Lessons from the World’s Largest Darknet Marketplace: HYDRA, Part 1

Author: Death Star
Date: November 22, 2023

Introduction

This is an original translation of a foreign scientific study on the HYDRA darknet marketplace and its operations.
Authors: phØBoŠ & hŮmAnǿ1Đ

Brief Overview of the Study

We present a comprehensive description of HYDRA, the world’s largest darknet marketplace, and its operations up until its closure in April 2022. We detail HYDRA’s main features, such as its dead drop delivery system, review and reputation mechanisms, escrow, and dispute resolution process. Using data from the marketplace itself, we quantitatively analyze the scale and structure of this highly competitive market. HYDRA covered at least 69% of Russia’s population geographically and offered a wide range of psychoactive substances (PAS), as well as wholesale trade opportunities for PAS and their precursors. From a drug business perspective, HYDRA’s dead drop system was costly, as courier expenses made up a significant portion of the final retail price. This work contributes to the study of all darknet marketplaces dealing in PAS by examining an unprecedentedly large non-Western market that existed much longer than any other known darknet market.

Political Implications

The HYDRA phenomenon demonstrates that policies aimed at shutting down darknet marketplaces have a significant impact and indirectly reshape the overall drug market. Without such policies, widespread digitalization of drug trafficking could occur. The main cost associated with allowing marketplaces to develop and grow is the likely increase in drug consumption due to the convenience of purchase and easier interactions between shops and suppliers. These costs must be weighed against potential benefits, including higher PAS quality, reduced potential violence, and incentives for self-regulation in a large market. The HYDRA case also highlights the need for specific financial regulations to limit the growth of darknet marketplaces.

Since the emergence of Silk Road in 2011, darknet marketplaces have become a new means of drug trafficking. The number of anonymous online drug markets has since increased, and online trade has become a common way to buy and sell illicit substances. Numerous studies have examined the organization of darknet marketplaces, including buyer-seller coordination and trust-building methods such as reviews, ratings, and escrow services. Research has also assessed how participants avoid law enforcement risks and the effects of marketplace shutdowns by authorities. One key finding is the resilience of online drug trade to law enforcement intervention: shutting down major vendors and marketplaces only leads to migration to other platforms. This has fueled debate about the effectiveness of primarily enforcement-based responses, such as prosecuting vendors and administrators where possible. Given limited resources for combating illegal drug use, policy inevitably involves trade-offs. Some scholars advocate for harm reduction approaches rather than criminalization and law enforcement, continuing a debate that began before online drug trade. However, most literature on the effects of shutting down darknet marketplaces focuses on Western experiences, lacking counterfactual analysis of what would happen without such policies, making it hard to fully assess their effectiveness.

This study fills that gap by examining a single, dominant drug market that existed for seven years in Russia, had no significant competitors, and was the world’s largest darknet marketplace. According to media investigations and other non-academic sources, before its closure in April 2022, most retail drug sales in Russia occurred via HYDRA. Unlike their Western counterparts, Russian law enforcement appeared not to make direct attempts to shut down HYDRA, despite regular arrests of low-level market participants like couriers. As a result, HYDRA lasted much longer than any other popular darknet marketplace, allowing it to become much larger than any market ever operating in the US or Western Europe. Over the years, HYDRA created an ecosystem enabling anonymous communication between all segments of the drug market, from wholesalers to end consumers. Although the marketplace served only the Russian-speaking world, its success offers valuable insights into the future of retail drug trade and the potential consequences of darknet marketplaces developing further in the coming years.

Our article describes HYDRA in two aspects. First, we provide a full description of HYDRA’s organization and the main services and mechanisms that contributed to its success. Operating on The Onion Router (Tor) network, HYDRA ensured participant anonymity, used cryptocurrency for payments, and dead drops for delivery. HYDRA also featured active self-regulation, advertising for individual vendors/shops, and a feedback system with reviews and ratings for products and sellers. Additionally, HYDRA had a dispute resolution system and special statuses like “trusted seller.” Finally, HYDRA attempted its own version of harm reduction strategies: selectively testing some substances for quality and providing medical consultations to clients.

