The Top 7 Dark Web Marketplaces in 2025

Based on our observations from analysis on dark web data using Lunar, we’ve identified the top 7 marketplaces on the dark web in 2025. We developed Lunar to monitor the deep and dark web, including dark web marketplace sites.

Just like Amazon on the open web, the dark web has marketplaces, but the goods sold are very different. Cybercriminals gather on dark web stores to buy and sell illegal goods and stolen data. Understanding what happens in these marketplaces is an important part of dark web monitoring. Regularly monitoring the top dark web markets gives your SOC team an insider’s view of the latest malware and phishing kit trends, plus real-time knowledge related to relevant compromised PII. 

What types of marketplaces can you find on the dark web?

Dark web marketplaces generally fall into two categories:

• Classic marketplaces: These platforms facilitate the sale of tangible illegal products, including drugs, weapons, and fraudulent financial instruments like gift and prepaid cards.
• Data stores: These marketplaces specialize in stolen sensitive data and tools for cybercrime, offering items such as:
  • Stolen credit card and bank account details.
  • Hacking tutorials and platform-breaching methods.
  • Access to compromised brand services, networks, and accounts.

To expand their reach, some marketplaces established parallel channels on Telegram. This further complicates monitoring efforts because now you need to search for the related Telegram channels and track activity there and on the marketplace itself.  

How can you determine where a marketplace is located?

While most dark web marketplace administrators prioritize anonymity, obscuring their origins, a few exceptions exist:

• WeTheNorth: This marketplace identifies as a Canadian platform, emerging Canadian HQ closed.
• Cocorico: A French-language marketplace serving European customers.
• Cypher: A Russian marketplace.

Our team searched the dark web and put together a list of the most active dark web marketplaces in order to assist you in monitoring illegal trade of products, cybercrime activity, and dark web trends in the dark web space.

Note: The language used on a marketplace does not necessarily indicate the origin of its administrators.

Key Considerations:

Understanding these marketplaces enables one to:

• Monitor emerging trends and identify potential threats.
• Identify compromised credentials and data.
• Gain insight to dark web activities.

Top 7 Dark Web Marketplaces

Let’s take a look at the leading dark web marketplaces today.

1. Abacus Market

Beginning in September 2021, Abacus Market has established itself as one of the leading dark web marketplaces. After AlphaBay closed, Abacus Market took its place as the world’s largest underground darknet marketplaces. Abacus Market quickly rose to prominence by attracting former AlphaBay users and providing a comprehensive platform for a wide range of illicit activities.

Main language: English

Topics and products sold

Abacus Market offers an extensive array of illegal goods and services across various categories, making it one of the most versatile marketplaces on the dark web. The primary categories include:

•   Drugs and chemicals: The largest section of the marketplace, featuring thousands of listings for recreational drugs, prescription medications, and chemical precursors (ingredients used to create something more dangerous).
•   Counterfeit items: The market offers a range of fake documents, including passports, driver’s licenses, and other forms of identification.
•   Digital products: Criminals can find many electronic goods, including e-books, software keys, and digital accounts.
•   Financial fraud: The market offers stolen credit card information (CVVs, dumps), bank account details, and PII.
•   Guides and tutorials: The market provides detailed instructions on how to commit various types of cybercrime, including hacking, phishing, and financial fraud.
•   Services: Criminals often offer illicit services through Abacus Market, which includes hacking-for-hire and money laundering.
•   Software and Malware: Criminals can find various hacking tools on the marketplace, such as malicious software and exploit kits.

Unique features

Abacus Market distinguishes itself with several unique features that enhance its appeal and functionality for users:

•   Extensive product selection: With over 40K products listed, Abacus Market offers one of the largest selections of illegal goods and services on the dark web.
•   Community support: The marketplace hosts a forum where users can discuss various topics, share tips, and provide support to each other.
•   Advanced search function: Abacus Market features a sophisticated search tool that allows users to quickly find specific products or services.
•   Security measures: The marketplace employs two-factor authentication (2FA) and extensive phishing warnings to ensure user safety and anonymity.
•   Payment methods: Abacus Market accepts multiple cryptocurrencies, including Bitcoin and Monero, providing flexibility and anonymity for transactions.

Market value and popularity

Valued at approximately $15 million, Abacus Market is one of the most lucrative platforms in the dark web ecosystem. In 2024, the platform grew significantly in popularity, partly because of its strategic acquisition of users from a number of recently shut-down marketplaces, such as AlphaBay and Incognito Market, which had recently closed their doors.

2. STYX Market

Launched in early 2023, STYX Market is relatively new. It is a hub for financial cybercrime and offers a wide range of illicit services and stolen data that cater to sophisticated cybercriminals.

