Dark web cybercrime economy shows significant growth and structural shifts

The dark web has evolved into a sophisticated component of the global cybercrime economy, facilitating the movement of stolen credentials, malware services, and illicit goods. Recent data highlights the scale of this ecosystem: Chainalysis estimated that darknet markets received nearly $2.6 billion in cryptocurrency during 2025, while CRIF reported over 2.2 million dark-web data-exposure alerts in the same year.

Recent trends in July 2026 indicate significant infrastructure shifts and leadership changes among major underground platforms. RaidForums transitioned to a new domain and launched a Ransomware-as-a-Service (RaaS) section, signaling deeper integration between data leak forums and ransomware operations. Additionally, BreachForums announced a change in leadership following the retirement of operator HasanBroker, and a website claiming to be LAPSUS$ declared a permanent cessation of activities.

Other notable developments include the beta launch of the Leaked forum and a seizure banner appearing on the Sevyware ransomware leak site, though official confirmation of the latter is pending. These shifts reflect a continuous cycle of platform emergence, reorganization, and law enforcement disruption within the dark web landscape.