How the Dark Web Makes Billions—and Who Gets the Money

A stolen password may sell for less than a restaurant meal.

By itself, it does not look like the beginning of a billion-dollar economy. But that password may unlock an email account, which leads to a bank account, a company network, private documents, customer records, or enough personal information to impersonate the victim.

The first criminal may steal the data.

A second person may organize it.

A third may sell access.

Another may use it to commit fraud.

Someone else may move the proceeds.

By the time the victim realizes what happened, the same piece of information may have produced income for several people who never met each other.

That is the real financial power of the dark web.

It is not one hidden company earning billions. It is an international supply chain in which stolen information, criminal services, illegal products, fraudulent payments, and technical access are repeatedly bought, sold, and reused.

The crime may begin with one victim.

The economy grows because many criminals can profit from the same loss.

The Dark Web Is Not a Single Marketplace

The dark web is a part of the internet that generally requires specialized software or configurations to access.

It can provide privacy to journalists, political dissidents, researchers, whistleblowers, and people living under oppressive governments. Merely using it is not automatically illegal.

However, its privacy features can also support criminal marketplaces and forums.

These platforms may advertise:

• Stolen personal information

• Compromised financial accounts

• Payment card details

• Fraudulent documents

• Malware

• Access to corporate networks

• Illegal drugs

• Counterfeit products

• Hacking services

• Money-laundering services

• Extortion-related data

• Other prohibited goods and services

The modern underground economy is also not limited to hidden websites.

Europol reports that criminal activity increasingly moves between dark web forums, ordinary websites, encrypted messaging applications, decentralized platforms, and private online communities. The boundary between the visible and hidden internet has become less clear.

The dark web is therefore better understood as part of a larger criminal infrastructure.

The store may be hidden.

The advertisement may appear on social media.

The negotiation may happen through an encrypted application.

The payment may move through cryptocurrency.

The final cash may enter the traditional financial system somewhere else entirely.

How Large Is the Underground Digital Economy?

No one can measure it perfectly.

Criminals do not publish audited financial statements. Victims do not report every loss. Some illegal transactions occur entirely in cash, while others move through bank transfers, payment applications, gift cards, cryptocurrencies, shell companies, or informal networks.

Different reports also measure different things:

• Marketplace transaction volume

• Money received by known illicit cryptocurrency addresses

• Losses reported by victims

• Ransom payments

• Value of stolen information

• Criminal assets seized

• Fraudulent transactions prevented

• Total economic damage to businesses

These figures are related, but they are not interchangeable.

The FBI’s Internet Crime Complaint Center recorded approximately $20.9 billion in reported losses during 2025. Complaints involving cryptocurrency were associated with about $11.4 billion in losses, while investment fraud alone produced more than $8.6 billion in reported losses. These figures include many crimes occurring outside the dark web, but they demonstrate the enormous financial scale of technology-enabled fraud.

Blockchain analytics firm Chainalysis estimated that known illicit cryptocurrency addresses received at least $154 billion during 2025. A large part of that increase was connected to sanctioned entities and state-related activity rather than ordinary dark web purchases. The company also estimated that illicit activity remained below 1% of total attributed cryptocurrency transaction volume.

That distinction matters.

Cryptocurrency crime is large.

The legitimate cryptocurrency economy is much larger.

And neither figure represents the dark web alone.

A Marketplace Can Process Hundreds of Millions

Individual hidden marketplaces can still become enormous.

Europol reported that Archetyp Market operated for approximately five years, accumulated more than 600,000 users, hosted over 17,000 listings, and processed at least €250 million in transactions before authorities dismantled it in 2025. Assets worth approximately €7.8 million were seized during the operation.

That €250 million did not all belong to the marketplace administrator.

Most of it represented payments moving between buyers and vendors. The platform earned only a portion through fees, commissions, deposits, advertising, or other services.

This is similar to a legitimate online marketplace.

The platform does not manufacture every product.

It creates the environment in which other people conduct business—and charges for controlling that environment.

The difference is that the hidden marketplace may be facilitating crime rather than lawful commerce.

Stolen Data Is the Raw Material

Data is one of the underground economy’s most valuable resources because it can be reused in many different crimes.

