-04-22-deepdotweb-dnmlist.html Accessed October 27, 2021, 2020.
  • [27] Seunghyeon Lee, Changhoon Yoon, Heedo Kang, Yeonkeun Kim, Yongdae Kim, Dongsu Han, Sooel Son, and Seungwon Shin. Cybercriminal minds: An investigative study of cryptocurrency abuses in the dark web. In Network and Distributed System Security Symposium, pages 1–15. Internet Society, 2019.
  • [28] Sean Foley, Jonathan R Karlsen, and Tālis J Putniņš. Sex, drugs, and Bitcoin: How much illegal activity is financed through cryptocurrencies? The Review of Financial Studies, 32(5):1798–1853, 2019.
  • [29] Aaron W Baur, Julian Bühler, Markus Bick, and Charlotte S Bonorden. Cryptocurrencies as a disruption? Empirical findings on user adoption and future potential of Bitcoin and co. In Conference on e-Business, e-Services and e-Society, pages 63–80. Springer, 2015.
  • [30] Ed Saiedi, Anders Broström, and Felipe Ruiz. Global drivers of cryptocurrency infrastructure adoption. Small Business Economics, pages 1–54, 2020.
  • [31] Matthieu Nadini, Christian Bongiorno, Alessandro Rizzo, and Maurizio Porfiri. Detecting network backbones against time variations in node properties. Nonlinear Dynamics, 99(1):855–878, 2020.
  • [32] Matthieu Nadini, Alessandro Rizzo, and Maurizio Porfiri. Reconstructing irreducible links in temporal networks: which tool to choose depends on the network size. Journal of Physics: Complexity, 1(1):015001, 2020.
  • [33] Frank Wilcoxon. Individual Comparisons by Ranking Methods. In Breakthroughs in Statistics, pages 196–202. Springer, 1992.
  • [34] Henry B Mann and Donald R Whitney.

    On a test of whether one of two random variables is stochastically larger than the other.

