Exploring Hydra, the post-Soviet black market that is dominating the global darknet trade

Named after the indomitable monster of Greek mythology, Hydra Market has devoured its competition. 

According to many cryptocurrency analytics firms, Hydra is the largest darknet marketplace still standing. Chainalysis, for one, says it accounts for the majority of the total market. 

Relying on a sophisticated platform for controlling vendors and elaborate distribution methods, Hydra shuttles around a whole lot of drugs in the former Soviet Union. But that’s not the reason that Western law enforcement and defense agencies have been paying closer attention to the marketplace than ever.

Western authorities are concerned because, aside from its vast drug market, Hydra hosts vendors who sell a variety of other illicit services that revolve around stolen data. That includes the anonymous conversion of bitcoin to other kinds of more usable money — a service the alleged perpetrators of the recent ransomware attack on the Colonial Pipeline apparently used to cash out some of their ransom. 

But despite its scale and sophistication — and the fact that it has been around since 2015 — Hydra remains poorly understood. 

Aside from the technological barriers of the darknet, one reason is that Hydra caters only to customers who understand Russian. Since I both speak Russian and wanted to learn more, I visited Hydra and explored the marketplace myself — and spoke with several investigators who do so professionally.  

Meet Hydra

Navigating to Hydra requires using an anonymous web browsing platform like Tor and an up-to-date roster of .onion addresses. Once you arrive, Hydra’s login page is surprisingly standard-issue. Its captchas are, however, among the toughest around — armor against AI and data-scraping bots that look to analyze its contents. 

Once inside Hydra, what you encounter is a remarkably holistic e-commerce platform, complete with extensive forums, product reviews, job boards and, of course, the goods: narcotics. The drug markets serve as clear reminders that this is not, say, an old version of Amazon. 

Drug markets (and labs)

The most-cited figures on Hydra’s drug sales come from a 2019 investigation by Russian news outlet Project. Top-selling items include various marijuana derivatives like hashish and synthetic stimulants like mephedrone, which in the U.S. is most familiar as a key ingredient in bath salts. Heroin, more exotic opioids, and synthetics like GHB are also available but don’t seem to be as substantial a chunk of Hydra’s sales. 

Among the most notable of Hydra’s features is its stringent eligibility requirements for vendors. Besides maintaining a rate of positive customer reviews above 90%, vendors must submit their products to independent labs that test for purity. 

Indeed, a decent portion of the job board on Hydra consists of openings for chemists. Geographically, Hydra’s own lab-related postings (vendors can also post positions) seem especially concentrated in Karelia, the region northeast of St. Petersburg that borders Finland. 

Sellers on Hydra also face strict controls on their funds. While almost all transactions take place in Bitcoin, vendors are not allowed to withdraw their BTC from the platform until they have completed 50 sales — a means of ensuring quality control in a more-or-less anonymous market. It presents a barrier to quick scams — and to investigators posing as vendors.

 “Since 2018, they’ve put really strict limitations on their sellers,” said Kim Grauer, head of research for Chainalysis. These restrictions and quality controls keep Hydra running.

The vendors also have to pay up to the Hydra infrastructure to stay running. “For keeping your shop within Hydra alive, depending on your revenue, you have to give a certain percentage to Hydra,” said Vlad Cuiujuclu, who runs Flashpoint’s investigations into cybercrime in the former USSR.

Uniquely Hydra

An element of Hydra’s operations that has attracted some mainstream attention is its use of an in-person delivery system that resembles geo-caching. 

Low-level dealers throughout the Russian Federation and beyond are being replaced by Hydra’s kladmen, or “treasuremen.” These kladmen hide small deliveries of drugs in discrete locations for buyers to pick up later. Hydra’s forums include a “Kladman’s Bible,” and the job boards advertise a “School of Kladmen.”

One such posting requires a potential kladman to have access to Tor and knowledge of computers, but also “the ability to express ideas literately,” “cool-headedness and orderliness” and “absence of unhealthy habits.”

Pamela Clegg, who heads CipherTrace’s investigations, said of the kladmen system: “They’ve taken a page from the intelligence community in the way they’ve maintained their security. Other dark markets that utilize the postal system — that’s obviously a weak link.”

The kladmen system is the stuff of great headlines. Vice, for example, ran a piece last year entitled “A New Breed of Drug Dealer Has Turned Buying Drugs into a Treasure Hunt.” But it’s actually one way that Hydra more closely resembles traditional systems of drug trade than many competitors. 

“When it comes to distribution of narcotics in Russia, it begins with border guards and goes all the way to distributors in the cities,” Cuiujuclu. “They can also hide money or just deliver it to your doorstep.”

Cyberwares and laundering risk

As intriguing as the drug trade is, Western authorities would not likely care about Hydra’s activity if it was limited to getting the former Soviet Union high. It’s the other services available on the site that have put Hydra on the radar of Western financial institutions and investigators.

“Initially Hydra was launched as a dark web platform focused on drugs and substances. But now the platform is known for providing more than illegal drugs-related goods,” Kaspersky Labs researcher Dima Galov said in an email to The Block. “There is a vast range of illicit merchandise, as well as illegal services, including stolen data, hacking services, sales of stolen credit cards, sim cards, stolen accounts and counterfeit money. On the marketplace cybercriminals can sell the stolen data of their victims and provide common hacking services.”

The Biden administration has been prioritizing Russian cybercrime and, in particular, ransomware like that which debilitated the Colonial Pipeline. But The Block could not find any for sale on Hydra.

Galov confirmed the same findings: “No ransomware on Hydra, at all.”

Rather than simple ransomware sales, the real concern with Hydra is its utility in laundering funds, including those that come from ransomware attacks. The market runs extremely overt connections to major local payments platforms like Yandex Dengi and Qiwi Wallet, as well as directly from credit cards. 

Western analogues like Venmo or Paypal are required to have programs in place to identify these sorts of transfers, though they still occur. The brazenness of the links to popular Russian payment apps is a step beyond, suggesting that there are minimal checks on these money services businesses interacting with Hydra. 

Similarly, Russian crypto exchanges don’t seem to be concerned about taking in Hydra-trainted bitcoin. According to Clegg, “With Russian exchanges, we don’t see that there has been action taken to reduce the influx of Hydra funds into those exchanges.”

And if that crypto can go directly into rubles? “Once cryptocurrency is deposited into Hydra Market it is a dead-end for tracing,” said Clegg. 

Lately, the Hydra use has been consolidating into fewer but larger transfers, suggesting a move away from recreational drug users and towards more powerful players.

“There are very few deposit addresses on exchanges that are accepting this money,” said Grauer. “The number of deposits to Hydra has been declining rapidly but the size of those transactions has been increasing.”

As the West, particularly the United States, focuses on ransomware, there is more talk of disrupting entire supply chains of ransomware. That would involve targeting the sites and ransomware-as-a-services gangs that actually sell the necessary code, but also cutting off access to cashouts.

Any concrete steps Western intelligence or Russian law enforcement have taken to curtail Hydra remain unclear. What is clear is that nobody has succeeded in taking the site and surrounding network offline. But why? That’s a question I will try to answer in a forthcoming piece.