Bitcoin in the darknet: Darker than you think

During its early days, before Bitcoin became “fool’s gold” for get-rich-quick investors, it was used as the main currency on the darknet. Think of the darknet as the space under your bed, dirty, desolate; barely acknowledged, never cleaned. The only time you come in contact with it is when you push scraps of paper, clumps of dust, or the odd sock into it. The darknet is the ‘under the bed’ underbelly of society.

In all seriousness, the darknet is the ‘online black market’ as it facilitates the buying and selling of several illegal goods such as drugs, child pornography and stolen financial information. Back in 2011, Bitcoin was thrust into the limelight courtesy of one of the most popular online markets of the darknet – the Silk Road.

Created in February 2011, Silk Road was allegedly the product of a 27-year old computer hacker Ross Ulbricht. Silk Road catered to a whole range of criminal activity with the most popular being drug trade. Ulbricht, who allegedly operated under the name ‘Dread Pirate Roberts,’ facilitated the use of Bitcoin as payments. Acting as middleman between transactions, serving as an escrow and taking a certain percentage from every transaction. Less than three years after launch, Silk Road was raking commissions of over $10,000 a day, while Bitcoin was trading at $120 a pop.

In October 2013, Ulbricht was arrested by the Federal Bureau of Investigation [FBI] and was indicted for “narcotics conspiracy, money laundering, and solicitation of murder for hire,” eventually sentenced initially to life in prison with no possibility of parole, a sentence he is currently serving. Soon after his conviction, Silk Road was shut down.

Despite the controversies surrounding Ross Ulbricht and his alleged involvement in the darknet, the creation Silk Road was a watershed moment for Bitcoin. For some it was the dark manifestation of the only utility of non-state currency, for others it was proof that Bitcoin’s transparent nature ensured deceitful transactions wouldn’t go amiss. Nearly a decade since the Silk Road was created, Bitcoin’s tryst with the darknet continues.

Never go quietly

Since Silk Road shut down, Bitcoin has matured more than ever. Its claim to fame occurred in December 2017 when its price skyrocketed to almost $20,000, a price point it hasn’t even come close to. That’s when the world began paying attention to the cryptocurrency.

Derivatives contracts were issued, cryptocurrency-exchange CEOs were on the cover of Forbes magazines, Bitcoin was mentioned in TV Shows and late-night comedy, and even the President of the United States tweeted about it. From ‘magic internet money’ and ‘the currency of internet criminals’ to seeing billions in single-day trading volume on exchanges like the Chicago Mercantile Exchange [CME], the trajectory was unprecedented.

Even with mainstream success for Bitcoin in the financial and technological world, the underside of the bed remained uncleaned. Dark web transactions, in Bitcoin, was still prominent. According to a report by Bitfury’s Crystal Blockchain, the value of Bitcoin transferred between entities on the darknet marketplaces, as recently as Q1 2020, rose by a whopping 65 percent, compared to the previous quarter. To put that in perspective, during the time of the ‘bull-run’ when Bitcoin was all the craze, the value of Bitcoin sent and received by darknet entities was $354 million, in Q1 2020, it increased to $775 million.

Now, a slight caveat needs to be added here, Bitcoin in USD terms is seeing higher and higher transactions on the darknet, but the actual Bitcoins transferred are not. The line graph in the background of the chart above shows the actual Bitcoin transferred and what’s interesting is it has dropped. The report stated that both the total amount [in BTC, not in USD] received by darknet entities decreased from Q1 2019 to Q2 2020 by 26.5 percent, so to did the Bitcoin sent, by 21.8 percent.

This wasn’t the only change in Bitcoin’s darknet markets. In fact, the entire ecosystem went through a shuffle.

All because of you

Not only was there a difference, in the opposite direction mind you, between the amount of Bitcoin and its USD value transferred between entities, but there was a change in the role of exchanges as well, and not in the way you’d think.

In Q1 2017, exchanges without verification requirements shouldered 72 percent of all Bitcoin received from darknet markets, which was relatively unchanged till Q4 2018. In 2019, the amount of Bitcoin received by these exchanges began dropping, from 62 percent in Q1 to 49 percent by Q4. For Q1 2020, only 45 percent of exchanges without verification requirements received Bitcoins from darknet market players.

For the more robust exchanges, the flow went in the opposite direction. In Q1 2017, the exchanges with verification requirements saw 14 percent of Bitcoin transactions, and by Q1 2020, it stood at 29 percent. A similar movement away from exchanges without verification requirements to exchanges with verification requirements was seen in Bitcoin sent to darknet entities.

According to Bitfury’s Crystal Blockchain, the reason for this change was because of the Financial Action Task Force [FATF] norms,

“This is likely due to more new exchanges implementing verification procedures due to requirements from the FATF. Users prefer these exchanges to ones that don’t follow FATF requirements.”

This does not mean that darknet entities are switching from exchanges without verification to exchanges with verification, that would be an incorrect assumption. Rather, the report indicates that because and not despite the FATF’s guidelines, darknet players are “trying to hide their bitcoin flow inside of the darknet itself, avoiding the risk of having their activities unveiled by entities.” Instead of pulling their Bitcoin out of the market itself, through the liquidation facilities of exchanges, darknet market players are keeping them within the marketplace itself.