    The Annals of Mathematical Statistics, pages 50–60, 1947.
  • [35] Frank J Massey Jr. The Kolmogorov-Smirnov test for goodness of fit. Journal of the American statistical Association, 46(253):68–78, 1951.
  • [36] Charles Spearman. The proof and measurement of association between two things. Appleton-Century-Crofts, 1961.
  • [37] Andréanne Bergeron, David Décary-Hétu, and Luca Giommoni. Preliminary findings of the impact of COVID-19 on drugs crypto markets. International Journal of Drug Policy, 83:102870, 2020.
  • [38] Covid is causing shipping issues, but natural competitive forces are causing darknet market consolidation. https://blog.chainalysis.com/reports/darknet-markets-cryptocurrency-2020 Accessed October 27, 2021, 2020. Chainalysis Team.
  • [39] Abhineet Gupta, Sean B Maynard, and Atif Ahmad. The dark web phenomenon: A review and research agenda. arXiv preprint arXiv:2104.07138, 2021.
  • [40] Martin Horton-Eddison, Patrick Shortis, Judith Aldridge, and Fernando Caudevilla. Drug cryptomarkets in the 2020s: Policy, enforcement, harm, and resilience. Global Drug Policy Observatory, 2021.
  • [41] Office of Public Affairs. First nationwide undercover operation targeting darknet vendors results in arrests of more than 35 individuals selling illicit goods and the seizure of weapons, drugs and more than $23.6 million. https://www.justice.gov/opa/pr/first-nationwide-undercover-operation-targeting-darknet-vendors-results-arrests-more-35 Accessed October 27, 2021, 2018. Department of Justice, United States.
  • [42] Europol Team. International sting against dark web vendors leads to 179 arrests. https://www.europol.europa.eu/newsroom/news/international-sting-against-dark-web-vendors-leads-to-179-arrests Accessed October 27, 2021, 2020. Europol.
  • [43] Joe Van Buskirk, Sundresan Naicker, RB Bruno, C Breen, and A Roxburgh. Drugs and the internet. The National Illicit Drug Indicators Project, 2016.
  • [44] Matthieu Nadini. Temporalbackbone. https://pypi.org/project/TemporalBackbone/ Accessed October 27, 2021, 2021. Python pip 3 library: A tool to detect the backbone in temporal networks.
  • [45] Chainalysis. The 2021 global crypto adoption index: Worldwide adoption jumps over 880% with p2p platforms driving cryptocurrency usage in emerging markets. https://blog.chainalysis.com/reports/2021-global-crypto-adoption-index Accessed October 27, 2021, 2020.
  • [46] Merve Can Kus Khalilov and Albert Levi. A survey on anonymity and privacy in Bitcoin-like digital cash systems. IEEE Communications Surveys & Tutorials, 20(3):2543–2585, 2018.
  • [47] Darknetlive. https://darknetlive.com/markets/darkbay/ Accessed October 27, 2021, 2020.
  • [48] Anthony Cuthbertson. Coronavirus: dark web market bans drug dealers selling fake COVID-19 vaccines. https://www.independent.co.uk/life-style/gadgets-and-tech/news/coronavirus-vaccine-cure-dark-web-drugs-market-covid-19-a9442671.html Accessed October 27, 2021, 2020. Independent.
  • [49] Frank Wehinger. The dark net: Self-regulation dynamics of illegal online markets for identities and related services. In 2011 European Intelligence and Security Informatics Conference, pages 209–213. IEEE, 2011.
  • [50] Kyle Soska and Nicolas Christin. Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. In 24th USENIX security symposium (USENIX security 15), pages 33–48, 2015.
  • [51] Emcdda special report: COVID-19 and drugs – drug supply via darknet markets. https://www.emcdda.europa.eu/publications/ad-hoc/covid-19-and-drugs-drug-supply-via-darknet-markets_en Accessed October 27, 2021, 2020. European Monitoring Centre for Drugs and Drug Addiction (EMCDDA).
  • [52] Dread forum. https://onion.live/site/dread-forum Accessed via Tor browser October 27, 2021, 2020.
  • [53] Raptor.life. Your most trusted darknet markets links directory. https://raptor.life/index.php Accessed October 27, 2021, 2020.
  • [54] Darknetlive. https://darknetlive.com/ Accessed October 27, 2021, 2020.
  • [55] Dark.fail. https://dark.fail/ Accessed October 27, 2021, 2020.
  • [56] Monica J Barratt, Jason A Ferris, and Adam R Winstock. Use of Silk Road, the online drug marketplace, in the United Kingdom, Australia and the United States. Addiction, 109(5):774–783, 2014.
  • [57] James Martin. Lost on the Silk Road: Online drug distribution and the cryptomarket. Criminology & Criminal Justice, 14(3):351–367, 2014.
  • [58] Judith Aldridge and David Décary-Hétu. Not an Ebay for drugs: The cryptomarket Silk Road as a paradigm shifting criminal innovation. Available at SSRN 2436643, 2014.
  • [59] James Martin. Drugs on the dark net: How cryptomarkets are transforming the global trade in illicit drugs. Springer, London, UK, 2014.
  • [60] Malte Möser, Kyle Soska, Ethan Heilman, Kevin Lee, Henry Heffan, Shashvat Srivastava, Kyle Hogan, Jason Hennessey, Andrew Miller, Arvind Narayanan, et al. An empirical analysis of traceability in the monero blockchain. Proceedings on Privacy Enhancing Technologies, 2018(3):143–163, 2018.
  • [61] Bitcoincore. https://bitcoin.org/en/bitcoin-core/ Accessed October 27, 2021, 2020.
  • [62] Blockchain.com. www.blockchain.com Accessed October 27, 2021, 2020. Daily Mail.
  • [63] Dorit Ron and Adi Shamir. Quantitative analysis of the full Bitcoin transaction graph. In International Conference on Financial Cryptography and Data Security, pages 6–24. Springer, 2013.
  • [64] Elli Androulaki, Ghassan O Karame, Marc Roeschlin, Tobias Scherer, and Srdjan Capkun. Evaluating user privacy in Bitcoin. In International Conference on Financial Cryptography and Data Security, pages 34–51. Springer, 2013.
  • [65] Paolo Tasca, Adam Hayes, and Shaowen Liu. The evolution of the Bitcoin economy. The Journal of Risk Finance, 2018.
  • [66] Martin Harrigan and Christoph Fretter. The unreasonable effectiveness of address clustering. In 2016 Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC/ATC/ScalCom/CBDCom/IoP/SmartWorld), pages 368–373. IEEE, 2016.
  • [67] Sarah Meiklejohn, Marjori Pomarole, Grant Jordan, Kirill Levchenko, Damon McCoy, Geoffrey M Voelker, and Stefan Savage. A fistful of Bitcoins: Characterizing payments among men with no names. In Proceedings of the 2013 conference on Internet measurement conference, pages 127–140, 2013.
  • [68] Wikipedia now accepts bitcoin donations. https://www.coindesk.com/wikipedia-now-accepts-bitcoin-donations Accessed October 27, 2021, 2014. Coindesk.
  • [69] Chainalysis, inc. https://www.chainalysis.com/ Accessed October 27, 2021, 2020.
  • [70] YoonJae Chung. Cracking the code: How the us government tracks Bitcoin transactions. Analysis Of Applied Mathematics, page 152, 2019.
  • [71] Chainalysis. Chainalysis in action: How law enforcement used blockchain analysis to follow funds and identify the twitter hackers. https://blog.chainalysis.com/reports/chainalysis-doj-twitter-hack-2020 Accessed October 27, 2021, 2020.
  • [72] Jeffrey D Scargle, Jay P Norris, Brad Jackson, and James Chiang. Studies in astronomical time series analysis. VI. Bayesian block representations. The Astrophysical Journal, 764(2):167, 2013.

