Why is the world’s largest darknet market so hard to kill?

In a previous piece, I explained the basics of Hydra, the Russian-language marketplace that has quietly become the world’s largest online platform for buying and selling narcotics, stolen data, and other illicit services. What’s harder to explain is why Hydra has remained operational for so long. 

Such a conspicuous and massive illegal network should surely draw all kinds of attention. So why is it still running?

The reasons are complicated, stretching from Hydra’s success as a business and independent economy to its insulation within the former Eastern Bloc all the way to suspicions of high-level corruption working in its favor.

The Russian defense

As mentioned before, Hydra is largely confined to Russia and the former USSR, which maintain a high degree of separation from global law enforcement organizations. Especially when its wares were almost all domestic drug sales, nobody outside the country seemed to care very much. 

Internally, Russian law enforcement makes a lot of money off of the country’s massive drug trade, so they are often hesitant to interfere. In the case of Hydra, a conspicuous exception was the assassination of Ministry of Internal Affairs investigator Evgenia Shishkina in 2018, which was ordered on Hydra and resulted in jail time for several involved. 

But as for scrutiny of Hydra itself? It blew over, possibly due to Shishkina’s reputation as a rare honest cop. Russian police are notoriously corrupt, and Shishkina apparently did not get along with any of her colleagues. 

“Every now and then Russian police catch people placing what they call ‘the treasure,’” said Vlad Cuiujuclu, an investigator with Flashpoint. “But that’s about the extent of it. And those 'kladmen' are not the most important people, they’re basically just deliverymen.” 

It seems that as long as Hydra sticks to drugs, its higher-ups stay safe. This may well be why its terms of service are so adamant about what can and cannot be sold on the platform.

It is possible that law enforcement is just more comfortable with Hydra than other agents of drug distribution. The drug problems of the former USSR are famously widespread. Perched next to the porous borders of Central Asia and the world’s largest poppy fields, Russia is the world’s largest heroin market despite having only the ninth-largest population. By some estimates, 6% of the nation’s population is heroin-dependent, consuming 20% of the global supply.

While vendors on Hydra do sell heroin, fentanyl and various other opioids, they don’t seem to be that great of a proportion of total sales. Softer, lower-priority drugs are more prevalent. Hydra also has a fairly comprehensive testing regime for vendor products that may reduce accidental overdoses. 

This reporter could also find no sales of the more horrifying local synthetic opioids like krokodil, so named because it turns an addict’s skin scaly — like a crocodile. 

Hydra may also be keeping the heat off of itself by imposing strict limitations on the other wares that vendors are allowed to sell. There’s seemingly no pornography — despite leading drug vendors with names like Love Shop, GangBang, and BDSM. Child sexual abuse materials are banned, as are weapons, which are all items likely to attract more legal heat.

Looking westward?

A 2019 ICO threatened to change that, promising 700% returns over the first six months of the project. Citing closures of Dream Market and Hansa by U.S. and EU authorities, Hydra also promised to launch a competitor to private browser TOR, whose original funding from the U.S. military has long been a subject of suspicion.

That $147 million ICO, however, never materialized. Today, the original announcement “to investors” has been replaced by the following:

At the time, many called this the most illegal ICO of 2019. It is highly questionable whether Hydra ever really intended to follow through with that ICO and move west. 

As Hydra’s operators were almost certainly aware, EU police would have reacted forcefully. “For their own safety they’re better off just keeping it to Russia and the former Soviet Union,” said Cuiujuclu.

“Law enforcement from the US and EU are generally the ones to go after darknet markets all over the world,” said Ciphertrace’s Pamela Clegg.

Still, the West has recently gotten more interested in Russia’s internal ecosystem of cybercrime. President Biden has taken to making Russia’s cybergangs a central topic in all interactions with President Putin. Putin, for his part, says that while his side is ready to partake in “joint deterrence of criminal phenomena in information space,” U.S. agencies have not contacted their Russian counterparts.

