Collective dynamics of dark web marketplaces

Dark web marketplaces are websites that facilitate trade in illicit goods, mainly using Bitcoin. Since dark web marketplaces are unregulated, they do not offer any user protection, so police raids and scams regularly cause large losses to marketplace participants. However, the uncertainty has not prevented the proliferation of dark web marketplaces. Here, we investigate how the dark web marketplace ecosystem reorganises itself following marketplace closures. We analyse 24 separate episodes of unexpected marketplace closure by inspecting 133 million Bitcoin transactions among 38 million users. We focus on “migrating users” who move their trading activity to a different marketplace after a closure. We find that most migrating users continue their trading activity on a single coexisting marketplace, typically the one with the highest trading volume. User migration is swift and trading volumes of migrating users recover quickly. Thus, although individual marketplaces might appear fragile, coordinated user migration guarantees overall systemic resilience.


Introduction
Dark markets are commercial websites specialised in trading illicit goods.They are accessible via darknets (e.g., Tor) and vary in specialization, technology, and primary supported language.Silk Road, the first modern dark market launched in 2011, limited its sales to drugs while other dark markets allow the trading of weapons, fake IDs and stolen credit cards [1,2].Most markets facilitate trading between buyers and vendors of illicit goods, but some of them involve a single vendor only.Regardless of these differences, Bitcoin is the universally accepted currency, occasionally together with other cryptocurrencies.
Operating outside of law, dark markets do not offer any protection to customers or vendors.This has led to the proliferation of scam sales and market hacks.Furthermore, markets may suddenly disappear, causing significant losses to users.For example, Silk Road was shut down in 2013 by the FBI [3] and in the same year Sheep Marketplace market was closed by its own administrator, who vanished with 100 million US dollars subtracted to its users [4].Following these events, markets tried to prevent closure by deploying technologies such as I2P [5], multisig [6] and rely more often on escrow services [7].I2P is an anonymous network layer designed to overcome censorship and multisig enables users to authorise a transaction through multi signatures.Tumblers (also known as mixers) are services which obscure the trail back to Bitcoin payments.Escrow services guarantee that markets do not hold users money, instead a trusted third party holds the money until users confirm they have received the shipment.Despite the introduction of these measures, market closures continued to occur, both to police seizures and scams.
However, this uncertainty has not prevented a steady growth of both users and revenue of dark markets.As of today, there are at least 38 active dark markets [8].The difficulty to identify relevant transactions from the Bitcoin blockchain has made it hard to quantify market volume [8,[10][11][12] but the European authorities estimated dark markets drug sales from 2011 to 2015 to be 44 million dollars per year.A later study estimated that, in early 2016, dark markets drug sales were between 170 million and 300 million dollars per year.[9].Recently, the market Berlusconi known mostly for selling stolen IDs was seised by the Italian police who estimated their annual transaction with 2 million euros [2].
The growth and resilience of the dark markets have attracted the attention of the scientific community.
The above mentioned difficulty to identify relevant transactions [8,[10][11][12] has forced researchers to rely mostly on data scraped from dark markets websites [11,13] (but dark markets administrators actively fight web scraping, seen as a threat), or users surveys [14,15].Police shutdowns were shown to correlate with a sudden increase in drug listings in co-existing markets [16,17], while the most comprehensive study on closures covered 12 markets concluding 'that the effect of law enforcement takedowns is mixed as best' [11] and a recent analysis of a large 2014 police operation identified an impact of closures on the drugs' supply and demand but not the prices [13].Recent research on how to attribute Bitcoin anonymised addresses to named entities [18][19][20] has not been applied yet to investigate the dynamics of dark markets, and only in few cases identifying dark-market related transactions has been the focus of research [21].
Here, we investigate the dynamics of 24 market closures by looking at 31 markets in the period between June 2011 to July 2019.We do so by investigating a novel dataset of Bitcoin transactions involving dark markets assembled on the basis of the most recent identification methods [22][23][24].For the first time, we quantify the overall activity of the major dark markets, in terms of number of users and total volume traded.We reveal that the closure of a dark market, due to a police raid or an exit scam, affects only temporarily the market ecosystem activity, suggesting that dark markets are resilient.
We provide the first systematic investigation of dark market users migration following an unexpected closure, and show that closures affects mostly low-active users, with highly-active users migrating quickly to a new market.Finally, we show that migrant users tend to coordinate, with 66% of them choosing the same new market, which is in most cases the one with largest volume.