Second, using data on listings and reviews from HYDRA, we examine the relative demand for different drugs, spatial and price variation in listings, and the composition and concentration of the drug market on the platform. In April 2020, we observed over 417,000 unique product pages across Russia and found that the most popular drugs were mephedrone (31%), cannabis (18%), amphetamine (13%), and alpha-PVP (12%). HYDRA operated in 1,129 different localities (cities, towns, rural areas) in all Russian regions, providing potential instant access to illegal drugs for 69% of the country’s population. In large cities, vendor concentration and product variety were higher. More expensive drugs were mainly distributed in wealthy areas, especially business districts. We also analyzed market concentration using the Herfindahl-Hirschman Index (HHI) and concluded that the online PAS market was extremely competitive overall and at the level of individual drugs and regions. We estimated a model to separate distribution costs from the retail price of PAS sold on HYDRA and found that the dead drop system is an expensive delivery method; for some PAS, distribution costs exceed 50% of the average dead drop price. Finally, we examined reviews, which, according to some data, were important for HYDRA buyers. We analyzed review texts and found that the language used reflects many aspects of consumer experience, while user ratings are generally less informative and skewed toward the maximum value of 10. Our results suggest that review text is likely what matters most.

We then analyze the policy implications of our findings. From its inception in 2015 until 2022, HYDRA was the dominant darknet platform in Russia and evolved into a complex platform. The main result of the closure policy pursued by most governments is that no large market like HYDRA has emerged in those countries. Thus, HYDRA allows us to better understand the benefits of this policy, serving as a counterfactual example of what could happen in its absence. We use our analysis of HYDRA to highlight several key components of the trade-off underlying closure policy. On one hand, an established market has incentives for self-regulation and creates conditions where sellers are interested in maintaining a good reputation, which can improve PAS quality and buyer welfare. Also, compared to in-person trade, online markets are associated with less violence inherent to drug trafficking. On the other hand, a large darknet marketplace is likely to increase both demand and supply of drugs due to convenience and reduced risks for buyers, as well as easier communication and trade among market agents. Once market participants move their operations online, they seem able to easily migrate to new platforms in case of any disruptions.

In Section 1, we review current research on darknet marketplaces trading PAS, consider HYDRA in this context, and discuss the history of online drug trade in Russia.
In Section 2, we provide a descriptive overview of the market’s organization, based on HYDRA’s rules, screenshots, and interviews.
In Section 3, we present quantitative analysis results based on listings and reviews from the platform.
In Section 4, we briefly describe the consequences of HYDRA’s closure.
In Section 5, we summarize the policy implications of our research.
Section 6 concludes our analysis.

1. Background

1.1. Darknet Marketplaces

Since Silk Road’s launch in 2011, the number of darknet marketplaces has grown rapidly, with an estimated 118 platforms specializing in black market goods by 2019. Today, darknet marketplaces are a major source of drugs for personal use and social supply. Online drug markets try to evade law enforcement by operating on the darknet and relying on cryptocurrencies like Bitcoin for transactions.

The required anonymity on darknet marketplaces creates a coordination problem among sellers, buyers, and site administrators. Research shows that to solve this, darknet marketplaces use formalized rules and centralized management. Trust is a key aspect: how can buyers be sure they’ll get quality goods for their money if they can’t rely on consumer protection or contract law in case of poor quality or fraud? Borrowing from legal online platforms, darknet marketplaces often use reputation systems based on seller reviews and ratings. Many platforms also use escrow services provided by administrators to help resolve disputes and increase trust in transactions. However, given that some darknet platforms have been involved in so-called exit scams (disappearing with users’ money), buyers are very sensitive to information about a platform’s stability and reputation.

The virtual nature of darknet marketplaces means market participants don’t need to meet in person. This shift can significantly reduce physical violence between competing drug sellers, which arises from the territorial approach typical of wholesale/intermediary markets. Buyers also report feeling safer compared to other forms of drug distribution. This matches trends seen in offline drug markets, where since the early 2000s, increased use of mobile phones for coordinating drug deals has made them less visible and reduced associated risks of violence. Some darknet marketplaces also promote harm reduction through forums where users discuss strategies for safer drug use and best practices. One qualitative study on changes in drug consumption patterns due to marketplaces found that with increased perceived accessibility, users tend to consume more during an initial “honeymoon” period, but later reduce use, buy smaller amounts, and generally control their consumption better.