A stolen database may contain:

• Names

• Email addresses

• Passwords

• Phone numbers

• Home addresses

• Dates of birth

• Social Security numbers

• Account numbers

• Medical information

• Employment records

• Payment information

• Copies of identification documents

The original thief does not always commit the final fraud.

They may sell the data to someone specializing in identity theft, account takeovers, phishing, extortion, fraudulent loans, or unauthorized purchases.

Europol describes stolen data and information collected by credential-stealing malware as central commodities that support fraudsters, access brokers, ransomware affiliates, and other cybercriminals.

The stolen information becomes inventory.

A criminal may buy thousands of records knowing that many will be outdated or useless. The records that still work can produce enough profit to make the entire purchase worthwhile.

This is one reason data breaches remain dangerous years after they occur.

The data may be old.

The password may still be active.

The person’s date of birth has not changed.

The victim may have forgotten the breach, while criminals continue passing the information from one buyer to another.

One Victim Can Produce Several Revenue Streams

Consider a compromised online account.

Without describing how the crime is performed, the financial chain may look like this:

1. One criminal obtains unauthorized account information.

2. The information is sold to a data broker.

3. The broker organizes it and resells it.

4. An access buyer tests whether the account remains valuable.

5. A fraud group uses the account or related identity information.

6. A payment intermediary receives the proceeds.

7. A laundering service charges to move or disguise the money.

8. The remaining funds are divided among the participants.

The victim loses once.

The stolen information may be sold several times.

This creates an economy in which the person causing the original breach may earn less than the criminals who later exploit the information more effectively.

A thief sells the raw material.

Other participants turn it into a business.

Marketplace Administrators Earn From Every Transaction

Marketplace administrators create and maintain the platform.

Their responsibilities may include:

• Managing servers

• Controlling user access

• Approving vendors

• Resolving disputes

• Maintaining payment systems

• Operating escrow services

• Moderating forums

• Removing suspected law-enforcement accounts

• Selling advertising placement

• Collecting fees

They commonly earn money through transaction commissions.

A percentage taken from thousands of purchases can become more valuable than selling illegal products directly.

The administrator may never physically touch the goods. The platform earns because it controls the location where buyers and sellers find each other.

Some marketplaces also use escrow.

The buyer’s payment is temporarily held until the transaction reaches an agreed stage. The system is designed to reduce the risk that either participant immediately disappears with the money.

That creates a strange contradiction.

A criminal marketplace must manufacture enough trust for strangers to break the law together.

The platform is illegal.

Its business model still depends on customer confidence.

Administrators Can Also Steal From Their Own Users

Criminal marketplaces contain no reliable consumer protection.

An administrator may suddenly close the platform and disappear with money held in vendor or buyer accounts. This is commonly known as an exit scam.

Europol reports that sudden shutdowns and exit scams remain common, with some administrators apparently preparing to disappear with user funds when they fear arrest or seizure.

This means a marketplace operator may earn money in two stages:

• Commissions while the platform operates

• Deposited funds stolen when the platform closes

Criminals are therefore exposed to the same dishonesty they inflict on others.

A seller cannot call a regulator when an illegal platform steals the balance.

A buyer cannot dispute an illegal transaction with a credit card company.

There is no legitimate court enforcing the marketplace’s promises.

The underground economy tries to create trust without accountability.

That weakness is always waiting beneath the transaction.

Vendors Receive the Sale Revenue

Vendors are the people or groups offering products, information, or services.

They may operate individually or as part of organized criminal networks.

A vendor’s revenue depends on factors such as:

• Demand

• Reputation

• Volume

• Competition

• Marketplace fees

• Refunds

• Product quality

• Risk of seizure

• Cost of obtaining inventory

• Payments to other criminals

The vendor does not necessarily keep the full sale price.

Money may be divided among suppliers, couriers, technical workers, document producers, account managers, recruiters, corrupt facilitators, and laundering networks.

The person visible on the marketplace may be only the final seller.

Behind one username may be an entire organization.

Access Brokers Sell the Door, Not What Is Behind It

Some criminals specialize in selling unauthorized access to digital systems.

