When the Markets Are Inaccessible: A Dark Web Drug Market Disruption Typology

Abstract

Dark web drug market participants (both buyers and vendors) face frequent disruptions that affect their access to marketplaces. While these disruptions vary in their duration and the actors involved, existing research has largely concentrated on closures by law enforcement. Recognising the broader range of disruptions experienced by participants is essential for understanding how dark web markets adapt and evolve. This paper presents a typology of dark web drug market disruptions, informed by the current literature, categorising disruptions along two key dimensions: the duration of the disruption (temporary versus permanent) and the actor involved (internal versus external) in the disruption. This typology provides a comprehensive framework for analysing how different forms of disruption may influence market participant decision-making processes and the resilience of illicit online drug markets. In doing so, the typology highlights how disruptions that differ in duration and origin may have varying implications for participant behaviour and market resilience.

1. Introduction

Since the emergence of dark web drug markets in 2010, they have become a persistent and global drug supply channel. The popularity of Silk Road and the high-profile law enforcement closure in 2013 marked the beginning of sustained marketplace closures and scholarly attention to these dark web drug markets (Barratt et al. 2013). Existing literature has largely focused on law enforcement disruption as the primary disruptive event in the dark web drug market ecosystem. However, evidence demonstrates that marketplace communities exhibit resilience, adapting to law enforcement shutdowns as well as to other disruptions that impede access (e.g., Bradley and Stringhini 2019; Van Buskirk et al. 2017b). This paper advances the literature by presenting a typology of dark web marketplace disruptions, synthesised from existing research, to better capture the range and consequences of these disruptive events. Sources were included if they directly addressed the nature or consequences of dark web marketplace disruptions. The empirical literature is prioritised throughout, with additional sources drawn upon only where necessary to ensure comprehensive coverage.

Dark web drug markets differ from other forms of online (surface web and social media) and offline drug exchanges in several ways. Firstly, a key difference is the anonymity provided through the technologies required to engage in these markets. This includes the browser (principally TOR, short for The Onion Router), which conceals the geographical location and identity of users. Secondly, payments are made using cryptocurrencies (e.g., such as Bitcoin and Monero), which offer another layer of anonymity to market participants. Uniquely, drug exchanges on dark web markets are generally facilitated by third-party administrators. Thirdly, operating similarly to other e-commerce platforms, such as eBay and Amazon, buyers and vendors can engage in transactions with others on a global scale. These platforms also offer protections such as escrow services. When a purchase is made on the dark web, the funds are held in escrow and will be released when the buyer indicates that the seller has met the terms of the sale (e.g., the product has arrived).

Despite the range of protections, the dark web market ecosystem is volatile and individual markets generally only operate for short periods of time. Marketplaces have an average lifespan of 8 months, and disruptions can be initiated by a range of actors through various means and for various reasons (European Monitoring Centre for Drugs and Drug Addiction and Europol 2017, 2019). Although law enforcement closures receive considerable media attention, a small percentage (17%) of dark web markets closed due to law enforcement and most closures are due to voluntary closures and exit scams (International Drug Policy Consortium 2018; Ladegaard 2020).

Research on the resilience of dark web drug markets has focused heavily on law enforcement closures and responses from the dark web community, reflecting a broader pattern in offline drug markets where enforcement-led disruption efforts are privileged (Blais et al. 2026). However, there are various reasons dark web marketplaces may be inaccessible, which have garnered limited attention. This paper aims to highlight the range of disruptions experienced by market participants to deepen the understanding of the resilience of these markets. This can help identify the similarities and differences between the various types of disruptions, which can allow for further exploration of these volatile platforms and a better understanding of the resilience of the dark web marketplace ecosystem. This can also illuminate some of the ways that characterise the dark web drug market compared to other drug supply channels. For example, the inaccessibility of dark web drug markets can come from internal actors such as marketplace administrators. The various market disruptions may reveal more about why people continue to participate in the markets despite their inaccessibility over various periods. Attention needs to be directed towards a range of other types of disruptions to accurately portray the experiences of market participants.