1 Additional data and methods

Identification of real identities performing Bitcoin transactions.

The trading volume of DWMs has been steadily increasing and exceeded $1.5 billion for the first time in 2020 [11]. The vast majority of such trading has occurred in Bitcoin, which is the most popular cryptocurrency to date. Its worldwide adoption has further increased in 2021, jumping over 880% with respect to 2020 [45]

. Bitcoin allows users to use pseudonym (public address) instead of their real identities. Users can create a new pseudonym at each transaction, requiring only a computer and an internet connection. However, various heuristics exist to cluster addresses together to recover the real identity behind pseudonyms 

[46]. In our dataset, this process is done by Chainalysis Inc. (see Section 2). In the dataset, real entities represent DWMs, users of DWMs, or other entities interacting with these users. Transactions to and from Bitcoin trading exchanges are removed, because our primary interest entails the study of direct interactions between DWMs and single users. The dataset comprises of 40 DWMs, for a total of 149 transactions among 57 million real entities. Each Bitcoin transaction has an associated timestamp , indicating the time at which the transaction occurred. The dataset is sparse, with 54.6% of all entities performing a transaction only. The conversion from Bitcoin to dollars is done using the price of Bitcoin at the time of the transaction.

Evaluation of coefficients of the trend line in Figure 2(a).

The coefficients and of the trend line in Figure 2(a) are in good agreement with the empirical data, , and evaluated as follows. First, the equation is transformed to , where and . The linear equation fitted against real data and coefficients and computed by minimizing the sum of squares.

Statistical analysis.

We compare the median of two paired distributions using the two-sided Wilcoxon test [33]

. It is a non-parametric statistical test and verifies the null hypothesis that two paired samples come from distributions with the same median. If distributions are not paired, we use the Mann-Whitney-U test to assess statistical differences of the medians of two distributions 

[34]. We compare two distributions using the Kolmogorov-Smirnov test [35] on two samples. It tests the null hypothesis that 2 independent samples are drawn from the same continuous distribution. We evaluate the correlation between two sets of values using the Spearman rank-order correlation coefficient [36]

. It is a correlation coefficient that does not assume normally distributed values and varies between -1 and 1: with -1 implying a negative correlation, 0 no correlation, and 1 a positive correlation.

2 Dark web marketplaces and identification of real identities performing Bitcoin transactions.

2.1 Dark web marketplaces

DWMs are in many ways similar to other online marketplaces. They have strict policies that every user must follow. For instance, in some DWMs are banned categories of products, like human trafficking, contract killing, weapons, or COVID-19 fake vaccines [47, 48]. Registration is required for all sellers, and sometimes also for buyers. Certified sellers can advertise their products. They have a reputation, which is based on buyers’ reviews [49, 50]. They are also responsible for delivering the products, sometimes with a tracking number attached, and may offer refunds or reshipment. Buyers are free to look at the listings and sometimes can ask questions directly to the relative seller [51, 6]. Payments are often protected by escrow services. These are third-party services, which guarantee that buyers can safely have their money refunded. Users’ on DWMs constitute an active community. Numerous are websites and forums where users can share their experience and get advice on the most trustworthy DWMs and sellers, such as Dread [52], Raptor.life [53], DarkNetLive [54], and DarkFail [55].

DWMs have some unique features as well. They sell several kinds of illicit products, like drugs, fake IDs, and medicines [56, 57, 58]. They are not accessible by standard web search-engines, but operate online in an encrypted part of the Internet [59]. Potential buyers can easily access to DWMs using specialized browsers, like The Onion Router (Tor) [2], and anonymously trade illicit goods using cryptocurrencies, like Bitcoin [3]. Bitcoin is currently the most popular cryptocurrency on DWMs [27, 28, 60] and its adoption is growing in the regular economy as well. Its infrastructure seems to ensure complete anonymity to its users. If a proper technique is adopted, however, there are chances to link the Bitcoin blockchain (that is, the entire Bitcoin transaction history) with the user’s real identity [46]. When the Bitcoin blockchain is successfully linked to a real identity, the records of past, present, and future Bitcoin transactions is traceable, easily accessible, and can be used by companies, law enforcement agencies, and researchers.