Following a long tradition of enforcement-based responses to drug use, law enforcement has focused on various ways to disrupt darknet marketplaces, mainly by prosecuting major sellers and platform owners and shutting down sites. Hutchings and Holt describe key strategies for disrupting darknet markets. These include “marketplace poisoning”: reducing overall trust by using law enforcement agents to post fake low-rated reviews or pose as sellers. Other strategies involve traditional law enforcement responses, such as tightening banking regulations, prosecuting dealers and clients, and censoring sites by deregistering domains.

However, online trade in illegal goods, especially drugs, is surprisingly resilient to law enforcement intervention and shutdowns. Ouellet et al. (2022) examined the consequences of shutting down the DarkMarket marketplace in 2021, which specialized in data sales, and found that darknet markets are highly interconnected: after a major marketplace closes, sellers quickly migrate to similar platforms, leading to high substitutability. Similarly, Ladegaard (2019) showed crime displacement and market resilience after the closure of a major MDMA vendor operating on Silk Road 2, Evolution, and Agora. The study also showed that after Operation Onymous in November 2014, the number of active darknet marketplaces dropped from 19 to 12, but trade volume quickly recovered and exceeded pre-intervention levels within six months. Decary-Hetu and Giommoni (2017) found that participants quickly adapted and drug prices were unaffected.

Despite growing research, there are several major gaps in the literature. First, most studies focus on marketplaces popular in Western countries like the US, Canada, Western Europe, and Oceania. However, darknet drug trade is a global issue, and in recent years it has grown significantly in India and several Southeast Asian countries, including Indonesia, Thailand, and Vietnam. It’s important to understand the specifics of darknet marketplaces in other countries, given their large populations. Our article examines the dominant Russian darknet market, which also operated in several post-Soviet countries. We argue that despite differences in political systems, drug policy, and illegal market organization, the experience and response of non-Western countries to darknet marketplaces can be an important source of information for Western policy.

Second, most studied darknet marketplaces use legal postal services for delivery. While technological innovations aim to ensure anonymity and reduce legal risks, delivery remains a weak point, as law enforcement targets drug shipments. Western darknet users have used several methods to reduce postal delivery risks, such as choosing delivery locations away from home or work, rotating addresses, avoiding postal services requiring signatures, and even using real names to make packages look less suspicious. Another potential delivery method, not yet widely used in the West, is dead drop delivery. This method is much faster, as it doesn’t involve postal delays. We provide a detailed description of a darknet marketplace operating mainly through dead drops, which could become popular elsewhere as it allows for quick delivery without using legal postal services.

Third, most darknet marketplaces last less than a year due to police shutdowns or exit scams, with new markets quickly replacing closed ones. However, concluding that shutdowns have no effect overlooks an important impact: they prevent the emergence of a dominant marketplace. This work examines the counterfactual of what could happen if a single darknet marketplace is allowed to develop. This experience should give policymakers a fuller picture of the potential consequences of changing the current policy of routinely shutting down popular marketplaces.

1.2. HYDRA: The Largest Darknet Marketplace

Before the digitalization of the drug business in Russia, several significant trends were observed: a major increase in heroin use in the 1990s, a wave of desomorphine popularity in the 2000s, and a very high rate of HIV infection from injection drug use. Russia’s official drug policy is focused on criminalization, and harm reduction services are extremely limited. For example, the Russian government has gradually tightened rules on publishing information about illegal drug use online. Over the past decade, Russia’s drug market has seen steady growth in darknet drug sales. The first major platform in Russia was RAMP, launched in 2012. Besides RAMP, several darknet forums were used for drug trade, with the most popular being RuTor, LegalRC, and WayAWay. In 2015, LegalRC and WayAWay jointly created HYDRA, which competed with RAMP until the latter was shut down by Russian police in September 2017. After that, HYDRA was able to develop without significant competition. HYDRA’s dominance was actively maintained through restrictions, such as forcing vendors not to work on competing platforms. HYDRA’s role in the Russian drug market was partially acknowledged by the government when it was discussed in the State Duma in 2019. However, we are not aware of any attempts by Russian law enforcement to shut down the platform. HYDRA was eventually closed thanks to intervention by the US and German governments, as detailed in Section 4.

