How darknet actors migrated from IRC forums to Telegram networks in 2025. Case studies, takedowns, and evolving criminal communication tools.

U.S. law enforcement agencies, with the help of international colleagues, have shut down the Chinese exchange Bitzlato Limited and arrested its entire top management.

Bitzlato Limited was established in 2016, and its founder is Anatoly Legkodymov, who is a citizen of the Russian Federation. From the first day of its operation, the exchange attracted a large number of people who were not entirely legitimate business, and this was facilitated by the company’s policy and lack of control over “dirty” money. First of all, the exchange attracted the attention of various criminals, and most of all it attracted the attention of users of “dark” Internet markets.

The investigation showed that most of the Bitzlato exchange users were also active users of Hydra Market. Customers and sellers from the Hydra resource immediately fell in love with the Chinese exchange because they did not have any questions about the legality of their finances when making illegal transactions through it. The blockchain analysis showed that in the period from May 2018 to April 2022, about $300 million was credited to Bitzlato accounts from Hydra users. Also, more than $200 million was sent to Hydra accounts from the exchange. Also, thanks to the analysis, it became known that almost $20 million was transferred to the exchange’s accounts from accounts that were used for ransomware crimes.

If you think that Bitzlato employees somehow fought against illegal transactions, you are mistaken. Exchange employees sometimes blocked users who were suspected of illegal activity, but in most cases they themselves deliberately helped to transfer money to Hydra accounts. The analysis of exchange users’ correspondence with the support service showed that the employees directly answered that funds from the exchange could be transferred to any address, regardless of the purpose of the transactions. The employees of the exchange were well aware that most of their customers used accounts registered under other names to make purchases on Hydra Market, and even knowing all the schemes of transferring funds, they did not react in any way.

The marketing director of the exchange prepared a report titled “Competitor Analysis” in which he pointed out that the rejection of illegal money transfers would hit the company’s finances, and he also highlighted the disadvantages of the exchange, which he attributed to “a large number of fraudsters among the users of the resource” and “a large amount of dirty money on the company’s accounts”.

Despite the fact that the exchange was not officially registered in the United States, it advertised its services among clients of the American market. As it later became known, about 1.5 thousand US clients transferred more than USD 2 million to Bitzlato’s account.

The founder of the exchange did not even worry about being held accountable for his activities. As of October 2022, he was living in Miami, from where he had unimpeded access to the exchange’s servers. It all ended on January 17, 2023, when US law enforcement agencies in partnership with several European countries arrested Legkodymov and confiscated all of his company’s cryptocurrency assets.

A district court in Moscow has arrested a man whom local media reports identify as Dmitry Pavlov, alleged administrator of the recently shut down darknet market Hydra. Russian authorities believe he has been involved in drug-related crime punishable by up to 20 years in prison.

Moscow Court Arrests Russian Believed to Be Hydra Administrator

Meshchansky District Court of Moscow has taken into custody a certain Dmitry Olegovich Pavlov accused of production, sale, and distribution of drugs under Russia’s Criminal Code, the “Moscow” City News Agency reported this week, quoting the court’s press service.

Pavlov, who was arrested on Monday, April 11, has the same names as a 30-year-old Russian citizen and resident charged for similar offenses in relation to his alleged role as an administrator of the recently busted Hydra Market, one of the largest marketplaces on the darknet.

Earlier this month, German law enforcement seized Hydra’s server infrastructure in the country and took down the Russian-language platform’s website. The operation was carried with support from several U.S. agencies.

On April 5, the U.S. Department of Justice announced criminal charges against Dmitry Pavlov for conspiracy to distribute narcotics and conspiracy to commit money laundering. According to an indictment filed with the U.S. District Court for the Northern District of California, the Russian is also accused of administering and providing hosting services to Hydra.

The Russian business daily Kommersant quoted Pavlov telling the BBC on April 6 he had not been contacted by U.S. authorities and that he learned about the charges from the media. He also insisted his company had all the necessary licenses from Roskomnadzor, Russia’s communications watchdog, and was not administering any websites but only leasing servers as an intermediary.

The United States has been alleging the Russian Federation’s involvement with crypto-related criminal organizations, including darknet markets (DNMs) and ransomware actors. In September, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned the Russia-based crypto broker Suex, believed to have received more than $20 million from DNMs like Hydra.

The department also imposed sanctions on Hydra itself — which had been active since at least 2015 and had around 17 million customers before it was shut down — and on a cryptocurrency exchange called Garantex, suspected of processing over $2.6 million in transactions from the darknet market platform.

Do you expect other arrests in Russia in connection with the Hydra case? Tell us in the comments section below.

Law enforcement agencies in Germany have targeted Hydra, a leading darknet market (DNM). As part of an operation conducted with U.S. support, the German police were able to establish control over the servers of the Russian-language platform in the country and take down its website.

Investigators Hit Hydra in Germany, Confiscate Millions in Crypto

Hydra Market, one of the largest marketplaces on the darknet, has been shut down by German authorities which seized its server infrastructure. According to an announcement by the Federal Criminal Police Office (BKA), law enforcement agents also confiscated bitcoin worth around €23 million ($25 million). The following message appeared on Hydra’s website on Tuesday:

BKA carried out the raid together with the Central Office for Combating Cybercrime (ZIT) at the Public Prosecutor’s Office in Frankfurt which is leading the investigation against Hydra’s operators and administrators. They are wanted for running illegal online platforms facilitating the trade of drugs and money laundering.

The German police noted that Hydra had been active since at least 2015 before the seizures which came after extensive investigations by the BKA and ZIT. They started in August last year and were conducted with the participation of several U.S. agencies.

The darknet marketplace, which was accessible via the Tor network, was targeting Russian speakers. It had around 17 million customers and over 19,000 registered sellers, the press release detailed. Besides banned substances, these also offered stolen data, forged documents and digital services.

Hydra became a major darknet market after overtaking another Russian platform, DNM Ramp. According to the data compiled by the blockchain forensics company Chainalysis, the region of Eastern Europe sends more digital currency to darknet marketplaces than any other region.

Washington has been alleging Moscow’s involvement with malicious cyber actors like DNMs, ransomware groups and other crypto-related crime. In September, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned the Russia-based crypto broker Suex which is believed to have received more than $20 million from darknet markets like Hydra.

The Treasury Department has imposed sanctions against Hydra and a crypto exchange called Garantex. The trading platform, which has been operating mostly out of Russia, is suspected of processing over $100 million in transactions linked to illicit actors and darknet markets, including $2.6 million from Hydra.

Meanwhile, the U.S. Department of Justice announced criminal charges against a Russian resident, Dmitry Pavlov, for conspiracy to distribute narcotics and conspiracy to commit money laundering. The 30-year-old Pavlov is allegedly the administrator of Hydra Market’s servers.

German law enforcement officials think that Hydra was likely the darknet market with the highest turnover globally. BKA and ZIT have estimated that its sales reached at least €1.23 billion in 2020 alone. They also noted that the investigations were hampered by the platform’s own ‘Bitcoin Bank Mixer’ service.

Do you think other darknet markets will be targeted after Hydra? Let us know in the comments section below.