2.2 Identification of real identities performing Bitcoin transactions

The raw, anonymized Bitcoin blockchain can be publicly accessed through Bitcoin core [61] or third-party APIs such as Blockchain.com [62]. It contains information about origin and destination addresses, as well as time and amount of the transactions. In order to contrast traceability of the real identity, an user is likely to use multiple addresses. A new address is often generated in each transaction. Grouping the addresses in clusters reduces the complexity of the Bitcoin blockchain and challenge users’ anonymity [63]. Given that millions of Bitcoin addresses are currently active and many others are continuously being generated, a clustering approach primarily based on manual annotation is not feasible. Various heuristics, instead, have been proposed[63, 64, 65, 66]. They were successful in grouping Bitcoin addresses and associate them to cluster of real entities. For instance, in [63], the authors were able to find a connection between a set of large transactions and a single one, which was dated in November 2010. In [64], the authors applied to a daily university setting the privacy protocol recommended in Bitcoin transactions, finding that almost 40% of the real identities would be recovered. Another work showed the presence of “super clusters” of entities, which marked macro-variations in the evolution of the Bitcoin economy [65]. The primary reasons behind the effectiveness of heuristic clustering are: “address reuse, avoidable merging, super-clusters with high centrality, and the incremental growth of address clusters” [66].

Figure 6: Identification of real entities in the Blockchain. End goal of Bitcoin transactions clustering techniques: mapping a series of Bitcoin addresses to real entities. In this example, an address sends Bitcoins to another address. Thanks to the identification process, the two addresses are associated with two real entities. The Bitcoin transaction between the two entities becomes traceable and transparent.

The end goal of clustering Bitcoin addresses is to map them to single, real entities, as shown in Figure 6. To achieve this goal, however, heuristic clustering techniques should be improved. Manual annotation has shown a valuable potential [67]. It consists on gathering publicly available Bitcoin addresses, like the Wikimedia Foundation one [68], and engage through direct interaction with unknown Bitcoin addresses. If some real entities are known, it is easier to associate the remaining Bitcoin addresses to other real identities. In the last few years, companies specialising in Bitcoin analytics have started to leverage previous methodologies [63, 64, 65, 66, 67] to unveil real entities. The leading company in analysing Bitcoin transactions on DWMs is Chainalysis Inc. [69], which has also aided several federal investigations. For instance, it supported the United States Internal Revenue Service (IRS) in tracking Bitcoin transactions [70] and the FBI in the Twitter hack [71]. Chainalsysis clusters Bitcoin transactions in groups by combining previous methodologies [63, 64, 65, 66] and real entities are unveiled with an approach similar to [67] (see Section 2 for more details on DWMs and this clustering technique). In the dataset, real entities represent DWMs, users of DWMs, or other real entities interacting with these users. Chainalysis aims at minimizing the false positives, who may lead to wrongly associate a real entity with illicit activities. If a Bitcoin address cannot be uniquely ascribed to a real entity, it is included in our dataset as an independent and unnamed entity. Only a fraction of the entities in our dataset thus represent named and real entities, which identity is known. Given that there are millions of entities in our dataset, it is impossible to identify all the corresponding real identities. After the identification process is completed, to each real entity is associated a string of numbers and the dataset re-anonymized. Transactions to and from Bitcoin trading exchanges are also removed, because our primary interest entails the study of direct interactions between real entities.