Main language: English

Topics and products sold

STYX Market’s primary categories for products and services include:

• BINs (Bank Identification Numbers): Collections of credit and debit card numbers for use in fraudulent transactions.
• RDP/VDS/VPS access: Remote Desktop Protocol access, Virtual Dedicated Servers (VDS), and Virtual Private Servers (VPS) that have been compromised or configured for illegal activities.
• Verified crypto accounts: Accounts for cryptocurrency exchanges that have been verified, making money laundering and fraud easier.
• Bank accounts: Stolen bank login credentials and account information.
• Credit cards: Collections of stolen credit card data, including CVVs, dumps, and full card information (Fullz).
• Data from stealer logs: Information harvested from infostealer malware, including the following details:
  • Usernames
  • Passwords
  • Session cookies.

• Email accounts: Access to compromised email accounts, often used for further phishing or fraud attempts.
• Stolen documents: Fake or stolen identification documents (passports and driver’s licenses).

Unique features

STYX Market focuses specifically on financial fraud, making it a go-to destination for cybercriminals engaged in this activity.

• Integration with telegram: The marketplace operates alongside a Telegram channel, which facilitates direct communication between buyers and sellers. This integration allows for real-time updates, support, and transactions, enhancing user experience and operational efficiency.
• High-value transactions: STYX Market often involves substantial transaction amounts, reflecting the high-value nature of the financial data and services it offers.
• User verification: To maintain trust and security, STYX Market requires users to undergo a verification process, ensuring that only serious and legitimate buyers and sellers can participate.
• Payment methods: The marketplace accepts various cryptocurrencies, including Bitcoin and Monero, providing users with secure and anonymous transaction options.

Market value and popularity

STYX Market is a key player in the dark web ecosystem. Its focus on financial fraud and high-value transactions has attracted a dedicated user base, contributing to its growing reputation and market value.

3. Brian’s Club

Also known as BrianCC, Brian’s Club opened in 2014. It is one of the most notorious credit card shops on the dark web. It has built a reputation for being a reliable source of stolen credit card data and PII. Renowned for its extensive inventory of financial data and sophisticated operating methods, Brian’s Club is a key player in the underground economy of financial cybercrime.

Main language: English

Topics and products sold

Brian’s Club’s primary product and service categories include:

• Dumps: Raw magnetic stripe data from credit cards, which can be used to create cloned cards for in-person transactions.
• CVVs: Card verification values (crucial for conducting fraudulent online transactions).
• Fullz: Comprehensive sets of personal information linked to credit card accounts, including:
  • Card numbers, 
  • CVVs, 
  • Expiration dates, 
  • Account holder names
  • Account holder addresses
• Wholesale accounts: Bulk sales of full account details, catering to buyers looking for large quantities of data.
• Auction listings: Auctions where users can bid on high-value or unique data sets, allowing for competitive pricing and access to premium data.

Unique features

Brian’s Club has several distinctive features that set it apart from other dark web marketplaces:

• Auctions: The auction feature allows users to reserve, bid, and outbid others for unique and valuable BINs. Serious buyers looking for exclusive data are attracted by the competition aspect.
• Internal search tools: Advanced search capabilities that enable users to filter and find specific breached assets such as Social Security Numbers (SSNs), CVVs, credit card numbers, and billing addresses.
• Cryptocurrency payments: The marketplace accepts multiple cryptocurrencies, including Bitcoin, Litecoin, and Cryptocheck, to ensure anonymous and secure transactions.
• Reputation for reliability: Brian’s Club has a reputation for consistently providing high-quality and valid data over the years. This reliability has earned it a loyal customer base.
• Regular updates: The platform frequently updates its inventory, adding new batches of stolen data to keep up with demand and maintain its relevance in the market.

Market value and popularity

Due to its extensive inventory and reputation for reliability, Brian’s Club has maintained a significant presence on the dark web. Quality and validity of the data it provides justify its higher cost over other marketplaces. The platform’s popularity continues to grow, attracting both new and returning customers.

4. Russian Market

Established in 2019, Russian Market is a well-known and highly regarded data store on the dark web, specializing in the sale of PII and various forms of stolen data. Despite its name, the marketplace operates primarily in English and serves a global audience. It has gained a reputation for being a reliable source of high-quality data for cybercriminals.

Main language: English

Topics and products sold

Russian Market’s primary categories include:

• CVVs: Card verification values used for online transactions and conducting fraudulent purchases.
• Dumps: Magnetic stripe data from credit cards, which can be used to create cloned cards for physical transactions.
• RDP access: Remote Desktop Protocol access credentials, allowing attackers to remotely control compromised systems.
• Stealer logs: Collections of stolen digital fingerprints harvested from infected devices. Collections can include cookies, login details, and IP addresses.
• PII data: Comprehensive personal information, including names, addresses, and social security numbers.
• Tools and utilities: Various built-in tools such as BIN checkers, PayPal cookie converters, and generators for Track1 data and Netscape-to-JSON cookies.

Unique features

Russian Market’s reputation is one of the main reasons why it is so popular. Here are a few other reasons: 

•   Affordable prices: The marketplace is known for its competitive pricing, with products ranging from a few dollars to a few hundred dollars, making it accessible to a wide range of buyers.
•   Built-in tools: Russian Market offers several useful tools for cybercriminals, including BIN checkers, PayPal cookie converters, and various data conversion scripts. These tools enhance the usability and value of the data sold on the platform.
•   Wide range of data: The marketplace provides a diverse array of stolen data, catering to cybercriminals’ different needs and preferences.
•   Reputation for reliability: Over the years, Russian Market has built a reputation for offering valid and high-quality data, attracting a steady stream of customers.

