key: cord-0471992-ykuoudg6
authors: ElBahrawy, Abeer; Alessandretti, Laura; Rusnac, Leonid; Goldsmith, Daniel; Teytelboym, Alexander; Baronchelli, Andrea
title: Collective Dynamics of Dark Web Marketplaces
date: 2019-11-21
journal: nan
DOI: nan
sha: f34d41e14758d83452e50adfb26172fd7307d9c1
doc_id: 471992
cord_uid: ykuoudg6

Dark markets are commercial websites that use Bitcoin to sell or broker transactions involving drugs, weapons, and other illicit goods. Being illegal, they do not offer any user protection, and several police raids and scams have caused large losses to both customers and vendors over the past years. However, this uncertainty has not prevented a steady growth of the dark market phenomenon and a proliferation of new markets. The origin of this resilience have remained unclear so far, also due to the difficulty of identifying relevant Bitcoin transaction data. Here, we investigate how the dark market ecosystem re-organises following the disappearance of a market, due to factors including raids and scams. To do so, we analyse 24 episodes of unexpected market closure through a novel datasets of 133 million Bitcoin transactions involving 31 dark markets and their users, totalling 4 billion USD. We show that coordinated user migration from the closed market to coexisting markets guarantees overall systemic resilience beyond the intrinsic fragility of individual markets. The migration is swift, efficient and common to all market closures. We find that migrants are on average more active users in comparison to non-migrants and move preferentially towards the coexisting market with the highest trading volume. Our findings shed light on the resilience of the dark market ecosystem and we anticipate that they may inform future research on the self-organisation of emerging online markets.

Dark markets are commercial websites specialised in trading illicit goods. They are accessible via darknets (e.g., Tor) and vary in specialization, technology, and primary supported language. Silk Road, the first modern dark market launched in 2011, limited its sales to drugs while other dark markets allow the trading of weapons, fake IDs and stolen credit cards [1, 2] . Most markets facilitate trading between buyers and vendors of illicit goods, but some of them involve a single vendor only. Regardless of these differences, Bitcoin is the universally accepted currency, occasionally together with other cryptocurrencies. was seised by the Italian police who estimated their annual transaction with 2 million euros [2] .

The growth and resilience of the dark markets have attracted the attention of the scientific community.

The above mentioned difficulty to identify relevant transactions [8, [10] [11] [12] has forced researchers to rely mostly on data scraped from dark markets websites [11, 13] (but dark markets administrators actively fight web scraping, seen as a threat), or users surveys [14, 15] . Police shutdowns were shown to correlate with a sudden increase in drug listings in co-existing markets [16, 17] , while the most comprehensive study on closures covered 12 markets concluding 'that the effect of law enforcement takedowns is mixed as best' [11] and a recent analysis of a large 2014 police operation identified an impact of closures on the drugs' supply and demand but not the prices [13] . Recent research on how to attribute Bitcoin anonymised addresses to named entities [18] [19] [20] has not been applied yet to investigate the dynamics of dark markets, and only in few cases identifying dark-market related transactions has been the focus of research [21] .

Here, we investigate the dynamics of 24 market closures by looking at 31 markets in the period between June 2011 to July 2019. We do so by investigating a novel dataset of Bitcoin transactions involving dark markets assembled on the basis of the most recent identification methods [22] [23] [24] . For the first time, we quantify the overall activity of the major dark markets, in terms of number of users and total volume traded. We reveal that the closure of a dark market, due to a police raid or an exit scam, affects only temporarily the market ecosystem activity, suggesting that dark markets are resilient.

We provide the first systematic investigation of dark market users migration following an unexpected closure, and show that closures affects mostly low-active users, with highly-active users migrating quickly to a new market. Finally, we show that migrant users tend to coordinate, with 66% of them choosing the same new market, which is in most cases the one with largest volume.

Dark markets operate typically as an eBay for illicit goods where vendors advertise their products and consumers request the shipment through the website. Transactions flow from buyers to the dark market that then sends the money to sellers after buyers confirmation of receiving the goods. Consumers may leave reviews that contribute to vendors' reputation [7] . After multiple scam closures, nowadays dark markets rely often on escrow systems. The dark market does not keep buyers' bitcoins in local addresses but instead sends it to an escrow service. After the buyer's confirmation, the escrow service transfer the money to the seller.