Methods
Dark markets operate typically as an eBay for illicit goods where vendors advertise their products and consumers request the shipment through the website.Transactions flow from buyers to the dark market that then sends the money to sellers after buyers confirmation of receiving the goods.Consumers may leave reviews that contribute to vendors' reputation [7].After multiple scam closures, nowadays dark markets rely often on escrow systems.The dark market does not keep buyers' bitcoins in local addresses but instead sends it to an escrow service.After the buyer's confirmation, the escrow service transfer the money to the seller.
Our analysis relies on a novel dataset of dark market transactions on the Bitcoin blockchain.The ledger of Bitcoin transactions (the blockchain) is publicly available and can be retrieved through Bitcoin core [25] or a third-party API such as Blockchain.com[26].It consists of the entire list of transaction records, including time, transferred amount, origin and destination addresses.Addresses are identifiers of 26 − 35 alphanumeric characters that can be generated at no cost by any user of Bitcoin, such that a single Bitcoin wallet can be associated to multiple addresses.In fact, to ensure privacy and security, most Bitcoin software and websites help users generate a new address for each transaction.Thus, blockchain data has to be pre-processed to map groups of addresses to individual users.
Chainalysis Identification of addresses related to illicit activities has been relied upon in many law enforcement investigations [28,29].Due to this critical use of data, rigorous investigation and avoidance of false positives is crucial.If an address can not be identified or clustered with certainty the address will be tagged unnamed.This means that some addresses might belong to a dark market but are not labelled as one (see more information on our dataset in Appendix 1.1, Figure 9).
We considered the entire transaction data of 31 dark markets (see Appendix 1.1) between June 18th, 2011 and July 24th, 2019.This dataset includes the major markets on the darknet as identified by law enforcement agencies reports [3,30] and the World Health Organization [31].We also considered the transactions of the users who interacted with one of these markets (dark market's nearest neighbours) after their first interaction with a dark market.Thus, each market ecosystem can be represented as an egocentric network [32] of radius 2, where the market is the central node, its nearest neighbours represent market users, and direct edges represent transaction occurring either between the market and one of its neighbours, or between two neighbours.Figure 1 shows a schematic representation of our dataset, where transactions within the square are the ones included in the dataset.After removing transactions to/from cryptocurrency exchanges, the dataset contains ∼ 133 million transactions among over 38 million users.
The total number of addresses which directly interacted with dark markets is ∼ 8.3 million.The volume of transactions sent and received by dark markets addresses amount to ∼ 4.2 billion dollars.
Figure 1: Dark market ego-network.Our dataset includes transaction between addresses belonging to a dark market (in red) and its nearest neighbours (in black), as well as the transactions between nearest neighbours and "other" Bitcoin addresses (in grey).Any transaction between two "other" nodes is excluded from our dataset.In this schematic representation, the dotted square includes transactions present in our dataset.
In order to gain information on the analysed markets, we collected additional data from the Gwern archive on dark markets closures [1].We also relied on law enforcement documents on closures, and online forums [30,31,33] dedicated to discussing dark markets to compile comprehensive information (see Appendix 1.1).Out of the selected markets, 12 performed exit scam, 9 were raided, 3 were voluntarily closed by their administrators, and 7 are still active.Our dataset includes 2 markets in Russian language, and the others are in English.Out of the 31 markets, 3 are markets dedicated to fake and stolen IDs and credit cards.The primary currency on these market is Bitcoin.In Figure 2, we present the lifetime of the selected markets and the reason behind their closure.