3 General statistics of the 40 DWMs under consideration

max width= Name Transactions with a DWM U2U transactions Users (sent; received; total) Trading volume in millions (sent; received; total) Users (sent; received; total) Trading volume in millions (total) Abraxas (95,642; 21,500; 111,003) (21.85; 27.23; 49.09) (28,588; 25,546; 44,151) 61.92 Agora (462,106; 119,221; 537,983) (141.3; 132.8; 274.1) (168,248; 151,699; 252,984) 558.0 AlphaBay (1,658,059; 334,154; 1,898,850) (537.1; 568.6; 1,106) (524,783; 422,881; 776,183) 1581 Apollon (68,373; 13,954; 79,307) (12.90; 16.59; 29.50) (19,468; 17,290; 29,900) 49.38 Basetools (119,114; 347; 119,461) (4.712; 6.727; 11.44) (32,191; 34,169; 50,939) 63.23 Benumb Shop (27,229; 343; 27,556) (3.929; 5.027; 8.956) (5,499; 5,654; 8,985) 21.73 BitBazaar (20,805; 150; 20,931) (2.681; 4.425; 7.106) (6,939; 6,569; 10,126) 14.13 Black Bank (52,783; 15,147; 64,131) (11.41; 11.78; 23.19) (15,843; 13,486; 24,291) 31.11 Blue Sky (16,002; 10,140; 22,616) (3.225; 3.786; 7.011) (9,763; 6,149; 12,108) 10.86 Buybest (334,741; 3,004; 337,556) (24.45; 7.490; 31.94) (57,001; 59,131; 99,390) 132.4 Bypass Shop (861,716; 8,118; 869,593) (65.66; 54.36; 120.0) (176,905; 174,151; 288,745) 804.3 DarkMarket (176,141; 13,554; 183,010) (27.25; 36.62; 63.87) (72,923; 67,621; 105,416) 166.7 Dream (466,511; 45,399; 507,837) (57.64; 72.95; 130.6) (109,871; 70,706; 154,873) 287.3 Empire (405,202; 9,690; 413,858) (64.38; 56.84; 121.2) (63,431; 56,415; 103,886) 287.4 Evolution (216,604; 34,512; 240,713) (47.58; 50.15; 97.73) (77,331; 72,711; 115,496) 236.7 FEshop (1,134,456; 5,858; 1,140,275) (64.67; 48.83; 113.5) (244,318; 261,489; 420,040) 834.4 Flugsvamp 2.0 (104,385; 21,201; 119,893) (23.01; 38.20; 61.22) (29,215; 23,079; 41,047) 144.2 Flugsvamp 3.0 (217,083; 20,773; 234,563) (39.34; 52.78; 92.12) (52,075; 49,881; 81,527) 473.8 FuLLzShOp (21,716; 9; 21,726) (3.937; 4.510; 8.447) (4,147; 4,496; 7,209) 10.07 Hansa (330,565; 73,202; 358,120) (60.64; 55.91; 116.6) (153,567; 127,514; 209,717) 76.60 Hydra (4,031,013; 666,075; 4,584,339) (1,868; 1,810; 3,678) (2,447,548; 2,099,320; 3,124,366) 20,840 Joker’s Stash (806,089; 1,090; 807,140) (153.0; 49.95; 203.0) (154,872; 156,689; 260,832) 926.2 LuxSocks.ru (326,159; 186; 326,340) (8.123; 5.573; 13.70) (59,638; 66,011; 97,705) 175.8 Matanga (57,354; 633; 57,963) (5.882; 7.775; 13.66) (10,637; 10,328; 17,632) 96.35 Middle Earth (38,017; 9,206; 45,629) (8.361; 9.151; 17.51) (8,091; 7,603; 12,990) 18.68 MrGreen.ws (44,918; 176; 45,094) (8.244; 6.176; 14.42) (6,298; 5,912; 10,501) 14.44 Nightmare (37,844; 3,524; 40,894) (5.697; 7.371; 13.07) (8,830; 6,277; 12,905) 25.83

Table 3: General statistics of DWMs, part 1. Some DWMs are presented here, the others are available in Table 4. The terms “sent” and “received” always refer to transactions made by users. The trading volume indicates millions of dollars. The amount of dollars sent and received by users through U2U transactions is equivalent to the total.

