Darknet markets were built on a promise of invisibility: Tor hides a site's address, cryptocurrency hides the payer's identity. But the story of Silk Road and Hydra proved the opposite. Transactions made in the "anonymous" shadows lay in the open blockchain, waiting for their moment — and that moment came years later, when the spotlight was finally turned on them.
A darknet market is a trading venue in the hidden part of the network, reachable through anonymizers like Tor. On its storefront are illegal goods and services, and the role of the "cash register" is played by cryptocurrency: it lets people pay with no bank, no name and no borders. It was precisely this pairing — a hidden site plus bitcoin — that created the illusion that the operations could neither be seen nor tied to a person.
The illusion turned out to be dangerous. Tor really does hide where a server is located and who visited the site. But a bitcoin payment is a record in a public ledger that stays there forever. The only thing that is anonymous is the little thread between an address and a name; the transaction network itself is visible to everyone. Link an address to a real identity just once, and that address's entire payment history is revealed backward through time.
Silk Road was a darknet market that operated in 2011–2013; its founder was Ross Ulbricht. The venue became a symbol of an era: it was there that many people first saw bitcoin used as a means of settlement in the shadow economy. The site was shut down and the founder was arrested — but the story of the money did not end there.
The most interesting part happened much later. In 2020 the US authorities seized roughly 69,370 BTC connected to Silk Road, and these funds were traced by the criminal investigation division of the US Internal Revenue Service — IRS-CI. Consider the gap in time: the market was shut down in 2013, but the coins were seized in 2020. For seven years the funds sat in the blockchain — and all that time they remained traceable.
The mechanics of this case are a perfect illustration of a principle that runs through our entire course: the blockchain does not forget. Even after the site was shut down, the coins earned during its operation continued to sit at known addresses. As long as they did not move, they were "dormant" but fully visible. All the analyst had to do was patiently monitor these wallets, wait for movement, and match it against other open data.
Note the role of IRS-CI — a tax authority. This is no accident. Money laundering almost always comes down to the moment when shadow income tries to be legitimized: cashed out, declared, spent. It is precisely at the junction of crypto and the real financial world that tax and financial investigators gain their footholds. A darknet payment is anonymous at the moment it is made, but dirty coins sooner or later seek a way out into the legal economy — and that is where they are met.
"Not your keys, not your coins."
— Andreas Antonopoulos, on control over keys as control over the fate of coins
Here this maxim works against the holders of dirty funds too: control over coins is control over keys, and keys are a physical object that can be found, seized or compromised. As long as coins sit in the blockchain, their movement is visible; the moment investigators gain access to the keys, dormant addresses stop being a secret.
If Silk Road was the pioneer, then Hydra became one of the largest Russian-language darknet markets of its time. It built out an entire shadow infrastructure for settlement and cash-out. In 2022 Hydra was shut down. And here the same storyline repeats: a large-scale shadow venue that had seemed invincible for years ended up in the sights of the investigation, and its financial flows turned out to be traceable.
Almost a decade and different jurisdictions separate Silk Road from Hydra, but the lesson for the AML analyst is identical. Network-level anonymization technology (Tor) and "anonymous" payment technology (cryptocurrency) do not cancel out the key property of the blockchain: every transaction stays recorded. A darknet market may shut down, change its domain, "die" — but the trail of its payments remains in the ledger and is available to be traced after the fact.
Let's collect the mechanics of these cases into a clear diagram. Picture a flow of coins from a darknet market to an ordinary customer's wallet years later.
How an "old" darknet trail reaches today's wallet
Darknet market (sales address) → Dormant wallets (years without movement) → Splitting / transit → Cash-out point to fiat → An "ordinary" customer's wallet
For you as a compliance checker this means: when you see exposure to a darknet tag in an address's deep history, the age of that link does not "forgive" it. Coins earned from a darknet venue in 2015 and reaching your customer in 2024 still carry a risky history on them. This is exactly why, in a check, it is important to look not only at direct counterparties but at the multi-hop exposure we covered in the section on taint and exposure.
Let's unpack a widespread misconception that made many holders of dirty funds feel safe. People confused two different levels of anonymity. The first level is network: Tor hides the user's IP address and the server's physical location, so "where" a site is and "from which computer" someone reached it really are hard to establish. The second level is financial: the payment record itself. And this is where the illusion falls apart, because a bitcoin payment has no network anonymity whatsoever — it is recorded forever in an open ledger seen by the whole world.
In other words, Tor protects the communication channel, but it does not protect the money. You can perfectly hide the point from which you went online and still leave in the blockchain a fully open, immutable trail of your payments. It was precisely this asymmetry that doomed the darknet markets: their operators invested in network anonymity but could not cancel out the publicity of the money. The moment the investigation obtained a single point tying an address to an identity, the entire payment history was revealed backward through time — years deep.
For the practicing analyst, an important principle of trust in data follows from this: the fact that the origin of funds is rooted in an "anonymous" environment does not mean it is untraceable. On the contrary, darknet payments are among the best-documented on the blockchain precisely because they are old and have been studied many times over by researchers and investigators. When you check a wallet whose deep history flickers with a darknet tag, it is wiser to assume that this trail is known and documented, rather than that it "got lost in time."
Facts are presented from open sources. This material is for educational purposes.