Understanding the variations in disruptions can provide a clearer understanding of the experiences of dark web market participants and the continuing presence of these markets within the wider drug markets. This article will address this in three ways. First, the term disruption is defined in the context of criminology and dark web drug markets. Second, the different types of dark web marketplace disruptions identified through empirical literature and examples of real events will be discussed. Thirdly, it presents a new way of understanding market disruptions through a typology.

2. Market Disruption Definition

In the current literature on the resilience of dark web drug markets there are inconsistencies in the terms used to describe disruptive events of marketplaces and the types of events that this term encompasses. These differences have emerged from fields of research beyond dark web drug markets. Within offline illegal drug markets research, the definition of an external shock refers to law enforcement closure as an event intended to obstruct the markets’ operations (Bouchard 2007). In their research on law enforcement operations of cybercrimes, Whelan et al. (2025) use the term to describe interventions that go beyond traditional operations of apprehension and arrests. Similarly, disruptions aimed at organised crime have been described as a tactic to create a hostile environment to impact their social and operational structures (Kirby and Penna 2013). These applications of the term focus on changes to the environment in which offenders operate to make offending more difficult and are operations used by law enforcement as crime prevention methods.

In the dark web market literature, the term “disruption” generally refers to market closures due to law enforcement interventions (Ouellet et al. 2022; Waldner and Moeller 2024; Whelan et al. 2025). Both Ouellet et al. (2022) and Waldner and Moeller (2024) used the term to refer to the closure of a marketplace (DarkMarket and Flugsvamp 4.0, respectively) by law enforcement. Whelan et al. (2025) used the term to encompass several activities by law enforcement in changing the behaviour of market participants. Disruption was centred around present offending rather than prosecution or preventing future offending. However, Duxbury and Haynie (2018) also referred to “disruption” as arrests of key actors in a dark web market when examining the network structure. Although it is often used to discuss law enforcement operations, it has also been used to describe exit scams (Van Buskirk et al. 2017b).

For this paper, we will build on these definitions by concentrating on the change of environment as a disruption. The term “market disruption” will be used to refer to events that change the accessibility for marketplace participants to take part in their preferred marketplace. This encompasses a range of temporary (Hacks/Distributed Denial of Service [DDOS] attacks and service updates) and permanent (law enforcement closure, voluntary closure and exit scams) market disruptions, which will be discussed in further detail throughout this paper.

3. Types of Market Disruptions in Dark Web Drug Markets

In the current dark web market literature, some authors have discussed different types of market disruptions. Ladegaard (2020) tangentially mentioned that markets were closed due to four main reasons: voluntary closures, exit scams, law enforcement closures and hackings. More recently, Wang et al. (2023) discussed three reasons for market closures: voluntary closures, exit scams and law enforcement closures. This paper will take the same approach and focus on the three most common reasons for market closures. However, it is proposed that in addition to permanent closures, temporary events that impact access to a dark web marketplace for short periods, in the form of hacks (including DDoS attacks) and service updates, should be recognised within the literature. Arguably, temporary disruptions can lead to similar disruptions to access and the subsequent movement of participants.

During both permanent and short-term market disruptions, vendors and buyers need to make decisions about engaging in other available marketplaces. However, during temporary closures, market participants may choose to wait until the marketplace is available again, instead of using other marketplaces. Thus, including short-term market disruptions can provide a new perspective on our current understanding of deterrence and displacement in this field.

Informed by these expanded definitions of market disruptions, this paper will discuss five different types of dark web drug market disruptions (law enforcement closures, exit scams, voluntary closures, hacks and DDoS attacks, and service updates). In discussing these market disruptions, the current knowledge on the events’ impacts on market participants and the resilience of the dark web drug marketplaces will be highlighted.

3.1. Law Enforcement Closure

Efforts by law enforcement to take down dark web markets have been the focus of most studies. Specifically, a significant proportion of the current literature on dark web markets has examined the impact of law enforcement closures and interventions on the dark web drug market ecosystem. These closures are often discussed with particular attention given to the deterrence and displacement of market participants.