max width= Name Interactions with DWM U2U interactions Users (sent; received; total) Trading volume in millions (sent; received; total) Users (sent; received; total) Trading volume in millions (total) Nucleus (205,043; 53,571; 247,884) (56.59; 61.68; 118.3) (62,577; 52,829; 93,279) 156.9 Pandora (35,667; 8,723; 41,718) (8.401; 8.561; 16.96) (11,119; 8,964; 15,944) 26.37 Russian Anonymous (740,625; 36,161; 769,228) (80.24; 95.94; 176.2) (363,773; 331,811; 493,766) 1866 San-Wells (51,795; 2,858; 54,633) (6.335; 5.755; 12.09) (8,227; 7,841; 13,679) 15.36 Sheep (38,068; 7,634; 42,673) (10.81; 11.47; 22.29) (12,007; 10,288; 182,90) 49.87 Silk Road (382,534; 72,344; 429,284) (130.2; 149.7; 279.9) (163,376; 157,113; 243,441) 671.4 Silk Road 2 (222,666; 47,528; 254,830) (66.83; 71.92; 138.7) (73,116; 66,019; 111,387) 259.8 Silk Road 3.1 (59,894; 15,413; 70,078) (9.054; 13.49; 22.54) (22,160; 18,570; 32,491) 21.80 TradeRoute (103,517; 14,080; 112,634) (16.97; 17.04; 34.01) (27,901; 22,287; 41,869) 67.72 Unicc (2,004,236; 559; 2,004,789) (147.8; 84.61; 232.4) (473,969; 490,794; 780,282) 1,673 Valhalla (82,507; 8,218; 89,214) (8.933; 9.811; 18.74) (25,755; 32,687; 45,297) 51.49 Wall Street (334,871; 25,352; 347,842) (48.15; 53.16; 101.3) (148,262; 127,370; 203,176) 163.5 xDedic (27,956; 885; 28,736) (3.552; 3.838; 7.389) (4,785; 4,767; 7,685) 12.70

Table 4: General statistics of DWMs, part 2. Some DWMs are presented here, the others are available in Table 3. The terms “sent” and “received” always refer to transactions made by users. The trading volume indicates millions of dollars. The amount of dollars sent and received by users through U2U transactions is equivalent to the total.
Figure 7: Lifetime of DWMs in our dataset. Time interval between the first and last transaction of each DWM. A total of 17 DWMs participated in at least one transactions in either 2020 or 2021, while 23 closed before 2020.
Figure 8: Key distributions of the full network.Probability distribution function (pdf) about the number of transactions of each pair of entities (a)-(d)-(g), their trading volume (b)-(g)-(h), and their lifetime computed as time difference between their last and first transaction (c)-(f)-(i).

4 Detection of stable pairs in temporal and directed networks

Here, we summarize the metholodogy of detecting the backbone of stable pairs in temporal and undirected networks as introduced in [31], and show how it can be easily adapted to tackle the analysis of directed temporal networks. The methodology follow three sequential steps: (i) determine the interval partition, (ii) estimate models’ parameters, over successive intervals, and (iii) run a statistical filter, which removes all pairs explained by the null hypothesis and retain stable pairs. The analysed temporal network, either directed or undirected, of nodes evolves in an observation window composed of time steps, labeled as . At each time step , entities interact among themselves and form a time-varying network of interactions, described by a binary adjacency matrix that varies in time .

4.1 Temporal and undirected networks

Interval partition.

The overall observation window is divided in successive and disjoint intervals using an auxiliary method, namely, the Bayesian Block method [72]. It takes as input the total number of temporal pairs created in the entire network at time

(1)

where the superscript “ts” indicates that these variables are estimated from the time series and is the th entry of the estimated adjacency matrix at time . The Bayesian Block method returns the interval partition, which divides the overall time window into disjoint intervals indexed by , that contain a uniform total number of connections. From the knowledge of the interval partition, the length, , of the generic th interval is obtained with the following closure relation: .

Parameter estimation.

According to the null hypothesis, pair of entities and are expected to interact proportional to the their individual activities at time

. That is, the probability that entities

and interact at time is a binomial random variable defined as

(2)

where and are piece-wise constant activities, which represent the propensity of creating interactions at time . The estimation of piece-wise constant activities is carried out analysing each of the intervals separately. The activity of entity at time is computed through the following frequency count:

(3)

where and are the total number of pairs generated by entity in the th and the total number of temporal pairs generated in the network in the th interval, respectively. These variables are computed from the adjacency matrix , as, , and . Once the activities are estimated according with Eq. (3), the probability in Eq. (2) can be calculated.

Statistical filter.

The statistical filter compares expected number of connections between entity and entity , , with observations from the time series, . The expected number of connections between entities and in the overall time window is determined by the sum of the binomial random variables given in Eq. (2)

(4)

where we have used the estimation of activity in Eq. (3) and summed over all intervals. Although the sum of non-identical binomial random variables in Eq. (4

) is a Poisson binomial distribution, the Poisson distribution is an appropriate approximation for long time series. The probability that the observed weight,

, could be explained by the relative expected weight, in Eq. (4), is computed according to the cumulative function of the Poisson distribution

(5)

where indicates the Poisson distribution with random variable and expected value . Equation (5) represents the p-value : when the p-value is below a pre-defined threshold, the pair is significant and included in the backbone network. The same statistical test is repeated for all pairs of entities observed at least once in the overall temporal evolution.