Because HYDRA lasted for seven years, it was able to grow to unprecedented scale. According to the US government, from January 2016 to March 2022, HYDRA processed over $5 billion in illegal transactions, with about 80% of all darknet cryptocurrency transactions in 2021 occurring on HYDRA. Similarly, Chainalysis estimated HYDRA’s share of global darknet market revenue at 75% in 2020. The scale of the “three-headed” marketplace meant it had a significant impact on the entire cryptocurrency market: consumer transactions using HYDRA made up a large share of some crypto exchanges’ revenue.

The US Department of Justice (United States v. Pavlov, 2022) called HYDRA “the largest and longest-running darknet market in the world.” Table 1 shows revenue estimates from various studies, confirming that HYDRA’s figures far exceed those of other platforms. We conclude that at the time of writing, HYDRA was the largest marketplace ever to exist.

TABLE 1. Annual revenue estimates from previous studies.

However, Russia lacks comprehensive studies on drug consumption that would allow for an accurate assessment of HYDRA’s market share compared to traditional street trade. For quantitative analysis, we conducted interviews with harm reduction activists and investigative journalists who studied HYDRA (see Section 2 for details). Our informants confirmed that HYDRA was a common way to buy drugs in Russia, likely the most popular in densely populated regions like Moscow and St. Petersburg. They also noted the existence of other online drug platforms, such as individual shops operating via Telegram groups and bots, but these were less popular and focused on local sales. A small portion of drug trade continued offline, especially among marijuana growers and economically disadvantaged opiate users without internet access. Overall, all informants agreed that HYDRA was the most popular way to buy drugs illegally, at least in Moscow, St. Petersburg, and other major Russian cities.

HYDRA’s key difference from its Western counterparts is that it operated for a long time without law enforcement intervention. HYDRA lasted seven years and was the dominant darknet marketplace in Russia for most of that time. Compared to other popular darknet markets, which rarely lasted even a year, HYDRA was able to develop and dominate the Russian drug market to an unprecedented degree. It developed a complex organization and structure, established rules and norms for vendors and buyers, implemented quality control mechanisms, and organized its own escrow service.

Like other marketplaces, HYDRA also facilitated the sale of other illegal and “gray” goods (fake passports, forged documents, counterfeit money, SIM cards, etc.) and services (graphic design for new shops, use of private databases to find personal information, etc.). However, according to our informants, these made up a much smaller share of operations than drugs. This suggests that HYDRA was primarily a drug market, as is the case for many Western markets. The scope of illegal business was limited by the platform itself, which explicitly banned the sale of weapons, poisons, contract killings, explosives, state secrets, and pornography. Particularly dangerous drugs like fentanyl and its derivatives were also banned.

HYDRA’s distinguishing feature compared to popular US and European darknet marketplaces is its delivery method. Most platforms use postal shipping, relying on mail or legal couriers to send disguised drugs. Postal delivery was once popular in Russia, but a 2014 law requiring postal services to check packages for illegal substances made this method less attractive. As a result, HYDRA, like its Russian predecessor RAMP, used a dead drop system. Couriers hired by vendors hid drugs around the city before the deal. The vendor then listed the type, quantity, approximate location, and price on HYDRA’s website.

2. Marketplace Organization

2.1 Methods

Unless otherwise noted, our qualitative description of the marketplace is based on three sources. First, we accessed a set of screenshots from the site illustrating its main functionality. Second, we studied HYDRA’s rules and guides for buyers and sellers, which were available on the site and contained extensive information about how the marketplace worked (see Figure 1). Third, we conducted four interviews with harm reduction activists and investigative journalists who studied HYDRA. To support our quantitative findings and better understand the context of online and offline drug trade in Russia, we interviewed experts in Russian drug use. One informant worked for a Russian harm reduction NGO, and the other three were Russian investigative journalists covering illegal drug trade. We began by contacting authors of media publications on online drug trade in Russia. After each interview, we asked for contacts of other potential experts.