Results
After removing transactions to/from cryptocurrency exchanges, the dataset contains 133, 308, 118 transactions among 38, 886, 758 users.The total number of users which directly interacted with dark market is 8, 377, 478.The volume of transactions sent and received by dark markets addresses amount to 4.210 billion dollars, while the one received by dark markets address is 1.99 USD billion.Table 2 reports characteristics of the 31 markets considered, including overall number of users and transaction volume.
The most active market in terms of number of users and traded volume is by far AlphaBay, followed by Hydra.

Market resilience
The capacity of the dark market ecosystem to recover following the closure of a market can be studied quantifying the evolution of the total volume traded by dark markets in time.Despite recurrent closures, we find that the number of markets has been relatively stable from 2014 (see Figure 3A).In addition, despite closures, the total weekly volume sent/received by dark market addresses has grown from 2014 until the end of 2019 (see Figure 3B).In fact, Moving Average Convergence Divergence (MACD) analysis [34] reveals that, following each dark market closure, the overall dark markets volume drops, but it recovers quickly after, typically within 9.5 days, see Appendix 1.1.Starting from the end of 2018, however, we observe a decrease in the total volume traded.It is important to note that, here, we considered the total volume (in American dollars) sent/received across the entire dark market egocentric network (See Figure 1).

User migration
The observation that dark markets are resilient to closure suggests that users may move to other markets [13,35].We refer to this phenomenon as migration.In fact, migration was observed [36] after the closure of the AlphaBay market when other markets, namely Hansa Market and Dream market, experienced an abnormal spike in activity.In this section, we provide the first systematic investigation of dark market users migration, by studying the effects of multiple closures.We identify migrant users in the following way.For each market that was shut down, we identify users who started trading with another coexisting market following the closure.Thus, users who were already trading on multiple markets before closure are not considered migrants.Figure 4 shows the flows of migrant users between markets.The overall picture reveals a common behaviour across all closures since after each closure there is a flow of migrants to other coexisting markets.An important question is which fraction of users involved in illicit trading continue to exchange with dark markets following a closure.The answer needs to consider that a large number of users interact only once across their life time.For example, a study based on data up to 2013 found that most of the minted Bitcoins were accumulated in addresses which never sent [19].In our dataset ∼ 38% of the users interacted only once.To identify users who stop trading with dark markets due to a market closure, we compute the fraction of "returning users" over time, meaning the fraction of all users active in a given week that are active also in the following week.After computing the fraction of returning users over time, we normalise it by the fraction of returning users at the time of closure (so that the normalised value of returning at that day is 1).Then, we consider the median across market closures.We find that, 5 days after the closure of a dark market, only 85% of the expected number of returning users interacts to another market.This result indicates that the closure does have an effect, albeit the vast majority of users seems to behave as normal (from the point of view of the following interaction).

Who is migrating?
The observation that some users stop trading following a dark market closure but the total volume traded in dark markets does not decrease could indicate that migrant users are on average more active than others.
We test this hypothesis by computing the activity of migrant users before and after closure.We refer to the first dark market a user was interacting with as its home market.For all users (migrant and non-migrant), we measure the total volume exchanged with any other user in our dataset including the home market.We find that the median volume exchanged by migrant users is ∼ 10times larger than the volume exchanged by non-migrant users (see Figure 5A), with the median volume exchanged summing to 3882.9 USD for migrant users and to 387.2 USD for non-migrant users.The mean on the other hand is 716441.9USD and 17529.7 USD for migrant and non-migrant users respectively (see Appendix 1.1 for the spending distribution of migrant and non-migrants).Similar conclusions can be drawn by considering the volume exchanged with the home market only, which has median value of 263 USD and for non-migrant users and 74.3 USD for migrant users and a mean value of 2725.1 USD and 475.9 USD for migrant and non-migrant users respectively (see Figure 5B).
The activity distribution of migrants is significantly different from the non-migrant users' distribution (using Kolmogorov-Smirnov test, p < 0.01, see Table 3 in Appendix 1.1).