Our analysis relies on a novel dataset of dark market transactions on the Bitcoin blockchain. The ledger of Bitcoin transactions (the blockchain) is publicly available and can be retrieved through Bitcoin core [25] or a third-party API such as Blockchain.com [26] . It consists of the entire list of transaction records, including time, transferred amount, origin and destination addresses. Addresses are identifiers of 26 − 35 alphanumeric characters that can be generated at no cost by any user of Bitcoin, such that a single Bitcoin wallet can be associated to multiple addresses. In fact, to ensure privacy and security, most Bitcoin software and websites help users generate a new address for each transaction. Thus, blockchain data has to be pre-processed to map groups of addresses to individual users.

We used data pre-processed by Chainalysis following the approach detailed in [22] [23] [24] . The preprocessing relies on state-of-the-art heuristics [18] [19] [20] [21] 27] , including co-spending clustering, intelligencebased clustering, behavioural clustering and entity identification through direct interaction [23] . These techniques rely on the observation of patterns in the Bitcoin protocol transactions and users behaviour.

Chainalysis Identification of addresses related to illicit activities has been relied upon in many law enforcement investigations [28, 29] . Due to this critical use of data, rigorous investigation and avoidance of false positives is crucial. If an address can not be identified or clustered with certainty the address will be tagged unnamed. This means that some addresses might belong to a dark market but are not labelled as one (see more information on our dataset in Appendix 1.1, Figure 9 ).

We considered the entire transaction data of 31 dark markets (see Appendix 1.1) between June 18th, 2011 and July 24th, 2019. This dataset includes the major markets on the darknet as identified by law enforcement agencies reports [3, 30] and the World Health Organization [31] . We also considered the transactions of the users who interacted with one of these markets (dark market's nearest neighbours)

after their first interaction with a dark market. Thus, each market ecosystem can be represented as an egocentric network [32] of radius 2, where the market is the central node, its nearest neighbours represent market users, and direct edges represent transaction occurring either between the market and one of its neighbours, or between two neighbours. Figure 1 shows a schematic representation of our dataset, where transactions within the square are the ones included in the dataset. After removing transactions to/from cryptocurrency exchanges, the dataset contains ∼ 133 million transactions among over 38 million users.

The total number of addresses which directly interacted with dark markets is ∼ 8.3 million. The volume of transactions sent and received by dark markets addresses amount to ∼ 4.2 billion dollars. Figure 1 : Dark market ego-network. Our dataset includes transaction between addresses belonging to a dark market (in red) and its nearest neighbours (in black), as well as the transactions between nearest neighbours and "other" Bitcoin addresses (in grey). Any transaction between two "other" nodes is excluded from our dataset. In this schematic representation, the dotted square includes transactions present in our dataset.

In order to gain information on the analysed markets, we collected additional data from the Gwern archive on dark markets closures [1] . We also relied on law enforcement documents on closures, and online forums [30,31,33] dedicated to discussing dark markets to compile comprehensive information (see Appendix 1.1). Out of the selected markets, 12 performed exit scam, 9 were raided, 3 were voluntarily closed by their administrators, and 7 are still active. Our dataset includes 2 markets in Russian language, and the others are in English. Out of the 31 markets, 3 are markets dedicated to fake and stolen IDs and credit cards. The primary currency on these market is Bitcoin. In Figure 2 , we present the lifetime of the selected markets and the reason behind their closure. 

After removing transactions to/from cryptocurrency exchanges, the dataset contains 133, 308, 118 transactions among 38, 886, 758 users. The total number of users which directly interacted with dark market is 8, 377, 478. The volume of transactions sent and received by dark markets addresses amount to 4.210 billion dollars, while the one received by dark markets address is 1.99 USD billion. Table 2 reports characteristics of the 31 markets considered, including overall number of users and transaction volume.

The most active market in terms of number of users and traded volume is by far AlphaBay, followed by Hydra.