Enter at your own risk 

In the past three years alone, Bitcoin saw two prominent bull-runs, the first in Q4 2017 and the second in Q2 2019. During this volatile time, the cryptocurrency trading infrastructure has developed immensely. Several spot and futures exchanges combined have made Bitcoin a very risky and leveraged asset.

While the rest of the world thought of the crypto as an investment product, only the darknet market used it as a currency. But unlike the inflating supply of traditional fiat currency, the balance of Bitcoin in the darknet hasn’t changed much.  Speaking to AMBCrypto, Kim Grauer, head of research, and Carles Lopez-Penalver, senior cybercrime analyst at Chainalysis told that the number of cryptocurrencies held on darknet marketplaces has been “flat.” However, each marketplace manages its cryptocurrency differently, so “flat” is a more general statement, rather than a specific to a darknet market. 

There has also been a flat number of cryptocurrencies held on darknet marketplaces. It’s important to note that each darknet marketplace manages their cryptocurrency differently, so understanding this trend would require further interrogation. As the chart below shows, from 2016 to 2020 the range of Bitcoin balances on the darknet was 11,000 BTC to 16,000 BTC, consistently small given the price ranged between $400 to $19,500. 

In fact, it’s not just the Bitcoin balances in the darknet, it’s also the newly mined Bitcoin that has not changed over the years. Grauer and Lopez-Penalver said, even cryptocurrency from “mining entities to darknet marketplaces,” have remained “relatively flat.” It should be noted, there is a disparity between the amount of Bitcoin and the USD value of the same. Since mined Bitcoins have been present in the darknet for a few years [transferred before the 2017 bull-run] only its USD-value has increased, the number of Bitcoins has remained, as the Chainalysis executives put it, “relatively flat.”

The chart below shows an increase in USD value of Bitcoin and a decrease in the amount of BTC sent from miners to darknet markets. The former has increased from $500,000 in Q1 2017 to $1.5 million by Q2 2020, while the latter dropped from 1,500 BTC to 200 BTC within the same period.

Another mainstay entity and anomaly statistic in the darknet markets is the use of coin mixers. Over the past few years, with more and more oversight on Bitcoin-transactions, the use of coin-mixers has increased.

In Q1 2017, only 2 percent of all Bitcoin sent to darknet entities were from mixers, in Q1 2020, the figure jumped to 20 percent. This jump came about only in the last 6 months, till Q3 2019 the coin-mixer share remained at 2 percent. While there was an increase in Bitcoin sent from coin-mixers to darknet entities, the flow in the opposite direction lagged.

A reason for this increase in Bitcoin sent to darknet entities [and not received from darknet entities] over the years is that darknet market players are substituting exchanges without verification requirements for mixers. Opting for blurred traceability [to ease future liquidation on robust exchanges or via other means] over  Bitcoin sent directly to exchanges.

Coin mixers are not just third-party affiliates within the darknet ecosystem, or a service used sparsely but serve specific functions. In fact, some mixers ‘partner’ with darknet markets according to Grauer and Lopez-Penalver,

“Some darknet markets have implemented internal mixing services or partnered with mixers, which may provide customers and vendors with opportunities to mix their funds upon exiting. “

In plain sight

The darknet markets are not detached from the larger realm of cryptocurrency either, but rather they are the destination for most high-stakes activity. Take the recent hack for example. No, not the Twitter hack, where accounts posted a Bitcoin address with a promise of doubling the cryptocurrency sent, that hack garnered less than 13 Bitcoins, take the one immediately before it, the one which stole 25 times more BTC.

A few days prior to Bitcoin trending on Twitter, a little known UK-based exchange, primarily serving Indian clientele, Cashaa was the subject of a malware hack, resulting in over 335 Bitcoins siphoned from an employee’s account. While this went under the radar in the crypto space, the Cashaa hack is an example of how closely linked the darknet market is to the crypto world.

John Jefferies, chief financial analyst at blockchain analytics firm CipherTrace told that 15 percent of the stolen Bitcoin [50 BTC  or~$460,000] were moved into Hydra, the largest of the darknet markets. Hydra is a Russian market, and has been the largest darknet market since 2018, dealing in products such as cocaine, cannabis, stolen financial information, fake passports etc.

Prior to sending the Bitcoin to the darknet the hacker’s address saw its funds ‘peeled’ or “split into multiple exchanges” to prevent traceability. Much like the above example of coin-mixing, peeling is a process to hide Bitcoin obtained through criminal activity by distributing dirty Bitcoin into multiple ‘clean’ addresses. According to Smith+Crown Intelligence, a cryptocurrency research firm, peeling can be traced back to source, but at a cost,

“They [stolen Bitcoin] might be re-aggregated into a couple [Bitcoin] addresses and then peeled again. It is theoretically possible to trace all of these transactions but it is not practically feasible without dedicated computing resources.”

Bitcoin on the darknet is more than meets the eye. More in terms of the market size it occupies, more in terms of how they transact the cryptocurrency, more in terms of how they prevent traceability, and more in terms of how they are tied to the larger cryptocurrency world.