Coordination in the dark
In our dataset, in all cases but one, users could choose between at least two surviving markets when their home market closed.A natural question is therefore how migrant users decide where to migrate.
In Figure 6, we show the evolution of the trading volume shares of the shut down market and the top two destination markets in the periods preceding and following a closure.We find that the top two destination markets experience an increase in share starting 2 days after the closure, and saturating after about 6 days to around 27%.We investigate the characteristics of the first destination market for migrant users, by ranking coexisting markets according to the total trading volume in USD at the time of closure and the total number of common users between the shut down and the coexisting market before closure.We find that, regardless of the reason behind closure, users do not migrate randomly and chose to move to the market with the highest trading volume which, in some cases, is also the market with the highest number of common users.
Focusing on the first week after closure, we find that, on average, one market absorbs 66.1% ± 16.1 of all migrant users.Only 4% of the users migrate to more than one coexisting market simultaneously after the closure.What is this market?Figure 6A shows that, in 36.4% of the closures considered, it is the one sharing the larger number of common users with the closed market, while the chances that users select the second and the third rank is 31.8%.Users do not choose to migrate to markets with rank lower than the third.
Figure 6B shows that, when markets are ranked according to the volume of their transactions, the second-largest is preferred in the majority of cases (31.8%).However, a closer look at the data reveals that the Russian market occupies often the top ranks in terms of volume but it tends not to be the preferred migration harbour, probably due language and geographical barriers.Excluding the Russian market from the ranking, in fact, we find that the largest market is selected 41% of the times (see Figure 6C).
We compare the users' decisions with a null random model, where at each closure users move with equal probability to any of the existent markets.The random probability P of rank i to be chosen for migration after m closures is equal to where c j is the number of coexisting markets at the time of closure j.We find that the results of the random procedure are significantly different from actual data, confirm the existence of a strong coordination between users (see Figure 6)

Conclusion
Considering a novel dataset of Bitcoin transactions for 31 large dark markets and their users, we investigated how the darknet market ecosystem is affected by the unexpected closure of a market in the period between 2013 and 2019.The markets under study differed in speciality, language, and date of creation, and 24 of them were closed abruptly due to reasons including police raids and scams.We found that the total volume traded on dark markets drops only temporarily following a dark market closure, revealing that the ecosystem exhibits a remarkable resilience.We identified the origin of this resilience, by focusing on individual users, and unveiled a swift and ubiquitous phenomenon of migration between recently closed markets and other coexisting ones.We found that migrants are more active in terms of total transaction volume compared to users who do not migrate, that they tend to privilege the same unique market as destination and that this is generally the biggest market in terms of the total trading volume.Our findings shed new light on the consequences of sudden closure and/or police raids on dark market, which had been previously raised in the literature and among law enforcement entities [9,13,30].Interesting future research directions include the role of market closure on the emergence of new markets, refining the analysis to investigate whether scam closures and police raids may have so-far neglected effects on user migration, and broaden the research to include the effect of online forums on the performance of existing markets as well as on the migration choices after a closure [33].Since users can have multiple addresses, they can use multiple of these addresses to transfer Bitcoins in a single transaction.For example, Figure 8A shows a case where user A controls 3 different addresses.
Each address has a different amount of Bitcoins, 1, 4 and 2.5 respectively.User A wants to transfer 5 Bitcoins to user B, and two addresses will be used to complete the transaction as shown in Figure 8B.
This observation allows the grouping of these two addresses as a single user [27].The work in [21] challenged these heuristics, showing the possibility of having false positives and not taking into consideration changes in the protocol.The work suggests instead a manual process, where the behaviour of each entity is investigated.Page rank (network centrality measure [37]) was also used to identify important addresses [38]; however, the addresses were already grouped using the heuristics introduced by [27].Machine learning was also shown to identify addresses which should be grouped as one with 77% accuracy.
Mapping addresses to an actual identity is more challenging.Some entities already publish their public key for donation and payment, such as Wikimedia Foundation [39].The only research that introduced a method for mapping a collection of addresses to a real-world identity is [21], through direct interaction with the address.In this work, researchers directly engaged in 344 transactions with different services including mining pools, exchanges, dark markets and gambling websites.
The introduction of these heuristics did not only challenge Bitcoin's anonymity but also eased the regulation of Bitcoin.Companies specialising in blockchain analytics started to capitalise on these heuristics and provide tools for exchanges and law enforcement entities to facilitate regulatory efforts.
For our analysis of dark markets, our data was provided by Chainalysis [40], which is a blockchain analytics company.Chainalysis aided several investigations led by different law enforcement entities, including the United States Internal Revenue Service (IRS) [29].
Our dataset sampling approach (from the entire Bitcoin transactions) deploys a complex network perspective.Transactions on the blockchain can be modelled as a directed weighted graph where a node represents a user, and a directed edge between two nodes A and B represents a transaction from user A to user B. Depending on the clustering algorithm, a node can represent one address or multiple addresses.
A node can also be labelled as a specific entity or unlabelled (unnamed).Figure 9 shows a sketch of the network and the different possible meanings of a node.For example in Figure 9, the black unnamed node on the right side is a representation of two different addresses clustered together, however, they were not attributed to an entity thus remained unnamed.Table 1: Dark markets information.Information on the 31 selected dark markets included in our dataset.For each market, the table states the name of the market, the start and end dates of its operation, the closure reason (if applicable) and the type of products sold by the market."Drugs" indicates that the primary products sold on the market are drugs while "credits" indicates the market specializes in fake IDs and credit cards and "mixed" indicates the market sells both types of products