4.2 Temporal and directed networks

With little modifications, the above methodology can be used to filter temporal and directed networks.

Interval partition.

The interval partition is obtained by using the Bayesian Block method as above. The total number of temporal pairs created in the entire network at time is

(6)

where not pairs are directed, while in Eq. (1) undirected, thereby explaining the different ranges in the summations.

Parameter estimation.

In directed networks, the probability that entity contacts at random entity at time is defined as

(7)

where is the activity of entity at time and the attractiveness of entity at time . The activity was already defined in Eq. (2), while the attractiveness represent the propensity of receiving connections at time . If (for all entities in the network and at all time), Eq. (7) becomes equivalent to Eq. (2). However, care should be placed in their interpretation, whereby Eq. (7) generates a directed pair from entity to entity , while Eq. (2) can only lead to an undirected pair.

In the generic th interval, defining the time window , piece-wise constant activities and attractivenesses are estimated directly from the time series, similarly to what done in the undirected case in Eq. (3)

(8)

where , , and , are the total incoming strength of entity in the th interval, outgoing strength of entity in the th interval, and the total number of directed, temporal pairs generated in the network in the th interval, respectively. These variables are computed from the adjacency matrix , that is, , , and . Once the activity and attractiveness are estimated according with Eq. (8), the probability in Eq. (7) can be evaluated.

Statistical filter.

Similar to Eq. (4), the expected number of pairs from entity to entity is computed by summing the probability in Eq. (7) for all time instants

(9)

The probability that the observed weight, , is explained by the expected weight, in Eq. (9), is computed according to the cumulative function of the Poisson distribution

(10)

Equation (10) represents the p-value , which is used to assess whether the directed pair is significant. The same statistical test has to be repeated for directed pairs observed at least once in the overall temporal evolution. For undirected networks, Eq. (10) is equivalent to Eq. (5).

5 Additional simulations

Figure 9: Statistics of U2U pairs. (a) Number of stable and non-stable U2U pairs with a given number of transactions. (b) Number of stable and non-stable U2U pairs with a given trading volume. Vertical lines represent median values of the respective distributions.
Figure 10: Evaluation of the time users spent on a DWM. It extends Figure 3(inset) in the main text by considering each individual DWM. Statistical tests are carried using the two-sided Kolmogorov-Smirnov test and results are available in Table 5. Vertical lines represent median values of the respective distributions.
Figure 11: Evaluation of the total trading volume users exchange with a DWM. It extends Figure 3 in the main text by considering each individual DWM. Statistical tests are carried using the two-sided Kolmogorov-Smirnov test and results are available in Table 5. Vertical lines represent median values of the respective distributions.

