Move over Hydra, OMG!OMG! is the darkweb’s latest trojan horse

A new Chainalysis report has found that sanctions have not dampened the presence of darkweb marketplaces that traffic illicit drugs and services on the internet.

The report found an unusual decline in revenue from the previous year.

According to Chainalysis, a blockchain intelligence company, the closure of Hydra – one of the world’s largest dark web sites – caused a significant decrease in the overall market revenue in 2022. Still, new sites have since sprung up in its wake.

The report stated that in Hydra’s wake, vendors soon migrated to several other platforms.

Using on-chain analysis, the researchers determined that wallets were previously associated. With Hydra, accounts were soon popping up on the OMG!OMG! marketplace, too.

Both platforms share a similar business model based on selling drugs via geographic coordinates in which packages are left hidden in parks and other public places, the locations of which are later texted to customers who pay using crypto, often organized over encrypted messaging applications like Telegram.

The Post-Hydra Darkweb

The dark web after Hydra is becoming populated with other players, too. Hydra was once the most successful marketplace for illegal goods and services, including drugs, counterfeit documents, and money laundering, with most of its users located in Russia and surrounding countries.

The platform provided cryptocurrency cash-out services and even announced plans to launch its initial coin offering (ICO) in 2019, plans that never materialized.

In April 2022, the U.S. government added Hydra’s cryptocurrency wallets to its sanctions list, and German authorities took down the platform, seizing 543 bitcoins worth approximately $25 million from its wallets.

In the aftermath of Hydra’s shutdown, however, several competitors emerged, not only OMG!OMG!, also Blacksprut, and Mega Darknet Market.

Chainalysis reported that all three utilized a standard set of deposit addresses at a high-risk exchange with a significant presence in Russia. A separate blockchain intelligence firm, TRM Labs, said that Hydra’s competitors saw an influx of $820 million in cryptocurrency deposits in the wake of Hydra’s sanctioning.

With the loss in market share, other competitors began getting creative. One company parked a bus with its logo painted in the center of Moscow, with Vice reporting that they had also projected their advertisement on a large building in Moscow.

According to the report, by May 2022, OMG!OMG! had captured 50% of the market share of the dark web activity in Russia but lost this due to a distributed denial of service (DDoS) attack in May. Vice also reported that it is not uncommon for competitors in this business to hire hacking mercenaries to take down each other’s sites.

Other Darkweb Revenues

The closing of Hydra has ultimately led to a decrease in revenue industry-wide, the Chainalysis report states. In 2021, darkweb shops cumulatively generated a total revenue of $2.6 billion, the report said. However, in 2022, this figure dropped to $1.3 billion. Chainalysis reports that the average daily revenue of the market saw a steep decline from $4.2 million before Hydra’s shutdown to just $447,000 immediately following the closure.

Additionally, the report found that the closure of another drug marketplace, Bypass Shop, another Russian entity reportedly shut down by police, also contributed to the overall decline in revenue.

However, Chainalysis found that while the revenue of drug shops has gradually been recovering since the latter half of 2022, websites selling illicit goods other than drugs, such as stolen personal or banking data, continued to experience a decline in revenue. For instance, Brian Dumps, the largest marketplace for stolen banking data in 2022, saw its revenue fall to near zero for unknown reasons in October, the Chainalysis report found.