The capacity of the dark market ecosystem to recover following the closure of a market can be studied quantifying the evolution of the total volume traded by dark markets in time. Despite recurrent closures, we find that the number of markets has been relatively stable from 2014 (see Figure 3A ). In addition, despite closures, the total weekly volume sent/received by dark market addresses has grown from 2014 until the end of 2019 (see Figure 3B ). In fact, Moving Average Convergence Divergence (MACD) analysis [34] reveals that, following each dark market closure, the overall dark markets volume drops, but it recovers quickly after, typically within 9.5 days, see Appendix 1.1. Starting from the end of 2018, however, we observe a decrease in the total volume traded. It is important to note that, here, we considered the total volume (in American dollars) sent/received across the entire dark market egocentric network (See 

The observation that dark markets are resilient to closure suggests that users may move to other markets [13, 35] . We refer to this phenomenon as migration. In fact, migration was observed [36] after the closure of the AlphaBay market when other markets, namely Hansa Market and Dream market, experienced an abnormal spike in activity. In this section, we provide the first systematic investigation of dark market users migration, by studying the effects of multiple closures. We identify migrant users in the following way. For each market that was shut down, we identify users who started trading with another coexisting market following the closure. Thus, users who were already trading on multiple markets before closure are not considered migrants. Figure 4 shows the flows of migrant users between markets. The overall picture reveals a common behaviour across all closures since after each closure there is a flow of migrants to other coexisting markets. An important question is which fraction of users involved in illicit trading continue to exchange with dark markets following a closure. The answer needs to consider that a large number of users interact only once across their life time. For example, a study based on data up to 2013 found that most of the minted Bitcoins were accumulated in addresses which never sent [19] . In our dataset ∼ 38% of the users interacted only once. To identify users who stop trading with dark markets due to a market closure, we compute the fraction of "returning users" over time, meaning the fraction of all users active in a given

week that are active also in the following week. After computing the fraction of returning users over time, we normalise it by the fraction of returning users at the time of closure (so that the normalised value of returning at that day is 1). Then, we consider the median across market closures. We find that, 5 days after the closure of a dark market, only 85% of the expected number of returning users interacts to another market. This result indicates that the closure does have an effect, albeit the vast majority of users seems to behave as normal (from the point of view of the following interaction).

The observation that some users stop trading following a dark market closure but the total volume traded in dark markets does not decrease could indicate that migrant users are on average more active than others.

We test this hypothesis by computing the activity of migrant users before and after closure. We refer to the first dark market a user was interacting with as its home market. For all users (migrant and non-migrant), we measure the total volume exchanged with any other user in our dataset including the home market. We find that the median volume exchanged by migrant users is ∼ 10times larger than the volume exchanged by non-migrant users (see Figure 5A ), with the median volume exchanged summing to 3882.9 USD for migrant users and to 387. Figure 5B ).

The activity distribution of migrants is significantly different from the non-migrant users' distribution (using Kolmogorov-Smirnov test, p < 0.01, see Table 3 in Appendix 1.1). 

In our dataset, in all cases but one, users could choose between at least two surviving markets when their home market closed. A natural question is therefore how migrant users decide where to migrate.

In Figure 6 , we show the evolution of the trading volume shares of the shut down market and the top two destination markets in the periods preceding and following a closure. We find that the top two destination markets experience an increase in share starting 2 days after the closure, and saturating after about 6 days to around 27%. We investigate the characteristics of the first destination market for migrant users, by ranking coexisting markets according to the total trading volume in USD at the time of closure and the total number of common users between the shut down and the coexisting market before closure. We find that, regardless of the reason behind closure, users do not migrate randomly and chose to move to the market with the highest trading volume which, in some cases, is also the market with the highest number of common users.

Focusing on the first week after closure, we find that, on average, one market absorbs 66.1% ± 16.1 of all migrant users. Only 4% of the users migrate to more than one coexisting market simultaneously after the closure. What is this market? Figure 6A shows that, in 36.4% of the closures considered, it is the one sharing the larger number of common users with the closed market, while the chances that users select the second and the third rank is 31.8%. Users do not choose to migrate to markets with rank lower than the third. Figure 6B shows that, when markets are ranked according to the volume of their transactions, the second-largest is preferred in the majority of cases (31.8%). However, a closer look at the data reveals that the Russian market occupies often the top ranks in terms of volume but it tends not to be the preferred migration harbour, probably due language and geographical barriers. Excluding the Russian market from the ranking, in fact, we find that the largest market is selected 41% of the times (see Figure  6C ).