Several studies provide evidence on the lack of deterrence as market participants move between marketplaces as a result of dark web market closures. Although law enforcement crackdowns are designed to deter offenders, they only do so for a short period of time and are largely ineffective in the long term. Indeed, even though closures have been observed to be followed by a significant drop in transactions and registration of new vendors, transactions and registrations will eventually rise to similar levels in the following months on other markets (Décary-Hétu and Giommoni 2016; Ladegaard 2019a; Soska and Christin 2015; Van Buskirk et al. 2017a). When examining Operation Onymous (which included the closure of a few dark web markets including Silk Road), Décary-Hétu and Giommoni (2016) found that many vendors on dark web markets shut down by law enforcement did not move to other markets.

In contrast, Soska and Christin (2015) identified that vendors moved to other markets following Operation Onymous. Similarly, Ladegaard (2019a) found that around half of MDMA vendors relocated to other markets to continue trading following the closure of Silk Road 2. Moreover, the permanent closure of these markets usually results in displacement to other active markets (e.g., Ladegaard 2020). For example, Abacus Market recently doubled its revenue following the closure of ASAP Market, which was the dominant market at the time (Chainalysis 2025). Van Buskirk et al. (2017a) observed listings on dark web markets and found short reductions in listings before recovery, which often exceeded previous numbers.

The relocation of market participants and the resilience of the markets may be partly attributed to the ease of moving to different markets. Dark web drug marketplaces generally have very similar structures, meaning there is little to learn to engage in new markets. For vendors who have chosen to move to other markets there may be few barriers to success, particularly for those vendors who choose to maintain their identity while moving between marketplaces as reputation history provides an advantage (Norbutas et al. 2020).

Media attention surrounding major marketplace closures may help drive the growth of new marketplaces. For example, Ladegaard (2019b) found that following media coverage of one law enforcement closure and the conviction of a major market founder, there was an increase in trade on markets. However, this may also be due to the popularity of dark web markets increasing during the period of data collection.

Barratt et al. (2016) found that participants were less comfortable using dark web markets following closures, but only a small minority of market participants had identified an intention to stop using the markets (Bradley and Stringhini 2019; Décary-Hétu et al. 2023). Bradley and Stringhini (2019) found that around 25% of forum posts indicated that they would stop trading. Analysis of forum posts following a law enforcement closure found 9% of posts referred to deterrence, while 33% of posts were on displacement (Décary-Hétu et al. 2023). They also found that some marketplace users shared their intentions to take a break, ranging from a few weeks to 8 months. However, this could also coincide with purchasing patterns. For instance, people may purchase drugs in bulk, choose to purchase through other means (i.e., offline) (Moeller et al. 2017), or are going through an initial ‘honeymoon’ period when first entering these markets and then reducing their purchases over time (Barratt et al. 2016). These studies of forum discussions demonstrate the intentions of market participants to discontinue trading for various amounts of time.

In addition to topics of deterrence, communities also discussed their emotional reactions to law enforcement closures in forums. This highlights the role of the community during disruptions. For instance, Ladegaard (2019b) examined the responses of market participants following the closure of Silk Road. They found the closure produced solidarity between the community members and enabled them to move to new platforms. Similarly, a recent study by Décary-Hétu et al. (2023) which analysed forum posts following law enforcement disruptions found that in 37% of posts, behavioural responses (deterrence and displacement) were discussed, while in 48% of posts, mental responses (negative emotions, risk perceptions and trust) were discussed by participants. In these, many forum users expressed worry, anxiety and paranoia in response to a law enforcement closure. Users were also reminded of the risks of engaging in this environment and disclosed trust issues following the disruption.

Unsurprisingly, research has found forum discussions following closures often focus on which marketplace to move to (Bradley and Stringhini 2019; Décary-Hétu et al. 2023). Moreover, the dark web market community is “herd-like” (Moeller et al. 2017, p. 1434). Waldner and Moeller (2024) found that respected and established vendors moved quickly following law enforcement closure and were followed by other vendors. They suggested this may be due to larger vendors with larger economic investments evaluating potential markets thoroughly prior to moving, which other vendors trust. Ouellet et al. (2022) observed a similar displacement pattern in stolen data dark web markets following law enforcement closures, where vendors were more likely to move to marketplaces where their peers had moved to.