max width=0.98 Name Time spent on a DWM Trading volume exchanged with a DWM Users with stable U2U pairs vs Users with stable U2U pairs vs Users with no U2U pairs Users with any U2U pairs Users with no U2U pairs Users with any U2U pairs (KS; p-value) (KS; p-value) (KS; p-value) (KS; p-value) Abraxas (0.572; 0.0001) (0.450; 0.0001) (0.382; 0.0001) (0.304; 0.0001) Agora (0.625; 0.0001) (0.522; 0.0001) (0.381; 0.0001) (0.310; 0.0001) AlphaBay (0.583; 0.0001) (0.516; 0.0001) (0.355; 0.0001) (0.280; 0.0001) Apollon (0.566; 0.0001) (0.487; 0.0001) (0.386; 0.0001) (0.364; 0.0001) Basetools (0.510; 0.0001) (0.481; 0.0001) (0.390; 0.0001) (0.386; 0.0001) Benumb (0.527; 0.0001) (0.478; 0.0001) (0.292; 0.0001) (0.263; 0.0001) BitBazaar (0.488; 0.0001) (0.462; 0.0001) (0.373; 0.0001) (0.402; 0.0001) Black Bank (0.459; 0.0001) (0.321; 0.0001) (0.287; 0.0001) (0.283; 0.0001) Blue Sky (0.577; 0.0001) (0.488; 0.0001) (0.334; 0.0001) (0.353; 0.0001) Buybest (0.539; 0.0001) (0.516; 0.0001) (0.334; 0.0001) (0.341; 0.0001) Bypass (0.590; 0.0001) (0.565; 0.0001) (0.433; 0.0001) (0.407; 0.0001) DarkMarket (0.649; 0.0001) (0.614; 0.0001) (0.442; 0.0001) (0.464; 0.0001) Dream (0.498; 0.0001) (0.416; 0.0001) (0.451; 0.0001) (0.442; 0.0001) Empire (0.502; 0.0001) (0.447; 0.0001) (0.396; 0.0001) (0.379; 0.0001) Evolution (0.600; 0.0001) (0.485; 0.0001) (0.343; 0.0001) (0.252; 0.0001) FEshop (0.644; 0.0001) (0.621; 0.0001) (0.446; 0.0001) (0.441; 0.0001) Flugsvamp 2.0 (0.575; 0.0001) (0.515; 0.0001) (0.444; 0.0001) (0.393; 0.0001) Flugsvamp 3.0 (0.617; 0.0001) (0.583; 0.0001) (0.508; 0.0001) (0.487; 0.0001) FuLLzShOp (0.515; 0.0001) (0.497; 0.0001) (0.207; 0.0001) (0.270; 0.0001) Hansa (0.583; 0.0001) (0.527; 0.0001) (0.348; 0.0001) (0.366; 0.0001) Hydra (0.541; 0.0001) (0.530; 0.0001) (0.306; 0.0001) (0.335; 0.0001) Joker’s Stash (0.654; 0.0001) (0.613; 0.0001) (0.399; 0.0001) (0.360; 0.0001) LuxSocks.ru (0.684; 0.0001) (0.599; 0.0001) (0.369; 0.0001) (0.417; 0.0001) Matanga (0.546; 0.0001) (0.538; 0.0001) (0.329; 0.0001) (0.464; 0.0001) Middle Earth (0.515; 0.0001) (0.368; 0.0001) (0.342; 0.0001) (0.252; 0.0001) MrGreen.ws (0.543; 0.0001) (0.514; 0.0001) (0.287; 0.0001) (0.259; 0.0001) Nightmare (0.424; 0.0001) (0.350; 0.0001) (0.405; 0.0001) (0.375; 0.0001) Nucleus (0.601; 0.0001) (0.477; 0.0001) (0.403; 0.0001) (0.332; 0.0001) Pandora (0.577; 0.0001) (0.391; 0.0001) (0.334; 0.0001) (0.268; 0.0001) Russian Anonymous (0.688; 0.0001) (0.674; 0.0001) (0.532; 0.0001) (0.530; 0.0001) San-Wells (0.567; 0.0001) (0.512; 0.0001) (0.310; 0.0001) (0.273; 0.0001) Sheep (0.528; 0.0001) (0.384; 0.0001) (0.356; 0.0001) (0.316; 0.0001) Silk Road 2 (0.586; 0.0001) (0.462; 0.0001) (0.395; 0.0001) (0.317; 0.0001) Silk Road 3.1 (0.566; 0.0001) (0.509; 0.0001) (0.413; 0.0001) (0.412; 0.0001) Silk Road (0.598; 0.0001) (0.570; 0.0001) (0.345; 0.0001) (0.331; 0.0001) TradeRoute (0.516; 0.0001) (0.453; 0.0001) (0.377; 0.0001) (0.390; 0.0001) Unicc (0.714; 0.0001) (0.678; 0.0001) (0.536; 0.0001) (0.521; 0.0001) Valhalla (0.473; 0.0001) (0.420; 0.0001) (0.409; 0.0001) (0.478; 0.0001) Wall Street (0.569; 0.0001) (0.550; 0.0001) (0.380; 0.0001) (0.418; 0.0001) xDedic (0.556; 0.0001) (0.457; 0.0001) (0.205; 0.0001) (0.107; 0.0001)

Table 5: Statistical tests. The two-sided Kolmogorov-Smirnov test is used to perform the statistical test. All p-values are less than 0.0001, which is indicated with 0.0001.
Figure 12: DWMs where users meet. Scatter plot of the number of pairs of users that meet inside each of the 40 DWMs considered versus the total volume sent to the DWM.
Figure 13: Temporal evolution of stable pairs. (a) Monthly number of new stable U2U pairs created. (b) Monthly trading volume of stable U2U pairs.
Figure 14: Trading volume stable U2U pairs during COVID-19. 28-days moving average of trading volume between users who met inside a DWM (a) and outside any DWMs (b). (c) Yearly growth relative to the same day of 2019. Vertical lines represent the dates of Wuhan (Jan 23, 2020) and Italy (March 3, 2020) lockdowns.
Figure 15: Formation of new stable U2U pairs during COVID-19. 28-days moving average of new stable U2U pairs started between U2U pairs who met inside a DWM (a) and outside any DWMs (b). (c) Yearly growth relative to the same day of 2019. Vertical lines represent the dates of Wuhan and Italy lockdowns.