We compare the users' decisions with a null random model, where at each closure users move with equal probability to any of the existent markets. The random probability P of rank i to be chosen for migration after m closures is equal to

where c j is the number of coexisting markets at the time of closure j. We find that the results of the random procedure are significantly different from actual data, confirm the existence of a strong coordination between users (see Figure 6 )

Considering a novel dataset of Bitcoin transactions for 31 large dark markets and their users, we investigated how the darknet market ecosystem is affected by the unexpected closure of a market in the period between 2013 and 2019. The markets under study differed in speciality, language, and date of creation, and 24 of them were closed abruptly due to reasons including police raids and scams. We found that the total volume traded on dark markets drops only temporarily following a dark market closure, revealing that the ecosystem exhibits a remarkable resilience. We identified the origin of this resilience, by focusing on individual users, and unveiled a swift and ubiquitous phenomenon of migration between recently closed markets and other coexisting ones. We found that migrants are more active in terms of total transaction volume compared to users who do not migrate, that they tend to privilege the same unique market as destination and that this is generally the biggest market in terms of the total 

All data needed to evaluate the conclusions in the paper are present in the paper. Additional data related to this paper may be requested from the authors. [40] Chainalysis, inc. https://www.chainalysis.com/, 2019. Accessed: 10 July 2019.

1 Appendix

In Bitcoin, multiple addresses can belong to one user; grouping these addresses reduces the complexity of the ledger and Bitcoin anonymity [19] . Clustering techniques rely on how Bitcoin's protocol works, users behaviour on the blockchain, Bitcoin's transaction graph structure and finally, machine learning.

Methods relying on Bitcoin's protocol specifically exploit what is known as change addresses: Bitcoins available in an address have to be spent as a whole. Figure 7 shows an example of a change address. User A's wallet has two addresses, one contains 1BTC and another has 2BTC. User A would like to transfer 0.25BTC to user B, as shown in Figure 7A . After transferring the 0.25BTC to B, the change (0.75BTC)

will not stay in the same address. Bitcoin protocol will create another address, also assigned to A, where the 0.75BTC change will be stored. By observing this pattern, a heuristic technique proposed in [27] suggests that these addresses can be grouped, as they belong to one user. Since users can have multiple addresses, they can use multiple of these addresses to transfer Bitcoins in a single transaction. For example, Figure 8A shows a case where user A controls 3 different addresses.

Each address has a different amount of Bitcoins, 1, 4 and 2.5 respectively. User A wants to transfer 5

Bitcoins to user B, and two addresses will be used to complete the transaction as shown in Figure 8B .

This observation allows the grouping of these two addresses as a single user [27] . ; however, the addresses were already grouped using the heuristics introduced by [27] . Machine learning was also shown to identify addresses which should be grouped as one with 77% accuracy.

Mapping addresses to an actual identity is more challenging. Some entities already publish their public key for donation and payment, such as Wikimedia Foundation [39] . The only research that introduced a method for mapping a collection of addresses to a real-world identity is [21] , through direct interaction with the address. In this work, researchers directly engaged in 344 transactions with different services including mining pools, exchanges, dark markets and gambling websites.

The introduction of these heuristics did not only challenge Bitcoin's anonymity but also eased the regulation of Bitcoin. Companies specialising in blockchain analytics started to capitalise on these heuristics and provide tools for exchanges and law enforcement entities to facilitate regulatory efforts.

For our analysis of dark markets, our data was provided by Chainalysis [40] , which is a blockchain analytics company. Chainalysis aided several investigations led by different law enforcement entities, including the United States Internal Revenue Service (IRS) [29] .