In addition to spatial displacement, there is also evidence of tactical displacement such as amendments to operational security (OPSEC) which contribute to the resilience of the dark web ecosystem (Barratt et al. 2016; Bradley and Stringhini 2019; Décary-Hétu et al. 2023). Operational security refers to the personal and technological safety strategies implemented by buyers and sellers in illicit digital environments to mitigate risks from law enforcement. Barratt et al. (2016) found that after the closure of Silk Road participants implemented greater security protocols, such as only using public Wi-Fi networks and avoiding international shipments. Bradley and Stringhini (2019) and Décary-Hétu et al. (2023) focused on more recent law enforcement closures and identified different forms of tactical displacement, such as purchasing smaller quantities, off-platform direct dealing (also see Childs et al. 2020), moving to other services and cryptocurrencies (e.g., Monero, i2P). Soska and Christin (2015) also observed a greater adoption of PGP (Pretty Good Privacy) keys following a law enforcement closure. PGP is an encryption method that provides cryptographic privacy and authenticity, ensuring that only the intended recipient can read the contents. These tactics demonstrate how dark web market participants adapt to technological advancements and market disruptions.

3.2. Exit Scams

Exit scams are closures initiated by the market administrators, unlike law enforcement closures. Exit scams occur when market administrators close a market without prior notice and take any funds held in escrow accounts for ongoing transactions between vendors and buyers (Moeller et al. 2017). Various exit scams have occurred in the dark web market ecosystem including marketplaces such as Evolution in 2015 and Wall Street Market in 2019. Exit scams are often a time of uncertainty resulting in marketplace participants often speculating on the state of the market in forums (Bradley and Stringhini 2019).

While risks such as exit scams are recognised as part of engaging in these markets (Martin et al. 2020), there are only a few studies on the impact of exit scams on the dark web market ecosystem. Howell et al. (2022) provide insights into how participants in one market reacted to a potential exit scam. This quasi-experimental study, in which a warning message from the market administrators about a former market administrator’s intention to scam market participants was posted, revealed that there was a reduction in vendors listing items, buyers’ spending and transactions on that specific site in the month following the message. Although this supports the idea that market participants will avoid taking risks on that specific platform, it is unknown whether market participants moved to other marketplaces or if they stopped using dark web markets completely. Similarly, the Evolution exit scam resulted in negative reactions from marketplace participants, including doxing (revealing one’s identifying information) attempts of the administrators and threats of violence (Tzanetakis et al. 2016).

Bradley and Stringhini (2019) compared a regular law enforcement closure to a law enforcement intervention masked as an exit scam. In Operation Bayonet, the FBI closed Alphabay but initially did not take responsibility for the closure. This study found the combination of Operation Bayonet and the law enforcement closure of Hansa generated more discussion about the market disruption in comparison to Operation Hyperion (“name and shame” operation by directly contacting market participants). There was also a greater concern with many participants discussing taking a break or stopping trade. This may be an indication of the ways in which different marketplace closures are perceived. For example, market participants may feel greater betrayal from closures by ‘one of their own’ as opposed to law enforcement, which is to be expected.

These studies showcased the reluctance of market participants to engage in platforms suspected of being exit scams and dark web markets more broadly during this type of market disruption.

3.3. Voluntary Closure

Similar to exit scams, voluntary closures involve marketplace administrators closing their market. However, this involves the administration informing marketplace users of this closure to allow for current orders to be completed and users to take their funds out of their accounts. Several voluntary closures have occurred in the dark web market ecosystem including the closure of Cryptonia and White House Market (Wang et al. 2023). Wang et al. (2023) examined the voluntary closures in their study of market closures through web scraping. Using vendor listings and number of sales, the authors concluded that participants move to other marketplaces following voluntary closures. Similarly, Broadhurst et al. (2021) examined unique vendors and found voluntary closures (and exit scams) to only have a small impact on the reduction of opioid availability compared to law enforcement closures.

Voluntary closures are generally only mentioned briefly within the literature. It is currently unknown how market participants are perceiving these closures, particularly in comparison to other market disruptions. These closures may be perceived less negatively than other marketplace disruptions, which may result in more displacement to other marketplaces. Participants may be less fearful of risks from law enforcement and malicious market administrators (i.e., those engaging in exit scams).