Moving Average Convergence Divergence Analysis
To further quantify the changes in dark markets traded volume, we calculate the Moving Average Convergence Divergence (MACD) of the weekly trading volume.The MACD is an trading indicator used in stock markets to quantify price movements and fluctuations.It is composed of three time series.Firstly, the MACD, calculated as the difference between the exponential weighted moving average of the trading volume for a period of 12 weeks and the exponential weighted moving average of the trading volume for a period of 26 weeks.Secondly, the signal line, computed as the 9 weeks exponential weighted moving average of the MACD time series.Finally, the last time series, known as the histogram, representing the difference between the MACD and the signal line.However, an upward change can be observed after the closures indicating that dark markets recover.

Migrant and non migrants
In the main text we show that for each closed market, migrant users are more active in terms of the total amount they send and received overall, specifically with the closed dark market.In this section, we show the distribution of the migrants and non-migrants activity across all dark markets.Figure 11 shows that activity for migrants overall is higher than the non-migrants.

Figure 2 :
Figure 2: Dark markets lifetime.Each bar corresponds to a different dark market (see y-axis labels).Bars are coloured according to the reason behind closure: raided by the police (black), exit scam (dark blue), voluntary closure (blue).Light blue bars correspond to markets that are still active in November 2019.

Figure 3 :
Figure 3: Dark markets resilience.(A) The total number of active dark markets across time.(B) The total volume (in USD) exchanged by dark markets addresses.(C) The number of unique users interacting with dark markets.Dashed lines represent market closure due to law enforcement raid (in red), or any other reason (in black).Values are calculated using a time window of one week.

Figure 4 :
Figure 4: Migration of users following a dark market closure.Flows of users migrating to another coexisting market following a closure.The arrowhead points to the direction of migration, and the width of the arrow represent the number of users.Markets are ordered clockwise according to the closing date in ascending order starting from Silk Road Marketplace.

Figure 5 :
Figure 5: Migrants are more active than other users.(A) Total volume exchanged by migrant users (orange box-plots) and non-migrant users (blue box-plots) before the closure of their home market.(B) Volume exchanged by migrant users (orange box-plots) and non-migrant users (blue box-plots) with their home market.The horizontal line in each box represents the median.The lower box boundary shows the first quartile, and the upper one shows the third quartile.The whiskers show the minimum and maximum values within the 1.5 lower and upper interquartile range.