The former USSR in general and Russia in particular have been tough nuts for western law enforcement to crack. The absence of extradition treaties and agnosticism towards the reign of the Five Eyes — a global alliance that emerged during the Cold War to gather communications for espionage  — prevail. But in theory, Russia itself would have the most incentive to go after Hydra.

Big fish eat the little ones

Russian law enforcement may have bigger fish to fry than a dark market for lower-priority drugs.  But Hydra’s brazenness has led many to believe that it must be connected to major figures in the regime. 

“With Hydra it’s been really stable for the past six years, without any attempted takedown whatsoever, which makes us think that Russian officials or someone high up in the Russian government has their own interest in this,” said Cuiujuclu.

But Russian authorities have previously intervened to take down another dark market. Hydra’s nearest predecessor was RAMP, or the “Russian Anonymous Marketplace.” The Ministry of Internal Affairs announced its closure in 2017.

If the capabilities exist to end a similar business, is corruption protecting Hydra? 

“Most likely, there’s corruption involved,” said Clegg. “But also, our information shows that it wasn’t so much Russian law enforcement that closed down RAMP.” An investigation into darknets from Russian news outlet Lenta found that part of RAMP’s closure was due to a DDoS attack — from who else but Hydra.

Likely nothing aided Hydra’s rise more than RAMP’s fall. 

This is how the global market of darknet marketplaces works, generally. Different entities are at digital war with each other. Hydra in its early years ran successful marketing campaigns to entice users and vendors in tandem with cyberattacks on competitors. 

“Hydra has been very strategic. It’s been run very much like a successful business, the way they monopolized the market. They went after the competition,” said Clegg.

And Hydra has been hit back. As recently as February a hacker tried doxxing two alleged Hydra developers. 

But Hydra carries on. For all its newfangled anonymizing technology, Hydra’s success resembles more traditional organized crime. 

In this day and age, Western audiences are accustomed to seeing Russian corruption as a phenomenon that emanates from the Putin regime. While sometimes true, it’s a radical oversimplification often made to facilitate foreign policy objectives. 

The truth is, Russian organized crime is a long proud tradition that has outlived national leaders both gormless and tyrannical. It often depends on pretty small players. 

“Konyuktura,” one anonymous source called the corrupt ecosystem that sustains Hydra. Difficult to translate, the word refers to a complex system of interlocking parts. It’s an apt description of Hydra’s dependence on corrupt low-level officials.

Impact of the US?

At the end of the day, Hydra is huge and its ability to survive fairly openly is fairly unprecedented. Could that change now that Western nations, led by the U.S., have started to spotlight Russian’s cybercrime industry?  

Well, maybe. It’s not impossible. But the Biden administration has yet to follow through — at least publicly — with any of its promised “consequences” against the Putin regime. While some are reporting that REvil has gone offline, these "gangs" are fairly amorphous and well equipped to shed digital skins only to re-emerge. 

The White House already put out a new round of sanctions against Russian cyber actors and sovereign debt in April, a response both to the SolarWinds espionage and military forces amassing at the Ukrainian border at the time. Russian commentators have largely given up on the idea that there is any path back to the U.S.’s good graces. 

New sanctions could perhaps target the sorts of payment rails that Hydra connects with so freely, denying ransomware groups the ability to render their BTC dark by converting to fiat. But Russian payment services have already largely been cut off from the U.S. system, so they have limited incentive to change their ways to woo that system back. 

Moreover, legislation is in motion in the Russian Duma that outlaws financial services providers from blocking transactions based on U.S. sanctions.

But more interesting than political machinations is this: Part of why Hydra figures so largely in assessments of the darknet may well be that it can operate so openly. This includes dealing almost exclusively in Bitcoin, the cryptocurrency for which forensic analytics have built out the best capabilities. It also includes being relatively easy to find and access.

The fact that Hydra exists so openly suggests that the ecosystem that sustains is far bigger than anyone is publicly admitting.