Law enforcement closures, exit scams and voluntary closures constitute permanent marketplace closures. However, not all closures are final. There are also several forms of temporary disruptions that do not result in the end of a marketplace. These less permanent closure types are explored in detail in the section below.

3.4. Hacks and DDoS Attacks

Hacks and DDoS attacks in dark web marketplaces are malicious activities aimed at disrupting the accessibility of the platform by marketplace participants (Moeller et al. 2017). In these attacks, actors deploy various techniques to overwhelm a targeted marketplace’s servers or network infrastructure, rendering it temporarily or indefinitely inaccessible to its users (Bradley 2019). The actors behind these attacks can vary, including marketplace competitors trying to gain customers on their own platforms and for the purpose of extortion, or possibly law enforcement as a preventative tool (Moeller et al. 2017; Holt 2018).

One notable example of a DDoS attack is the 2019 attack on Dream Market which persisted for seven weeks (Power 2019). Hackers held the site for a ransom of $400,000, which the administrators refused to pay. This was followed by an announcement by Dream Market administrators to close the market. However, there were suspicions by marketplace participants that Dream Market was taken over by law enforcement and would be monitored due to the lack of a PGP signature in the announcement. Dream Market is not only an example of how a DDoS attack may occur in this dark web ecosystem but also demonstrates how a market disruption event can develop from one type of disruption to another. Although these disruptions are occurring in the dark web market ecosystem, there is no research examining how this impacts the dark web market ecosystem and its participants.

3.5. Service Updates

Although there are minimal discussions of service updates within current dark web literature, this is a form of disruption that can occur. An example is BlackBank in 2015, where market administrators announced the brief closure citing security upgrades before coming back online (DeepDotWeb 2015). These generally last for short periods of time while the market administrators update systems to improve the marketplaces. This type of disruption may be perceived well by market participants as it demonstrates how the marketplace is continually improving for their use.

4. Typology of Dark Web Drug Market Disruptions

In existing literature dark web markets have been described as volatile and resilient without adequately distinguishing or organising the range of events disrupting the marketplaces. This gap is addressed in this paper by bringing the current knowledge into a conceptual framework. The developed typology based on the duration and origin of the disruption is discussed in the following section (Table 1). The first dimension depicts the dichotomy of disruption duration: temporary and permanent market disruption. The second dimension represents the origin or source of the disruption: internal and external. These dimensions provide a structured way to classify and compare market disruptions.

Table 1. Types of Dark Web Illicit Drug Market Disruptions.

		Duration
		Permanent	Temporary
Origin	Internal	Voluntary Closure Exit Scam	Service Updates
	External	Law Enforcement Closure	DDoS Attack/Hack

DDoS: Distributed Denial-of Service.

4.1. Temporary vs. Permanent (Duration)

Market disruptions can vary in their duration of closure. Dark web markets can be temporarily disrupted. During temporary disruptions, market participants (vendors and buyers) may choose to access other sites instead or refrain from engaging in the markets completely. Following the disruption the vendors and buyers can, if they wish to, return to the market. In contrast, permanent disruptions are events in which marketplaces are permanently closed. Following the closure, the vendors and buyers may move to other markets to continue engaging in the dark web market ecosystem, opt for other methods of selling or buying drugs (e.g., offline, social media), or stop participating in transactions altogether. However, at certain times, marketplace participants may be unsure about whether a closure is temporary or permanent (Bradley and Stringhini 2019).

It is important to distinguish between temporary and permanent marketplace closures as these may result in different reactions from market participants. For instance, temporary disruptions may be interpreted by participants as an inconvenience and routine feature of a volatile environment, and therefore may not change their behaviours greatly (Bradley 2019; Broadhurst et al. 2021). In contrast, permanent closures resulting from law enforcement closures or exit scams may be perceived as higher risk, prompting users to reassess their participation in the dark web markets. Recognising the difference between temporary disruptions and closures is therefore essential for understanding the varied impacts of these on market participant decision-making.

4.2. Internal vs. External (Origin)

Market disruptions originate from various actors and can be categorised as internal or external. Internal market disruptions are events enacted by market administrators. They may choose to close the market (voluntary closure) or conduct an exit scam (and subsequently take the money that is held in escrow). External origins of market disruptions include actors who are not market administrators. This can include law enforcement or other actors, such as hackers.

