Dark web black markets operate like anonymous e-commerce sites hidden on the Tor network: vendors list stolen data, buyers pay in cryptocurrency, and an escrow service holds the funds until the "goods" are delivered. What gets sold is your digital identity: login credentials, credit card numbers, banking details, and full identity packages harvested from data breaches and infostealer malware. Reputation scores and vendor reviews let strangers trade with each other, which mirrors legitimate online shopping while dealing exclusively in illegal goods.
The Chainalysis 2026 Crypto Crime Report measured slightly over US$2.5 billion (about RM 10.5 billion) in crypto inflows to darknet markets and drug vendors in 2025.
The dark web is the small, deliberately hidden portion of the internet that standard search engines like Google or Bing never index. Reaching it requires anonymising software such as the Tor Browser, which routes traffic through layers of encryption to conceal a user's location and identity. Within that hidden layer sit dark web black markets: online marketplaces where illegal goods and services, including stolen data, are bought and sold.
Three terms are often confused. The deep web is any content behind a login or paywall, such as your email inbox or online banking dashboard, and it is entirely legitimate. The dark web is a deliberately concealed subset reached only through tools like Tor. A darknet market is a specific commercial platform on that dark web.
Read also: The Dark Web vs. the Deep Web: Which Is More Dangerous?
Dark web black markets solve one hard problem: letting strangers commit crimes together without trusting each other or revealing who they are. They copy the trust features of mainstream online retail and layer anonymity on top. Four mechanisms make them work.
Many markets require new members to register, and some tiers ask for an invitation or referral from an existing buyer to keep out law enforcement and scammers.
Transactions run on cryptocurrency because it settles without a bank in the middle.
To stop buyers and sellers cheating each other, markets hold the payment in escrow and release it to the vendor once the buyer confirms the data works.
Like any e-commerce platform, darknet markets run on ratings. Vendors accumulate feedback scores and reviews, which tell buyers whom to trust.
Prices vary widely by data type. The latest edition we found of the Privacy Affairs Dark Web Price Index is the 2023 edition, built from 2022 and early-2023 listings. Its figures are historical, so read them as relative price signals:
| Stolen data type | Price in the index (US$) |
|---|---|
| Credit card details | US$10 – US$110 |
| Hacked Gmail account | US$60 |
| Hacked social media account (Facebook and Instagram US$25) | US$20 – US$25 |
| Selected verified crypto exchange accounts (Kraken) | US$1,170 |
| Online banking logins | US$25 – US$4,255 (about RM 18,000) |
| Verified Cash App account | US$860 |
| USA passport scan | US$50 |
Source: Privacy Affairs, Dark Web Price Index 2023. Ringgit figures are indicative, at roughly RM 4.2 per US$1.
Names, addresses, national ID numbers, dates of birth, and phone numbers form the raw material for identity theft, fake account creation, and document forgery.
Card numbers, expiry dates, and CVV codes fuel fraudulent purchases, while banking logins can drain accounts directly. Balance matters: in the index, a card with a balance up to US$5,000 listed at US$110, against US$70 for one up to US$1,000.
Usernames and passwords for email, social media, and banking sit alongside cards in the index, priced by how much access they give.
Before your data can be sold, it has to be stolen and delivered into the marketplace supply chain. Four routes feed it.
Infostealer malware silently harvests saved passwords, browser cookies, and autofill data from an infected device. The output, called a "stealer log", bundles credentials for many sites at once. In the same index, malware installs sell per 1,000 infections, from US$35 for low-quality global installs to US$4,500 for premium-quality installs, so access to victims' devices is itself a priced product.
Phishing tricks people into handing over credentials directly. A message posing as a bank, employer, or courier leads the victim to a fake login page, and whatever they type goes straight to the attacker.
When a company is compromised, entire databases of customer and employee records leak at once. These bulk dumps are broken up and resold on dark web markets. IBM's Cost of a Data Breach Report 2026 put the global average cost of a breach at US$4.99 million (about RM 21 million), a 12% rise on the year before.
Social engineering manipulates people rather than machines. An attacker posing as IT support phones an employee and talks them into resetting a password or approving access.
Read also: Has a Data Breach Occurred? Here Are the Steps You Should Take
Once data lands on a black market, the damage spreads in predictable ways. For individuals, stolen card and banking details lead to direct financial loss, and exposed PII enables identity theft such as loans opened in the victim's name.
For businesses, a breach also erodes customer trust.
Read also: Why Is Automated Data Breach Monitoring Important for Security?
Law enforcement does take markets down. Chainalysis found that on-chain volume at fraud shops, the sites that sell stolen payment data, fell from about US$205 million to US$87.5 million in 2025, largely after takedowns of the UAPS payment processor and the Cryptex laundering service. Even so, darknet market inflows still edged up slightly that year. Privacy Affairs saw the same pattern in 2022-23: new sites filled the gap left by seized ones nearly overnight.
Operators profit from hosting the trade and from controlling the escrow wallet where buyers' payments wait until a sale completes. When an operator closes a market, users can lose whatever they had on deposit.
In the index, a verified ING bank login is the highest-priced account at US$4,255, a Kraken exchange account lists at US$1,170, and hacked social media accounts sell for US$20-US$25.
Plan on the data staying out there, so the practical response is to limit the damage: change exposed passwords and freeze or monitor affected accounts.
Use a dark web monitoring or breach-scanning service that checks known dark web sources for your email, phone number, or credentials. For businesses, automated breach monitoring alerts security teams when corporate data surfaces for sale.
Find out how the data leaked and tell the people affected. Then check with legal counsel whether the incident triggers a breach notification duty under the PDPA.
Stolen data starts with a single phished password or an infected laptop. Train employees to recognise phishing and social engineering, enforce unique passwords with multi-factor authentication, and monitor the dark web so exposed credentials are caught early. SiberMate combines automated breach monitoring with security awareness training to reduce human cyber risk across your organisation.
To see where you stand today, run SiberMate's free Exposure Check on an email address or your company domain.