Author

Tim Alper

Author

Tim Alper

About Author

Tim Alper is a British journalist and features writer who has worked at Cryptonews.com since 2018. He has written for media outlets such as the BBC, the Guardian, and Chosun Ilbo. He has also worked…

Share

Last updated: 

June 1, 2025

Russian investigators confiscated crypto worth around 649 million rubles ($8.2 million) from the wallets of Dmitry Pavlov, the 35-year-old self-confessed server mastermind behind the Hydra darknet portal.

The Russian newspaper Izvestia reported that documents unveiled in court this month confirmed law enforcement officers have frozen and seized coins from Pavlov’s crypto wallets.

Hydra Darknet Server Operator ‘Was Paid in Crypto’

Pavlov testified that he received the cryptoassets in the form of “a salary and bonuses” in return for maintaining Hydra servers.

A criminal ring paid Pavlov “about 15 million rubles ($189,277) a year” in crypto for his services, prosecution officials explained.

The accused said that he did not sell his coins for cash. Instead, he held on to the crypto, hoping that its price would continue to grow.

Hydra operators also paid Pavlov cash to cover maintenance costs, prosecution officials added. A branch of the Moscow District Court jailed 16 people for orchestrating Hydra in December last year.

The operation’s mastermind Stanislav Moiseev was jailed for life after the court heard that the portal facilitated over $5 billion in crypto transactions.

Prosecutors said that Russian experts agreed with Chainalysis estimates about the size of the firm’s crypto turnover.

‘Couriers Brought Pavlov Bags of Cash’

Moiseev and others handed Pavlov money to rent and maintain servers at the German company Hetzner, prosecutors explained.

These costs alone amounted to 1.5-2 million rubles ($18,928-$25,239) per month. Hydra managers “periodically” sent Pavlov couriers with bagfuls of cash, prosecutors added.

Hydra’s annual turnover at the time of closure was $1.7 billion, a Rosfinmonitoring employee testified at Pavlov’s trial. The staffer estimated that the platform took cuts of 2% to 5% from crypto transactions made on Hydra.

Rosfinmonitoring (officially the Russian Federal Financial Monitoring Service) is the nation’s top anti-money laundering agency.

Another expert testified that that the “net profit of Hydra’s co-founders alone,” taking into account-related services, amounted to “about 100 billion rubles ($1.3 billion) a year.”

Last month, Chainalysis reported that while there was a 15% decline in global crypto sales across darknet markets in 2024, Russian sites bucked the trend. The latter saw a 68% rise in crypto sales, the firm said.

Blockchain analytics firm Chainalysis has reported a 15% decline in global cryptocurrency sales across darknet markets in 2024, according to a data-driven blog post on May 16. Altogether, these markets brought in just over $2 billion in Bitcoin, while fraud shops dealing in stolen or counterfeit goods saw around $225 million in inflows.

However, this overall slowdown wasn’t universal. Russia’s darknet market defied the trend, recording a 68% surge in crypto sales, which indicates a sharp regional divergence in illicit crypto activity.

Why is “Kraken” (Darknet Market) Dominating Russia’s Underground Economy?

The global darknet markets continue to evolve, and Russia is at the center of a surprising shift. In 2024, most countries saw crypto sales on darknet markets fall, but not Russia.

Chainalysis revealed that the top Russia-based darknet markets remained dominant, but one stood out.

The “Kraken” darknet market (unrelated to the legitimate Kraken crypto exchange) surpassed Mega to become the highest-earning darknet market of the year.

While Mega’s revenue fell by over 50% year over year, the Kraken darknet market saw a dramatic 68% rise.

By the end of 2024, the Kraken darknet market had generated $737 million in on-chain crypto sales. Meanwhile, Blacksprut, which initially gained traction alongside Mega, saw its revenue drop by 13.6%.

Crypto sales are only part of the story. Russia’s darknet markets are steadily evolving as vendors grow savvier and more coordinated, increasingly outsourcing key functions—hosting, payments, and logistics—to turnkey providers like iKlad.biz and Klad.cc.