They may advertise access to:

• Corporate networks

• Remote working systems

• Cloud accounts

• Email environments

• Business software

• Customer databases

• Other compromised infrastructure

The broker may not deploy ransomware, steal the final files, or negotiate with the victim.

The broker’s product is the opportunity.

Another criminal group purchases that access and decides how to monetize it.

This division of labor makes cybercrime easier to scale.

A fraudster no longer needs to possess every technical skill. A ransomware group does not necessarily need to discover every victim itself. A criminal can purchase one piece of the operation from someone who specializes in it.

The underground economy becomes more efficient when crime is divided into services.

Malware Developers Can Earn Without Selecting Victims

Some developers create malicious software and rent or sell access to other criminals.

Depending on the criminal model, they may receive:

• Subscription payments

• Licensing fees

• A percentage of stolen funds

• Payments for technical support

• Fees for customized versions

• Revenue from each successful installation

The developer may present the illegal service with features resembling a legitimate software company:

• User dashboards

• Updates

• Customer support

• Documentation

• Membership levels

• Affiliate programs

• Performance statistics

This professional appearance does not make the service legitimate.

It reveals how far criminal operations have adopted ordinary business practices.

The software industry discovered recurring subscriptions.

The criminal economy copied them.

Ransomware Operates Like a Revenue-Sharing Business

Many ransomware operations use an affiliate structure.

A central group may maintain the malicious software, payment system, communication platform, and leak site. Affiliates identify or compromise victims and carry out attacks using the group’s infrastructure.

When a victim pays, the money may be divided among:

• The core ransomware operators

• Affiliates

• Initial-access brokers

• Negotiators

• Infrastructure providers

• Data thieves

• Money launderers

• Other facilitators

The exact division varies between groups and can change rapidly.

Europol observed more than 120 active ransomware brands during 2025 and described the ecosystem as fragmented, competitive, and increasingly based on specialized services and overlapping participants.

The important point is not a specific percentage.

It is that the ransom is rarely pure profit for one person.

Like revenue inside a legitimate company, the money is divided among the people and systems required to produce the result.

Scam Centers Turn Fraud Into Industrial Labor

Some digital fraud is conducted through large organized operations rather than by isolated individuals.

Workers may be assigned tasks such as:

• Finding potential victims

• Beginning conversations

• Building emotional trust

• Impersonating professionals

• Managing fake accounts

• Processing payments

• Preventing victims from withdrawing money

• Contacting previous victims again

The FBI reported that many cryptocurrency investment scams targeting Americans are operated by organized criminal enterprises in Southeast Asia. Some workers inside these compounds are themselves victims of human trafficking and are forced to participate in fraud.

This makes the financial structure especially disturbing.

The victim sending money may believe it is an investment.

The person communicating with the victim may be working under coercion.

The managers and criminal organizers take the largest share.

The people at both ends of the conversation may be trapped for different reasons.

The technology creates distance between them.

The money connects their suffering.

Stolen Accounts Become Tools for Other Crimes

A stolen account can have value beyond the money immediately available inside it.

It may be used to:

• Impersonate the victim

• Contact friends or employees

• Reset other passwords

• Access stored payment methods

• Obtain private documents

• Create convincing fraudulent messages

• Enter additional business systems

• Make purchases

• Support extortion

• Build a more complete identity profile

This is why stolen credentials can be sold cheaply while producing expensive consequences.

The initial login is not always the prize.

It is the first key on a much larger key ring.

The buyer is paying for whatever the account might unlock next.

Illegal Services Reduce the Cost of Committing Crime

The underground economy earns billions partly because criminals can purchase services instead of building everything themselves.

A criminal may pay for:

• Stolen data

• Unauthorized system access

• Hosting

• Fraudulent documents

• Communication infrastructure

• Malware

• Technical support

• Money movement

• Advertising

• Recruitment

• Automated tools

This lowers the barrier to entry.

Someone with limited technical knowledge may purchase capabilities from more skilled criminals. Someone with technical knowledge but no victims may sell services to groups that already possess targets.

Specialization increases efficiency.

Efficiency increases scale.

The economy becomes dangerous not only because a few criminals are highly capable, but because their capabilities can be rented by many others.