Market value and popularity

Russian Market has consistently remained one of the most popular and valuable data stores on the dark web. Its affordability and reliability have earned it a loyal customer base. The platform’s activity has increased significantly over the past year, indicating its growing influence and market share in the underground economy.

5. Torzone

Established in 2022, Torzon market is one of the biggest and most diverse marketplaces on the dark web. It is considered very secure thanks to strict user validations and transparent payment and vendor review procedures.

Main language: English

Topics and products sold

Torzon is a highly diverse marketplace offering a wide range of products:

• Drugs: the site offers various drug types with safe payment and worldwide shipping.
• Digital Products: Criminals can find many electronic goods, including e-books, software keys, and digital accounts.
• Financial fraud: The market offers many items for financial fraud, including stolen credit card information (CVVs, dumps), bank account details, and PII.
• Guides and tutorials: The market provides detailed instructions on how to commit various types of cybercrime, including hacking, phishing, and financial fraud.
• Counterfeit items: The market offers a range of fake documents, including passports, driver’s licenses, and other forms of identification.
• Professional services: hacking and fraud services are offered by cybercriminals, offering their skills for hire. 
• Weapons: though a smaller section, firearms can also be found on this site.

Unique features

Torzon is one of the most notable dark web stores for a number of reasons.

• Extensive product selection: with over 100K listings in the past year and a wide variety of products, criminals are sure to find their needs in this site.
• Highly protected and private: from mirror rotating on an hourly basis, to several CAPTCHA tests before the buyer even gets the opportunity to open a new user, an option which is not always available, Torzon is definitely one of the more secure and hard to enter marketplaces. It also implements PGP encryption and several different ways of user authentication.
• Vendor rating system: the site features a useful vendor ranking system, allowing buyers to make smarter buys from trusted vendors.
• Payment methods: the site accepts multiple cryptocurrencies, including Bitcoin and Monero, allowing for secure and flexible payment.

Market value and popularity

Torzon Market has established itself as a significant player in the darknet ecosystem, offering a secure, user-centric platform for anonymous trading. Its commitment to privacy, diverse product offerings, and robust security measures make it a preferred choice for users seeking discreet transactions within the darknet.

6. WizardShop

Established in 2022, WizardShop is one of the biggest data stores on the dark web, focusing mainly on carding and financial data.

Main language: English

Topics and products sold

• CVVs: Digital credentials for credit cards from across the world that can be used for online purchases, as well as dumps and bin numbers.
• Accounts: Bank accounts, shops and Paypal accounts,
• Documents: IDs, permits, passports, SSNs, and more.
• RDP:  Remote Desktop Protocol access that can be used for illegal access. 

Unique features

Among the dark web stores, WizardShop stands out for a few reasons.

• Product offering: WizardShop offers a wide range of financial and personal stolen information, from CVVs and BINs to documents and SSNs. 
• Accessible user interface: the site is easy to navigate and purchases are simple and quick. 
• Community updates: the site features a unique news section where admins update buyers about new leaks, data dumps, site updates, and other relevant information.
• Product checkers: the site has a dedicated section to check the quality of the bought products, ensuring customer satisfaction. 

Market value and popularity

WizardShop has solidified its status as one of the best data stores in the dark web by providing an impressive quantity of quality data as well as providing a trustworthy, easy to use interface allowing criminals easy and secure buying and selling.

7. Freshtools

Freshtools was established in 2019 and offers various stolen credentials, accounts, and host protocols like RDP. It is considered a go-to site for malware purchasing, providing keyloggers, trojans, and other Malware as a Service products.

Main language: English

Topics and products sold

• Leaked PIIs: phone numbers, email addresses and passwords, logins, accounts and more leaked PIIs.
• cPanels: compromised web hostings of control panels allowing control of victim websites.
• Malwares: up to date mailers, keyloggers, spammers, and scripts
• Tutorials: training, methodology, and papers for hacking tutorials.

Unique Features

Freshtools has some characteristics that help it stand out from the other dark web stores. 

• Vast variety of products: Freshtools sells both the stolen credentials and accounts and the malware leading to them, allowing any cyber criminal to focus on the specific need or expand his skills. 
• Open web access: Freshtools is accessible through the open web and still allows secure access, making it simpler for inexperienced users to access the site.
• Payment Methods: the site accepts various currencies, including Bitcoin, USTC, and PerfectMoney.
• Buyer requests: buyers can open a ticket including any request, question or problem they wish to fix or improve.

Market value and popularity

Freshtools is a unique marketplace in that it does not only provide the stolen data, but it allows criminals to purchase MaaS which can cause further damage to the victims. It is one of the most active and up to date markets and always provides new and updated malware and data.