Figure 1. Storefront of a HYDRA shop (2022)

Interviews were conducted via video call from March to May 2022 by two co-authors in Russian, each lasting 1–2 hours. We did not record the interviews due to understandable concerns and the sensitive nature of the topic, but each interviewer took notes. After each interview, we discussed new information and added relevant context to this work. Interviews were semi-structured. Before each interview, we prepared a list of questions on topics such as the overall structure of the Russian drug market, HYDRA’s popularity, and various aspects of HYDRA’s operation. Some sample questions:

• How do people usually buy drugs in Russia?
• How popular is online drug trade, especially HYDRA, compared to offline markets like street dealing?
• Which drugs are most popular in Russia?
• How do buyer groups differ depending on the type of PAS sold?
• What is the organizational structure of HYDRA and its vendors?

Depending on the informant’s experience and the interview flow, we asked additional questions. Together, these interviews helped us gather more information about illegal drug trade and HYDRA’s role. We also acknowledge that some informants’ backgrounds may have influenced their views. Since interviews were used solely to support quantitative results, we leave critical analysis outside the scope of this work. However, as we base some findings on interview data, we note that this approach imposes certain limitations on our analysis.

2.2 Consumers

Like other popular darknet marketplaces, HYDRA was accessible via the Tor network using the Tor Browser. After creating an anonymous profile, users could browse the site and filter available products by drug type, shop, location, price, and desired weight. Many listings included reviews from other buyers, rating product quality and sharing their experiences.

Once a buyer chose a product, payment was made using Bitcoin. Typically, buyers had two options for adding Bitcoin to the platform. One was to purchase Bitcoin externally and transfer it to the wallet address listed in their account. The other was to use a QIWI wallet, a payment service from the Russian company QIWI. Since QIWI has ATM-like terminals across Russia, clients could deposit cash and exchange it for Bitcoin using one of many crypto exchange services operating on HYDRA. As no ID was required to use the terminals, this method provided sufficient anonymity. To our knowledge, these terminals played a crucial role in HYDRA’s popularity by making anonymous crypto purchases much easier. This is confirmed by the HYDRA user guide, which included several pages of detailed instructions for using QIWI terminals. After purchase, HYDRA provided escrow service, holding funds until the deal was confirmed as complete.

After payment, the buyer received detailed information about the dead drop location, including photos and GPS coordinates. Thus, no physical contact between seller and buyer was required. Moreover, communication was isolated to the Tor site. Payment was also anonymous if the buyer used external Bitcoin or deposited cash via QIWI terminal.

The main communication channel between buyer and seller was HYDRA’s encrypted chat system. While market participants could theoretically use other means, the platform aggressively prohibited this. Rules imposed heavy fines (up to 2 BTC) for vendors trying to contact buyers outside HYDRA, and rewards for buyers who reported such attempts.

2.3 Delivery

Unlike most darknet marketplaces, HYDRA mainly used a dead drop system: drugs were hidden in advance, and buyers could see their type, quantity, and approximate location in a given area. After payment, the buyer received exact details needed to retrieve the product. Four methods were used to hide packages: “magnet,” “buried,” “snow buried,” and “stash.” The first involved attaching a magnet to the package and sticking it to something like the inside of a drainpipe, a transformer box, or a metal fence. The second and third involved burying the package in soil or snow, usually in a park or green area. Finally, a stash could simply be hidden in a place unlikely to be found by accident (e.g., an apartment building attic).

As on other marketplaces, some products could be delivered by mail, mainly for drugs like LSD that are especially hard for law enforcement to intercept. Many products could also be pre-ordered, meaning the dead drop was made specifically for the client after payment. Pre-orders were mainly used for wholesale deals or exotic drugs.

Because communication between HYDRA administrators, vendors, couriers, and buyers was remote and anonymous, the market reduced many legal risks associated with drug deals. However, couriers and consumers were at risk of being caught by law enforcement when placing or retrieving dead drops. Activities like digging in parks or searching apartment courtyards became signs that someone was likely looking for drugs and attracted a lot of attention.

To be continued…