Cryptocurrency Is the Payment Rail, Not the Entire Crime

Cryptocurrency is attractive to criminal networks because it can move across borders quickly, operate continuously, and function without a traditional bank transfer between every participant.

Different digital assets offer different levels of:

• Price stability

• Liquidity

• Privacy

• Transaction speed

• Acceptance

• Traceability

Chainalysis estimated that stablecoins represented 84% of illicit cryptocurrency transaction volume in 2025, reflecting many of the same practical reasons legitimate users prefer them: relatively low volatility and easy cross-border transfer.

However, cryptocurrency does not make transactions invisible.

Many blockchains maintain public transaction records. Investigators can combine blockchain activity with exchange records, seized devices, communications, and other evidence to identify participants.

Cryptocurrency can make money easier to move.

It can also preserve a financial trail for years.

The criminal may experience speed today.

The evidence may remain tomorrow.

Why Criminals Still Need the Traditional Economy

Cryptocurrency can be used to pay other criminals, purchase illegal services, or hold value.

But eventually, many participants want ordinary economic benefits:

• Housing

• Vehicles

• Travel

• Food

• Businesses

• Luxury products

• Property

• Cash

• Political influence

• Payments to employees or associates

That creates a difficult moment.

Digital assets must often be converted, spent, invested, or integrated into the broader economy.

Each transition can produce fees and risk.

The more people required to move the money, the more people demand a share.

The marketplace earns a fee.

The payment intermediary earns a fee.

The laundering network earns a fee.

The person converting funds may earn a fee.

The organizer receives what remains.

A billion-dollar criminal economy does not mean the original criminal keeps a billion dollars.

The money leaks into the infrastructure supporting the crime.

Money Launderers Are Paid to Absorb Risk

Criminal proceeds are less useful when they remain clearly connected to theft, fraud, extortion, or an illegal marketplace.

Money-laundering networks help move or disguise those proceeds.

They may charge based on:

• The amount

• The payment method

• The countries involved

• The speed required

• The level of legal risk

• The difficulty of converting the assets

• The criminal reputation of the customer

The laundering network is not performing a minor administrative service.

It is accepting the risk that accounts will be frozen, assets seized, intermediaries arrested, or funds stolen.

That risk creates its price.

The criminal who produced the money may receive less because someone else must make the money usable.

Illegal revenue and spendable wealth are not the same thing.

Money Mules Receive a Small Share and Carry Large Risk

Money mules help receive, transfer, withdraw, or convert criminal funds.

Some understand exactly what they are doing.

Others are recruited through:

• Fake job offers

• Romantic relationships

• Investment schemes

• Social media

• Requests from online acquaintances

• Promises of easy commissions

A mule may be told to keep a small percentage and send the rest elsewhere.

The commission can look like easy income.

The mule’s name, bank account, address, and identification may become the most visible part of the transaction.

The organizers remain distant.

The mule becomes the person authorities and financial institutions can find.

In the underground economy, the smallest payment may come with the most immediate exposure.

Corrupt Facilitators Can Profit Without Using a Computer

Digital crime still depends on the physical world.

Criminal networks may benefit from corrupt or compromised people who can provide:

• Documents

• Insider information

• Account access

• Transportation

• Protection

• Business records

• Financial services

• Advance warning

• False verification

These participants may receive direct payments, a percentage of revenue, or other benefits.

Their role demonstrates that cybercrime is not entirely virtual.

The attack may occur online.

The organization surrounding it can contain the same corruption, coercion, and hierarchy found in traditional organized crime.

State-Linked Actors May Want More Than Profit

Some illicit digital activity is connected to governments or state-linked groups.

Their goals may include:

• Sanctions evasion

• Intelligence gathering

• Political disruption

• Financing government operations

• Stealing digital assets

• Funding military or strategic programs

• Weakening foreign institutions

In these cases, the money does not necessarily end with private criminals purchasing luxury products.

It may support national objectives.

Chainalysis attributed much of the sharp increase in known illicit cryptocurrency volume during 2025 to sanctioned entities and state-related infrastructure. The company also estimated that hackers linked to North Korea stole approximately $2 billion in digital assets during the year.

This expands the underground economy beyond ordinary theft.

