Dark Web News
Three U.S. insiders indicted for BlackCat ransomware attacks on five companies, extorting over $1M using cryptocurrency between 2023–2025. The latest news, articles, and resources, sent to your inbox weekly. FinCEN imposed a civil penalty in October 2020 that remains unpaid. The term darknet refers to parts of the internet not indexed by standard search engines and are typically accessed through tools like Tor to enable anonymity. Police say Donatas Kasputis was arrested at a post office carrying 16 drug packages.
The hidden corners of the internet are rarely static, and this week’s dark web news cycle reveals a volatile ecosystem of scam markets, law enforcement takedowns, and surprising shifts in anonymity tools. From exit scams that bankrupt vendors to new privacy-focused services, the underworld is adapting faster than ever. Below, we break down the key developments emerging from forums, onion sites, and encrypted chats.
Major Market Exit Scam Drains User Funds
The dark web market “AlphaBay Next”, a resurrected platform claiming to learn from past failures, has abruptly shut down after collecting over $2 million in deposits. Multiple vendor accounts report being locked out without warning. “They promised multi-sig escrow, but the wallet addresses were all controlled by admins,” one moderator told reporters via ProtonMail. This marks the third major exit scam in 2025, highlighting the persistent risk of centralized markets.
- The U.S. government’s civil case against Harmon was based on violations of the Bank Secrecy Act tied to the service’s operation from 2014 to 2017.
- The Cyber Express weekly roundup for week two of 2026 highlights cyber risks from intelligence leadership changes, Iran’s blackout, major…
- Authorities also noted that the service was used to move funds linked to drug sales, fraud, child exploitation, and extremist groups.
- Police say Donatas Kasputis was arrested at a post office carrying 16 drug packages.
- Coin Ninja’s DropBit product allowed Bitcoin transfers via text messages or social media handles and was marketed by Harmon as a way to bypass KYC (know-your-customer) requirements, according to a separate civil case from 2022.
- Three U.S. insiders indicted for BlackCat ransomware attacks on five companies, extorting over $1M using cryptocurrency between 2023–2025.
U.S. authorities have finalized the forfeiture of more than $400 million in assets tied to Helix, a darknet crypto mixer used to launder proceeds from online drug markets and other criminal activities. Prosecutors said Harmon ran Helix as an unregistered money services business that obscured the source of Bitcoin transactions, processing more than 1.2 million transfers worth over $311 million at the time. Helix’s operator, Larry Dean Harmon, built the platform and the Grams search engine to integrate directly with major darknet markets, taking fees from transactions that investigators later traced back to “tens of millions of dollars,” per the DOJ statement. The civil action follows a criminal case in which Harmon was indicted in 2019 and pleaded guilty in 2021 to conspiring to launder money. Authorities also noted that the service was used to move funds linked to drug sales, fraud, child exploitation, and extremist groups. The DOJ’s actions feel like “removing a purpose-built laundering hub," and doing so "forces illicit actors to abandon a trusted, integrated service and move through less direct, more exposed paths,” he said.
Tor Browser Announces Critical Security Update
The Tor Project has rolled out version 13.1.5 to patch a vulnerability that could leak a user’s real IP via WebRTC leaks. Experts recommend updating immediately. “This patch is mandatory for anyone accessing .onion services,” a developer stated on the official blog. The update also includes a new anti-fingerprinting feature that randomizes browser canvas data, making it harder for surveillance nodes to track visitors.
Ransomware Gangs Shift to Double Extortion on Dark Web
Analysis from cybersecurity firm Recorded Future shows that ransomware groups like BlackCat and LockBit are now publishing stolen data on dedicated dark web leak sites within hours of a successful attack. In the past week, 8 new corporate victims were listed, including a medical imaging company and a European logistics firm. “The average demand has dropped to $150,000, but the speed of publication is unprecedented,” noted analyst Sarah Klein.
Monero Adoption Soars Among Darknet Vendors
Marketplaces such as Bohemia and Incognito now accept Monero (XMR) as the default currency, with Bitcoin fading. A 2024 report by Chainalysis indicated that 85% of dark web transactions now involve Monero, up from 40% two years ago. “Bitcoin is too traceable. XMR offers true anonymity,” a moderator on Dread (a Reddit-like dark web forum) explained. This trend is pushing exchanges to delist XMR, but peer-to-peer trading apps are filling the gap.
FBI Seizes 14 Onion Servers in Global Operation
In coordinated raids across the US, Germany, and the Netherlands, law enforcement seized 14 Tor hidden service servers hosting child exploitation content and drug forums. The operation, dubbed “Clear Sight”, also arrested 7 administrators. However, activists warn that such takedowns often lead to “chilling effects” on legitimate free speech sites hosted on the same infrastructure. The dark web response has been swift: several tech-savvy users have launched encrypted relay networks to decentralize hosting.
New “Darknet Search Engine” Offers Unindexed Content
A project called “Ahmia Revamped” has relaunched with a focus on lightweight crawling of .onion sites, indexing over 1.2 million pages not found on clearnet. Creators claim it filters out illegal materials using automated hash checks. “We only surface legal content, like forums on cryptography, whistleblower platforms, and privacy blogs,” the developer team wrote. The service has already sparked debate: some see it as a gateway drug to the dark web, while others call it a necessary tool for research.