Our dataset sampling approach (from the entire Bitcoin transactions) deploys a complex network perspective. Transactions on the blockchain can be modelled as a directed weighted graph where a node represents a user, and a directed edge between two nodes A and B represents a transaction from user A to user B. Depending on the clustering algorithm, a node can represent one address or multiple addresses.

A node can also be labelled as a specific entity or unlabelled (unnamed). Figure 9 shows a sketch of the network and the different possible meanings of a node. For example in Figure 9 , the black unnamed node on the right side is a representation of two different addresses clustered together, however, they

were not attributed to an entity thus remained unnamed. Figure 9 : A dark market's Bitcoin transaction network. A schematic representation of our dataset as a complex network. Nodes represent users, and a direct edge between two nodes represents a transaction in the direction of the edge. Nodes can represent different abstractions as shown by the dotted rhombus. Starting from the right side, the unnamed black node represents a cluster of two different addresses which, however, was not attributed to a specific entity. The dark market node(in dark red, Silk Road Market), is a representation of 3 addresses and attributed by the algorithm to the market. The black named node on the left side of Silk Road Market node is a representation of 4 addresses and named to belong to a specific entity. Finally, the black unnamed node at the bottom left side of the figure, represents one address.

In this section we provide data on each market understudy. Table 1 shows general information on the dark markets included in our dataset. However, an upward change can be observed after the closures indicating that dark markets recover. 

In the main text we show that for each closed market, migrant users are more active in terms of the total amount they send and received overall, specifically with the closed dark market. In this section, we show the distribution of the migrants and non-migrants activity across all dark markets. Figure 11 shows that activity for migrants overall is higher than the non-migrants. Figure 11 : Migrant vs. non-migrants activity distribution The distribution of the total volume sent and received across all closed dark markets for migrants (orange line) and non migrants (blue line). 

Gwern. gwern.net/dnm-survival

Italian police shut down darkweb berlusconi market and arrested admins

United states of america : Vs. ross william ulbricht

I2p data communication system

Bitcoin multisig wallet: the future of bitcoin

The dark net: Self-regulation dynamics of illegal online markets for identities and related services

Traveling the silk road: A measurement analysis of a large anonymous online marketplace

Not an'ebay for drugs': the cryptomarket'silk road'as a paradigm shifting criminal innovation. Available at SSRN 2436643

Measuring the longitudinal evolution of the online anonymous marketplace ecosystem

Evaluating drug trafficking on the tor network: Silk road 2, the sequel

Do police crackdowns disrupt drug cryptomarkets? a longitudinal analysis of the effects of operation onymous

Use of silk r oad, the online drug marketplace, in the united kingdom, a ustralia and the united states

silk road', the virtual drug marketplace: A single case study of user experiences

The closure of the s ilk r oad: what has this meant for online drug trading?

The rise and challenge of dark net drug markets

The evolution of the bitcoin economy: extracting and analyzing the network of payment relationships

Quantitative analysis of the full bitcoin transaction graph

The unreasonable effectiveness of address clustering

Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress

A fistful of bitcoins: characterizing payments among men with no names

Tracking ransomware end-to-end

Breaking bad: De-anonymising entity types on the bitcoin blockchain using supervised machine learning

Analyzing hack subnetworks in the bitcoin transaction graph

Evaluating user privacy in bitcoin

How a bitcoin trail led to a massive dark web child-porn site takedown

Cracking the code: How the us government tracks bitcoin transactions

Hydra Marketplace 426

Middle Earth Marketplace 9

Sheep Marketplace 15

Silk Road 2 Market 85

Silk Road 3.1 13

Silk Road Marketplace 172

Table 2: Dark markets overall activity. The activity of the dark markets as observed in our dataset. For each market, the table reports the total volume sent and received by dark market addresses. It also reports the total number of users who sent (in-degree) and received (out-degree) Bitcoins to/from dark market addresses

 Table 1 : Dark markets information. Information on the 31 selected dark markets included in our dataset. For each market, the table states the name of the market, the start and end dates of its operation, the closure reason (if applicable) and the type of products sold by the market. "Drugs" indicates that the primary products sold on the market are drugs while "credits" indicates the market specializes in fake IDs and credit cards and "mixed" indicates the market sells both types of products