The same infrastructure that serves fraudsters may also serve organized crime groups, sanctioned entities, and governments.

What begins as a criminal payment network can become a geopolitical tool.

Who Usually Keeps the Largest Share?

There is no universal answer.

The largest financial rewards may go to:

• Marketplace owners controlling high transaction volume

• Leaders of organized fraud networks

• Successful vendors

• Ransomware operators and affiliates

• Skilled brokers controlling valuable access

• Laundering networks processing large amounts

• State-linked organizations

• Administrators who conduct exit scams

The people performing repetitive work may receive much less.

That includes low-level recruiters, account operators, couriers, money mules, and coerced workers.

The criminal economy is not financially equal.

Like many exploitative systems, it concentrates profit near the top and risk near the bottom.

The leaders design the structure.

Others become replaceable parts inside it.

A Simplified Look at Where One Payment Goes

Imagine a victim loses $10,000 in a digital scheme.

The exact division varies, but the money may be divided conceptually among:

• The person who found or manipulated the victim

• The group that provided the fraudulent platform

• The supplier of stolen data or accounts

• The criminal organization managing the operation

• The payment processor or mule network

• The laundering service

• Managers, recruiters, and infrastructure providers

Some money may be frozen or stolen during transfer.

Some may be paid to other criminals.

Some may never successfully leave the digital ecosystem.

The organizer may keep only part of the original $10,000.

But the organization does not need to keep everything from every victim.

It needs a system capable of repeating the process thousands of times.

Scale turns partial profit into enormous revenue.

Why the Economy Survives Marketplace Takedowns

When authorities close one marketplace, users often migrate to another.

Europol reports that dark web markets have become more fragmented and specialized. Forums act as migration centers, helping users reconnect when a major platform disappears. New markets can emerge rapidly to absorb displaced vendors and customers.

This resilience comes from decentralization.

There is no single headquarters containing the entire underground economy.

Different parts may exist across:

• Several countries

• Multiple hosting providers

• Hidden services

• Encrypted applications

• Private forums

• Cryptocurrency networks

• Compromised computers

• Independent criminal groups

Removing one platform matters.

It can produce arrests, seizures, distrust, and temporary disruption.

But the customers, skills, and financial incentives may remain.

A marketplace can be destroyed.

Demand begins rebuilding it somewhere else.

Distrust Is Also a Major Cost

Criminal markets may generate enormous revenue, but they operate under constant suspicion.

Participants must worry about:

• Undercover officers

• Informants

• Exit scams

• Fake vendors

• Stolen deposits

• Rival groups

• Compromised administrators

• Seized servers

• Leaked identities

• Fraudulent services

• Internal betrayal

This creates economic friction.

More intermediaries are needed.

More fees are charged.

More time is spent verifying reputation.

Funds may be held in escrow.

Membership may be restricted.

The environment becomes less efficient because no one can fully trust anyone else.

Anonymity helps the market exist.

It also prevents participants from knowing whether the person across the transaction is a criminal, a scammer, or an investigator.

Law Enforcement Can Become the Final Recipient

Some criminal money never reaches its intended destination.

Authorities may seize:

• Cryptocurrency

• Cash

• Bank balances

• Vehicles

• Property

• Servers

• Business assets

• Marketplace deposits

Europol’s 2025 operation against Archetyp Market resulted in the seizure of assets worth approximately €7.8 million. Other international operations have seized marketplaces, infrastructure, and large quantities of digital assets.

Seized money may eventually be handled according to legal forfeiture and victim-compensation procedures.

Recovery is not guaranteed.

Assets may have changed value, moved through several jurisdictions, or been spent before authorities locate them.

The amount stolen is often much larger than the amount recovered.

Crime can move money in seconds.

The legal process of returning it may take years.

The Victim Pays More Than the Stolen Amount

Reported financial losses do not capture the complete cost.

A business affected by cybercrime may also pay for:

• System restoration

• Legal advice

• Security investigations

• Customer notifications

• Regulatory compliance

• Lost productivity

• Higher insurance premiums

• Reputation repair

• New security controls

• Interrupted operations

Individuals may spend months correcting:

• Credit reports

• Fraudulent accounts

• Tax records

• Insurance claims

• Compromised identities

• Bank disputes

• Passwords and account access

The criminal receives money.