Figure 6 :
Figure 6: Migration decision and impact.(A) The median share (across closures) of a closed market (blue market), the top destination market for the migrant users (orange line) and the second top destination for migrant users (green line).The shaded area represents the 50% interquartile range.Value are computed using a rolling window of one week.Figures B-D show the probability of a market to be chosen for migration given its rank at the time of coexisting market closure in comparison to the random model.Markets are ranked in descending order according to (B) the number of overlapping users they have with the closed market excluding Russian markets (C) the total trading volume in USD and (D) the total trading volume in USD excluding Russian markets from the ranking.The random model in the figures B-D represent a model where users can move to any existent market with equal probability.

Figure 7 :
Figure 7: How Bitcoin's protocol handles transactions with change.(A) A transaction between users A and user B, where A wants to transfer 0.25 Bitcoins to B. User A has two addresses, one with 1 Bitcoin and the other with 2 Bitcoins.User B has one address, containing 1 Bitcoin.(B) How a transaction is conducted under Bitcoin protocol.User A first address transfers 0.25 Bitcoin to user B first address.The change of 0.75 Bitcoin does not stay in User A first address 1, but appears, instead, as another transaction to a new address.The dotted boundaries in both figures represent a grouping of these addresses, as they belong to one user.A solid arrow represents an executed Bitcoin transaction, while the dotted arrow represents a desired transaction.

Figure 8 :
Figure 8: Sending from multiple inputs in Bitcoin (A) A desired transaction between users A and B, where A wants to send 5 Bitcoins to user B. User A has 3 different addresses with 1, 4 and 2.5 Bitcoins respectively.User B has one address containing 1 Bitcoin.(B) How the transaction will be conducted under the Bitcoin protocol.User A will use two addresses to complete the transaction.Both addresses will send to one address belonging to user B. The dotted boundaries in both figures represent a grouping of these addresses as they belong to one user.The solid arrows represent an already executed Bitcoin transaction while the dotted arrow represents a desired transaction.

Figure 9 : 12 −
Figure 9: A dark market's Bitcoin transaction network.A schematic representation of our dataset as a complex network.Nodes represent users, and a direct edge between two nodes represents a transaction in the direction of the edge.Nodes can represent different abstractions as shown by the dotted rhombus.Starting from the right side, the unnamed black node represents a cluster of two different addresses which, however, was not attributed to a specific entity.The dark market node(in dark red, Silk Road Market), is a representation of 3 addresses and attributed by the algorithm to the market.The black named node on the left side of Silk Road Market node is a representation of 4 addresses and named to belong to a specific entity.Finally, the black unnamed node at the bottom left side of the figure, represents one address.

Figure 10
Figure 10 shows the indicator behaviour across time.For each closure, there is a fluctuation in the MACD line and the histogram line indicates a downward change in the overall dark markets volume.

Figure 10 :
Figure 10: Moving Average Convergence Divergence (MACD) (A) The MACD (blue line) and MACD signal line (orange line) for dark markets trading volume from 2013 till 2016.(B) The MACD histogram (blue line) for the dark markets trading volume from 2013 to the end of 2016.(C) The MACD (blue line) and MACD (orange line) signal line for dark markets trading volume from 2017 until July, 2019.(D) The MACD histogram (blue line) for the dark markets trading volume from 2017 until July, 2019.Vertical dashed lines represent markets closure.

Figure 11 :
Figure 11: Migrant vs. non-migrants activity distribution The distribution of the total volume sent and received across all closed dark markets for migrants (orange line) and non migrants (blue line).

Table 3
shows the results of a Kolmogorov smirnov test between the migrant and non migrant activity distribution.

Table 3 :
P values between the migrants and stayers The table shows the p value results from the Kolmogorov smirnov test between the migrant and non migrants users distributions.The table report the results for the transactions to/from dark markets and the results for all the transactions.