The origin of marketplace closures could also play an important role in the ways market participants engage in the marketplaces following a disruption. Exit scams may generate stronger deterrent effects than law enforcement interventions because they directly damage institutional trust, a core mechanism of the functioning of dark web drug markets (Moeller 2023). However, it has also been suggested that some market participants may be more concerned with the collection of their data by law enforcement during closures than the financial loss from exit scams (Bradley 2019). Understanding the different impacts of actors responsible for the market disruptions is an important factor to explore more deeply to grow our understanding of the dark web market ecosystem.

While the typology looks at the dynamic nature of drug markets (origin of disruption by its duration), there is a lack of recognition and consideration of the emotional reactions that these disruptors generate for market participants. In fact, these disruptions will shape how actors will operate or engage in markets next. The typology presented here is a theoretical attempt to highlight the nature of dark web drug markets in the event of disruptions. For instance, voluntary closures and exit scams are both permanent disruptions that are enacted by the market administrators. However, the motivations of the market administrators behind these closures are different as well as the resulting perceptions of market participants. In voluntary closures, the market administrators choose to remove the marketplace and warn market participants of the imminent closure so they can withdraw any funds held in escrow. Exit scams, in comparison, occur when a marketplace suddenly closes without warning and the market administrators steal any funds held in escrow and trading accounts. The motivations and the outcomes for the market participants may be vastly different.

Therefore, the element of perception has been proposed as an addition to the typology (see Figure 1). This additional component accounts for the difference in emotional reaction between market disruptions. This idea emerged as voluntary closures and exit scams are both permanent closures enacted by internal actors but have very contrasting reasons for occurring and implications for market participants.

Figure 1. Outcomes of Dark Web Illicit Drug Market Disruptions. DDoS: Distributed Denial-of-Service.

Market participants may perceive the disruption as positive/neutral or negative. Previous research has documented participant perceptions of both law enforcement interventions (Bradley and Stringhini 2019; Décary-Hétu et al. 2023) and exit scams (Tzanetakis et al. 2016). While the inclusion of perception adds conceptual depth to the typology, empirical evidence capturing how market participants interpret and emotionally respond to different forms of marketplace disruption remains limited, particularly for temporary disruptions. Although the perceptions of these five market disruptions require further consideration, this could have substantial implications for crime prevention. The closure of the market, broadly, may not have an impact on the continuous participation within the marketplaces. However, it is the perception of market participants that ultimately changes their behaviour and decision-making.

A positive or neutral perception of disruptions is associated with internally initiated events that do not lead to adverse outcomes (e.g., financial loss or increased risks) for market participants. One of these is voluntary closures, which are a type of permanent disruption initiated by market administrators. Service updates are temporary closures by internal actors (market administrators) to conduct maintenance or improve the site. Both of these disruptions are communicated to market participants through announcements and forum posts to maintain trust.

In contrast, a negative perception of market disruptions refers to events that are viewed unfavourably by market participants due to the risks they pose, such as potential financial loss or compromised security. These disruptions may be due to internal or external actors. Firstly, exit scams are permanent disruptions originating from internal actors (marketplace administrators) and may be perceived negatively because there is a financial loss associated with exit scams for both buyers and vendors. Secondly, law enforcement closures are also a permanent disruption but are initiated by external actors (law enforcement) and are also perceived negatively. Several studies (e.g., Bradley and Stringhini 2019; Décary-Hétu et al. 2023) have examined the reactions of marketplace participants in response to law enforcement closures. Finally, the temporary closure enacted by an external actor are DDoS attacks and hacks.

5. Discussion

This paper presented a new typology to classify different types of market disruptions experienced by dark web drug market participants. Firstly, a new and broader working definition of market disruption was presented. Secondly, the different types of dark web market disruptions were discussed to understand the current research on each of these. Finally, a typology of dark web drug market disruptions based on the duration and origin of disruptions was presented, with the addition of the element of perception. This discussion will review the main findings and their implications for policy, practice and research.

