Key Takeaways:
- Russian darknet markets processed $1.9 billion in Bitcoin between January and September 2025, according to a new report.
- The funds were routed through at least 20 regulated crypto exchanges holding over 130 international licenses.
- Criminal networks used over-the-counter brokers or peer-to-peer intermediaries to bypass AML and KYC checks.
Russian darknet markets (DNMs) processed about $1.9 billion in Bitcoin this year, a new investigation has found, showing how criminal networks exploited regulated crypto exchanges to launder illicit funds.
Blockchain intelligence firm Global Ledger analyzed transaction activity from January to September 2025 across five of the most active Russian darknet marketplaces — Mega, Kraken, BlackSprut, Omg!Omg!, and Nova.
It found that funds were routed through at least 20 centralized exchanges holding over 130 international licenses, using a complex network that takes advantage of the weak points between on-chain transparency and off-chain compliance.
“We scoped targets with off-chain intelligence: tracking forums, clearnet or darknet dashboards, and using third-party sources to prioritize the top [platforms],” Lex Fisun, the CEO of Global Ledger, told Cryptonews.
“Then, Global Ledger clustering heuristics helped define the on-chain infrastructure and provided the basis for volume calculations [i.e. $1.85B in Bitcoin volume] and counterparty identification.”
Fisun said the firm’s counterparty analysis revealed links to dozens of centralized exchanges (CEXs), including top-tier platforms with “impeccable reputations” for compliance. He refused to reveal their names.
“Yes, we identified exposure to at least 20 centralized exchanges…” Fisun said in response to questions from Cryptonews. “However, because of ongoing compliance reviews, we’re not publishing names.”
“Doing so can sometimes distract from the broader systemic issues we’re aiming to highlight. It’s important to allow compliance processes to unfold properly.”
In its report, shared with Cryptonews, Global Ledger traced thousands of wallet transactions from darknet addresses into regulated crypto venues. It stated that DNMs rely on crypto as a primary method of payment.
Combined, the marketplaces moved nearly $2 billion worth of Bitcoin during the first nine months of this year. Kraken facilitated the largest volume of illicit transfers, totaling $1.3 billion, followed by BlackSprut at $344 million.
Omg!Omg! was the third highest with $123.4 million in volume. Transfers at Mega and Nova reached $76 million and $3.1 million, respectively.
On-chain data shows that funds tied to the darknet sites were funneled through crypto exchanges from all over the world — America, the European Union, Asia, the Middle East, Africa, and other regions.
Exchanges were exploited for deposits and withdrawals through third parties that hide the source of funds. In most cases, exchanges didn’t know what was happening. Total exchange exposure was $291 million, the report says.
“Though relatively small in proportion, this share is significant from a compliance perspective, as it connects regulated financial entities to illicit ecosystems, often without their knowledge.”
According to Global Ledger CEO Fisun, darknet actors typically bypass anti-money laundering and know-your-customer checks through over-the-counter (OTC) and peer-to-peer intermediaries.
“Once funds leave the darknet wallet, the most common route into the regulated perimeter is via OTC or P2P intermediaries that accept card-to-card, phone-number, and fast-payment transfers in rubles…” he said.
“To card networks and banks, these look like routine P2P payments, so the crypto provenance is masked before value ever touches a CEX. That’s why the exposure we see at exchanges is indirect, rather than willful facilitation.”
Informal over-the-counter brokers have emerged as an important bridge between local users and global crypto markets since Western economic sanctions cut off much of Russia’s access to international payment systems.
Fisun said that where actors cash out in crypto instead of fiat, they often use multiple obfuscation layers, including “peel-chains to disperse value, long multi-hop paths (over 20 hops), and mixers or cross-chain bridges.”
Russian Darknet Markets: the Compliance Gap
Experts say such tactics allow cybercriminals to make the most of the time gaps in compliance systems, making it harder for crypto exchanges or analytics tools to flag new addresses that may be linked to criminals.
“Exchanges count on blockchain analytics to prevent illicit funds from entering their platforms,” Slava Demchuk, CEO of blockchain security and compliance firm AMLBot, told Cryptonews.
“However, darknet actors exploit gaps in labelling, especially newly created dark-market addresses that may not yet appear in analytics databases.”
Demchuk added that “sophisticated” laundering now includes automated bot systems that split transactions into small fractions and route them across numerous wallets before depositing into centralized exchanges.
Global Ledger said it is preparing targeted disclosures for the affected exchanges and regulators, focusing on remediation, “not pointing fingers.”
“The focus is on helping compliance teams and regulators understand exposure that may have gone unnoticed,” said company CEO Fisun.
“Sharing these findings directly allows for internal reviews and stronger controls. We see this as part of a broader industry effort to create a safer and more resilient ecosystem.”
Fisun said even “the most reputable exchanges can face exposure due to the speed and complexity of laundering today.” For Demchuk, the issue is now more procedural than it is technological.
“Transaction monitoring systems are highly advanced, with alerts and complex conditions that track everything from the accumulation of small transactions to user geography,” said Demchuk.
“These systems are actually more sophisticated than most users realize. The real issue does not lie in the software, but rather in internal compliance policies and each company’s risk appetite.”
Dumping USDT
Meanwhile, the U.S. Treasury Department’s sanctioning of major Russian exchange Garantex last year, and the subsequent freeze of $28 million in USDT by Tether, triggered an immediate shift in darknet payment behavior.
Garantex was accused of being a haven for cybercriminals who laundered money through the platform to evade sanctions.
Global Ledger co-founder Fisun said Tether’s enforcement actions “shook confidence in USDT rails” and pushed major Russian-language darknet marketplaces to turn off direct USDT deposits.
“Tether’s Garantex freeze shook confidence in USDT rails and likely nudged MEGA to turn off direct USDT deposits,” he noted.
“But the market’s centre of gravity didn’t move. BTC/XMR still dominate, and when alternatives appear, they usually take the form of OTC or P2P ‘vendor exchanges’ moving rubles as ordinary P2P payments.”
The move is a retreat from stablecoins, which were previously favored for their price stability and fast settlement.
Experts say Bitcoin’s emergence as a preferred darknet currency is a trade-off because it is harder to censor but easier to trace. That said, exchanges still have to deal with slow reaction times from law enforcement.
“The software is capable,” said Demchuk, the AMLBot CEO. “But law enforcement operates sometimes too slowly — such reaction times are simply unrealistic in crypto. This has turned out to be a global problem.”
The post How Russian Darknet Markets Funneled $2B in Bitcoin Using Top-Tier Exchanges appeared first on Cryptonews.
