The dark web, accessible primarily through anonymizing tools like Tor, hosts a hidden economy estimated at $20–25 billion annually in cryptocurrency transactions, with about 57–60% of sites facilitating cybercrime.
While it enables legitimate privacy needs, it predominantly supports illicit trade. Based on 2025 analyses, here are the most prevalent illegal activities, ranked by estimated market share and impact:
1. Drug Trafficking and Sales
Darknet marketplaces like Archetyp (shut down in 2025) dominate, offering narcotics such as fentanyl, cocaine, heroin, and MDMA via anonymous shipping. Drugs account for roughly 50% of all dark web transactions, generating an estimated $1.7 billion in 2022 (with a 15% year-over-year increase). In 2025, fentanyl remains a focal point due to its role in the opioid crisis.
2. Identity Theft and Stolen Credentials
Criminals trade stolen personal data, including Social Security numbers (SSNs), full identity profiles (“fullz”), and login credentials, enabling account takeovers and fraud. This tops the list, comprising over 65% of monitored illicit activities, with 15 billion credentials exposed by 2022 (an 82% rise from prior years). Nearly 80% of compromised email accounts end up listed here, priced from $1–$6 for an SSN to $200–$1,000+ for bank logins.
3. Credit Card Fraud and Financial Data Sales
Dumped credit card details with CVVs fuel unauthorized purchases, representing about 15% of dark web listings. Over 192 million cards were listed in recent years, with averages carrying $8,700 limits and selling for $10–$40 each. This ties into broader fraud, contributing to $12.5 billion in U.S. internet crime losses in 2023 (up 22%).
4. Ransomware and Cybercrime-as-a-Service
Gangs offer ransomware kits, malware, exploit tools, DDoS attacks, and phishing services for hire. Ransomware claims surged 55.5% in 2023 (5,070 victims), with median demands at $190,000 and a 25% overall rise in activity. Tools like infostealer malware rent for $1,024/month, and DDoS services cost $45 for 24 hours.
5. Counterfeit Goods, Weapons, and Forged Documents
Fake IDs, passports, luxury goods, and firearms are sold, alongside niche services like hitmen (though rarer). These make up smaller shares but persist, with weapons and counterfeits noted in about 10–15% of marketplaces. Pricing for fake passports starts around $1,000.
Other activities, like child exploitation materials and human trafficking, occur but are less quantified due to their severity and underreporting.
How Authorities Fight These Activities
Law enforcement agencies worldwide, including the FBI, ICE’s Homeland Security Investigations (HSI), and international partners, treat the dark web as a high-priority target. Despite its anonymity, they’ve dismantled major sites and arrested thousands through coordinated, tech-driven efforts. Key strategies include:
• Undercover and Sting Operations: Agents pose as buyers or sellers in controlled buys, mirroring street-level tactics, to gather evidence and disrupt networks. HSI’s Operation Dime Store used undercover purchases and fingerprint analysis on seized packages to trace drug shipments via the U.S. Postal Service.
• Marketplace Takedowns and Seizures: Global ops exploit site vulnerabilities to seize servers and redirect traffic for intel. In May 2025, Operation RapTor arrested 270 suspects, seized $200 million in crypto/cash, and confiscated 2 tons of drugs (including 144 kg of fentanyl). June’s Operation Deep Sentinel shut down Archetyp Market, worth $250–290 million. Historic wins include Silk Road (2013: operator sentenced to life), AlphaBay (2017: international raid), and Hydra (2022: $5.2 billion in transactions seized).
• Technological Tools and Tracing: Network Investigative Technique (NIT) warrants deploy code to unmask Tor users. Blockchain analysis tracks crypto flows (98% of dark web payments), while platforms like DarkOwl enable keyword searches across millions of records for real-time alerts on credentials or threats. These aid in fraud, trafficking, and missing persons cases.
• International and Cross-Agency Collaboration: Joint task forces like J-CODE (since 2018) have led to hundreds of arrests. Operations involve 6–9 agencies, including DOJ, DHS, and foreign police, sharing intel to counter rapid site relaunches.
• Legislative and Preventive Measures: No dark web-specific laws exist, but proposals like the 2025 Dark Web Interdiction Act seek harsher penalties for drug trafficking, bolster J-CODE, and mandate reports on crypto’s role in opioids. Agencies urge monitoring tools, strong passwords, and breach reporting to preempt crimes.
Challenges persist—new markets emerge quickly, and anonymity tools evolve—but enforcement has reduced visible activity by 20–30% in key areas since 2020. Success relies on blending human intel with AI-driven surveillance.