How the dark web actually works: a deep dive into the internet's underworld

01What the dark web actually is

The dark web is World Wide Web content that exists on darknets — overlay networks that use the internet but require specific software, configurations, or authorization to access. Through the dark web, private computer networks can communicate and conduct business anonymously without divulging identifying information such as a user's location. The dark web forms a small part of the deep web, the part of the web not indexed by search engines.

It is important to distinguish the dark web from the deep web. The deep web includes all unindexed content — online banking, private databases, subscription content, and email inboxes. The dark web is a specific subset that requires tools like Tor to access. While the deep web is overwhelmingly benign, the dark web has acquired notoriety for hosting illicit marketplaces, forums, and services. However, it also serves legitimate purposes: whistleblowing, journalism, and communication in repressive regimes.

02How Tor and hidden services work

Tor is a free overlay network for enabling anonymous communication. It is built on open-source software run by over seven thousand volunteer-operated relays worldwide, as well as by millions of users who route their internet traffic through these relays. The technique is called onion routing — data is encrypted in multiple layers, each relay peeling off one layer to reveal only the next destination. This makes traffic analysis extremely difficult.

Hidden services, now called onion services, allow websites to operate within the Tor network with their real server location concealed. These sites use .onion addresses that are self-authenticating — the cryptographic key is embedded in the address itself, eliminating the need for certificate authorities. This architecture provides both anonymity for the server and authentication for the user, making it nearly impossible to locate or shut down a hidden service without compromising its operators through other means.

03Marketplaces and their economics

A darknet market is a commercial website on the dark web that operates via darknets such as Tor and I2P. They function primarily as black markets, selling or brokering transactions involving drugs, cyberarms, weapons, counterfeit currency, stolen credit card details, forged documents, unlicensed pharmaceuticals, and other illicit goods. A 2014 study by the University of Portsmouth found that darknet markets were the second most popular type of site on Tor.

The economic model is sophisticated. Markets use escrow systems and multisignature cryptocurrency transactions to protect both buyers and sellers. Reputation systems — vendor ratings, dispute resolution, and feedback — create trust in an inherently trustless environment. Markets charge commissions on transactions, generating significant revenue. Before its takedown, AlphaBay was estimated to have had over 400,000 users and generated hundreds of thousands of dollars in commission revenue monthly.

04Law enforcement takedowns and their effects

Silk Road was the first modern darknet market, launched in 2011 by Ross Ulbricht under the pseudonym Dread Pirate Roberts. It operated as a hidden service on the Tor network, with all transactions conducted in bitcoin. Between February 2011 and July 2013, Silk Road generated approximately $1.2 billion in sales before the FBI seized it and arrested Ulbricht. His life sentence sent a message but did not stop the phenomenon.

The pattern is now well established: law enforcement takes down a major market, and users migrate to alternatives. After AlphaBay was seized in 2017, users flocked to Hansa — which Dutch police had already covertly controlled for a month, allowing them to collect data on thousands of users. Despite these operations, new markets continually emerge. The hydra effect demonstrates that targeting individual marketplaces addresses symptoms but not the underlying demand or supply chain.

05Cryptocurrency and anonymous payments

Cryptocurrency is the lifeblood of dark web commerce. Bitcoin was the original medium of exchange on Silk Road, but its pseudonymous nature provides limited privacy — all transactions are recorded on a public blockchain, allowing forensic analysis to trace funds. Privacy coins like Monero and Zcash have gained prominence on darknet markets because they obscure transaction details, making blockchain analysis far more difficult.

Mixing services, or tumblers, attempt to break the link between bitcoin wallets by pooling and redistributing coins. However, these services have proven vulnerable to analysis and some have been shut down by authorities. The ongoing arms race between privacy technology and forensic tools is central to the dark web economy. Each innovation in anonymity triggers a response from blockchain analysis firms and law enforcement agencies.

06The cybercrime supply chain

The dark web hosts a mature cybercrime ecosystem with specialized roles. Initial access brokers sell compromised corporate credentials and network access. Malware developers create and license ransomware strains. Affiliate programs operate like legitimate software-as-a-service businesses, offering technical support, user manuals, and revenue sharing. Ransomware-as-a-service has lowered the technical barrier to entry, enabling criminals without coding skills to launch attacks.

The supply chain extends to money laundering. Cash-out services convert cryptocurrency into fiat currency through mixers, exchanges with weak KYC controls, and prepaid cards. Stolen data — credit card numbers, personal identification, login credentials — is sold in bulk on specialized forums. The division of labor mirrors legitimate markets, with specialists focusing on specific stages of the criminal value chain and selling their services to others.

07What authorities are doing about it

Law enforcement has evolved its approach beyond single-market takedowns. International operations like DisrupTor and Dark HunTOR have coordinated arrests across multiple countries simultaneously, targeting vendor networks rather than just infrastructure. The seizure of servers provides intelligence — customer databases, encryption keys, and transaction records — that enables further investigations.

Agencies are also deploying undercover operations, with agents operating as buyers and vendors to map networks. Blockchain analysis firms like Chainalysis and Elliptic provide tools that trace cryptocurrency flows, linking dark web activity to real-world identities. Despite these efforts, the fundamental challenge remains: the dark web is global, decentralized, and technologically adaptive. Sustained pressure reduces specific threats but the ecosystem continually reconfigures around them.