When Hydra Market collapsed in 2022, its network didn’t disappear. Former affiliates simply regrouped, tapping into the same shadowy ecosystem now driving Kraken’s expansion.

Authorities are also pushing hard against this underground resurgence. For example, in December 2024, a Russian court sentenced Stanislav Moiseyev, Hydra’s founder, to life in prison. Fifteen of his associates received sentences ranging from 8 to 23 years.

In the U.S., federal authorities arrested Taiwanese national Rui-Siang Lin in May 2024. Lin allegedly ran Incognito Market, a darknet market that disappeared after an exit scam in March. Investigators linked Lin to crypto transfers made to an exchange account in his name. His charges include a wide range of cyber and financial crimes.

But criminals are adapting. Bitcoin, once the currency of choice, now poses a risk due to its traceability.

Many darknet market operators are switching to Monero, a privacy coin that hides transaction details. Monero’s activity, however, lies beyond the scope of the Chainalysis report.

DeFi Creates New Illicit Loophole for Darknet Market Vendors

The report also observed a changing trend. Over the past few years, darknet market vendors used centralized exchanges (CEXs) to convert crypto to cash, but this changed in 2024.

Vendors increasingly moved funds to decentralized finance (DeFi) platforms instead.

Vendors sent more of their earnings to DeFi platforms and personal wallets than ever before. While CEXs still play a major role in the crypto sales cycle, DeFi is now a rising alternative.

The appeal is simple. DeFi offers extra privacy and lighter oversight, letting users bypass KYC checks and other red tape, which makes it a convenient way for criminals to cash out quietly.

Retail vendors are storing more crypto on-chain, while wholesale vendors are leaning heavily on DeFi. This results in a more fragmented and harder-to-trace web of darknet market transactions.

Frequently Asked Questions (FAQs)

The post Russia’s ‘Kraken’ Darknet Market Crypto Sales Soar 68% as Global Trade Falls appeared first on Cryptonews.

Blockchain security firm TRM Labs reported that Russian-language darknet marketplaces dominated crypto-linked drug transactions in 2024.

According to the report, the platforms were behind more than 97% of the drug-related crypto activity on the Bitcoin and TRON networks. That translates to around $1.65 billion out of the $1.7 billion traced to drug trade on both blockchains last year.

[Editor’s Note: The total value of the global illegal drug trade is estimated to be over $600 billion, making the crypto portion a small fraction of the total criminal activity.]

Why Russian darknets are thriving

TRM Labs explained that several factors contributed to the continued dominance of Russian darknet marketplaces. These include a diminished threat of enforcement action, the relatively low cost of importing chemical precursors from China, and the growing demand for synthetic narcotics.

Moreover, of the nearly 20 active marketplaces identified, only four ceased operations during the year, with Solaris being the most notable shutdown.

Interestingly, operators in this space have adopted a surprising code of conduct. Rather than carrying out exit scams, common in Western illicit markets, Russian darknet administrators often allow users to withdraw funds before shutting down operations.

This practice has helped maintain a level of trust within their communities, unlike their Western counterparts, which have been marred by takedowns and fraudulent closures that have shattered user confidence.

Vendors shift to encrypted channels

While Russian marketplaces thrived, the broader illicit drug trade underwent a significant transformation in 2024.

Vendors increasingly moved away from centralized darknet markets in favor of encrypted messaging platforms such as Telegram, Signal, and secure email channels.

This shift, initially more common in Western regions, is now accelerating across Russian-speaking networks.

TRM Labs explained that this migration reflects an effort to reach less tech-savvy buyers, reduce vendor fees, and avoid disruptions caused by market closures or law enforcement actions.

To maintain reach and operational stability, many vendors now operate across multiple channels, including clearnet websites and social media.

As a result, TRM Labs reported increased crypto use linked to these decentralized vendor shops. In 2023, such addresses received $289 million. That figure more than doubled in 2024, soaring past $600 million.