Everyone else pays for the damage surrounding it.

This is why the true economic cost can be much greater than the payment visible on the blockchain or complaint form.

The Dark Web’s Most Valuable Product Is Trust

The stolen data, drugs, malware, and fraudulent documents attract attention.

But the marketplaces cannot function without something less visible: trust.

A buyer must believe the seller will deliver.

A seller must believe the buyer will pay.

An affiliate must believe the operator will share revenue.

A criminal must believe a laundering service will not steal the funds.

A forum member must believe another user is not working with law enforcement.

Marketplaces try to manufacture that trust using reviews, reputations, escrow, membership rules, and dispute systems.

That trust has financial value.

The administrator who controls it can collect revenue from thousands of people who do not trust one another individually.

This may be the darkest similarity between the criminal and legitimate economies.

Both depend on trust.

One protects it with laws.

The other tries to replace laws with fear, reputation, and temporary convenience.

How Ordinary People Feed the Economy Without Knowing It

Most victims never intentionally enter the dark web.

They may become part of its economy through:

• Reusing passwords

• Responding to fraudulent messages

• Sending money to impersonators

• Downloading malicious files

• Investing through fake platforms

• Having information exposed in a company breach

• Accepting a fake remote job

• Allowing someone else to use their bank account

• Failing to secure email or financial accounts

This does not make the victim responsible for the crime.

The criminal made the decision to exploit them.

But understanding the financial chain makes defensive habits easier to appreciate.

A password is not merely a password.

An email account can become the entrance to someone’s financial life.

A bank account used for “processing payments” can become part of a laundering chain.

The individual action may appear small.

The underground economy survives by combining millions of small opportunities.

How to Reduce Your Exposure

You cannot eliminate every risk, but you can make your information more difficult and less profitable to exploit.

Use Different Passwords

A password manager can help create and store unique passwords so one breach does not unlock several accounts.

Enable Multifactor Authentication

Use stronger authentication methods wherever available, especially for email, banking, cryptocurrency, cloud storage, and work accounts.

Protect Your Email Account First

Email often controls password resets for other services. A compromised inbox can provide access to much more than messages.

Review Financial Activity

Check bank, credit card, investment, and cryptocurrency accounts for transactions you do not recognize.

Monitor Your Credit Reports

Unfamiliar accounts or inquiries may reveal identity theft before a collection letter arrives.

Verify Unexpected Requests Independently

Contact companies and relatives through known numbers rather than using links or contact information provided in a suspicious message.

Never Move Money for a Stranger

A legitimate job should not require you to receive money personally and transfer it elsewhere.

Report Fraud Quickly

Fast reporting may improve the possibility of freezing or recovering funds.

The underground economy depends on speed, confusion, and silence.

Verification slows it down.

The Money Rarely Ends With the Person Who Stole It

The image of one anonymous hacker sitting alone and becoming rich is incomplete.

Some criminals do operate independently.

But the largest underground operations resemble networks of businesses.

One participant steals data.

Another sells it.

Another purchases access.

Another operates the fraud.

Another manages victims.

Another processes payments.

Another launders the proceeds.

Administrators charge commissions while infrastructure providers charge fees. Low-level workers and money mules absorb risk. Leaders and successful intermediaries collect the largest rewards.

The dark web does not create billions from nothing.

The money comes from real people, businesses, financial institutions, and governments.

Every criminal dollar was previously part of someone else’s life.

It may have been retirement savings, business revenue, medical money, a home deposit, a child’s education fund, or years of accumulated work.

Technology changes how quickly it can be stolen.

It does not change what the money represents.

The underground economy becomes powerful by turning human loss into inventory, subscriptions, commissions, and revenue-sharing agreements.

That may be its most unsettling feature.

Behind the anonymous usernames and digital wallets is not a mysterious alternative economy.

It is an organized system designed to convert someone else’s trust into profit.

Sources

Europol — Internet Organised Crime Threat Assessment 2026

FBI — 2025 Internet Crime Report

Chainalysis — 2026 Crypto Crime Report: Key Findings

This article was written by the owner of this website using information researched from the sources listed above.

Continue Reading