The typology developed in this paper categorised dark web market disruptions across duration and origin. The duration dimension consists of permanent (voluntary closures, exit scams and law enforcement closures) and temporary disruptions (service updates and DDoS). These market disruptions can be executed by internal actors (i.e., market administrators) or external actors (e.g., law enforcement, hackers). Using literature and reported events, each market disruption was organised into these dimensions and the possible perception of market disruptions was identified. These positive and negative perceptions may have significant implications for crime prevention.

Understanding different market disruptions can provide a new perspective on resilience in these markets. The experiences of market participants are not limited to closures of marketplaces but extend to short-term disruptions. The current knowledge of the resilience of dark web markets is heavily based on the impacts of law enforcement closures on the purchasing and selling patterns of market participants. The distinctions identified by the typology could be critical in developing successful interventions. The typology demonstrates that structurally similar events (e.g., permanent market closures) could produce markedly different effects depending on the source of the disruption.

This study builds on the ideas of Ladegaard (2020), Wang et al. (2023) and Bradley (2019) who highlighted the various reasons for closures. This paper supports the permanent closures previously identified and builds on their work by categorising these closure types within a conceptual framework. Moreover, this study extends the existing literature by incorporating temporary disruptions as a distinct category which has received comparatively little attention previously. By moving beyond the identification of individual closure types toward a typology, this study offers a more structured understanding of disruptions in dark web drug markets.

5.1. Limitations

This paper has two related limitations. The first is that the framework is limited to the existing literature on dark web drug markets. The level of detail of empirical data for each market disruption is varied. Thus, some market disruptions (i.e., law enforcement closures) are more detailed. This difference may reflect the challenges of studying dark web markets. Permanent closures are easier to study (particularly quantitatively) than short-term disruptions. Second, this is a conceptual framework rather than an empirically tested model. It provides a starting point for the development of future research.

5.2. Future Research

A potential avenue for future research is role-specific responses to market closures, as buyers and vendors may experience and interpret disruptions in different ways. Vendors typically may have greater financial incentives to re-establish sales channels quickly after a closure (Waldner and Moeller 2024). As a result, they may be more likely to migrate quickly to alternative markets or shift to direct communication channels to retain existing customers. These differences suggest that closures may result in different reactions: vendors may move to alternative platforms quickly while buyers pause their activity or explore other alternatives. Therefore, future research should consider how roles affect post-closure movement as this may reveal important variations in how market disruptions impact the dark web market ecosystem.

A further direction for future research is to examine the broader environment of market migration following closures. Current scholarship has largely concentrated on market participant movement within the dark web marketplace ecosystem as opposed to other drug supply channels. While studies have documented vendor and buyer relocation to alternative dark web sites after law enforcement closures and exit scams, participants may also transition to different digital environments, including encrypted messaging platforms, or offline, face-to-face networks (Bradley and Stringhini 2019). These platforms may offer more stability and fewer risks (from law enforcement or exit scams). Research into understanding the cross-platform movement may focus on how and why they migrate outside the dark web market ecosystems, and whether such pathways differ by the role of market participant or type of market disruption. It could further provide guidance on other ways to prevent offending and understanding of how movement occurs to predict the potential effectiveness of future interventions.

Future research should also move beyond evaluating disruption events in isolation and instead focus on the longitudinal consequences of repeated disruptions. Such an approach would allow for greater insight into whether ongoing instability impacts participation in markets. Van Buskirk et al. (2017b) found that successive law enforcement disruptions reduced the ability of the dark web market to recover. Similarly, Décary-Hétu et al. (2023) stated that the choice to discontinue dark web activities could be due to the result of multiple and simultaneous dark web market disruptions. Understanding how dark web drug market participants respond to multiple disruptions could have important implications for crime prevention. Van Buskirk et al. (2017b) and Décary-Hétu et al. (2023) identified that multiple law enforcement efforts could have a cumulative impact, but this could also extend to other types of market disruptions. Examining these is essential for assessing the long-term crime prevention potential of disruption strategies that may appear limited in impact when studies only focus on the short term.

6. Conclusions

This paper has presented the first typology of dark web drug market disruptions. The different forms of disruption were distinguished based on their duration, origin, and perception by market participants. The typology highlights the varied ways disruptions occur on dark web markets and the consequences on market participants. The purpose of this typology is to stimulate further thinking about different types of disruptions and how they may produce different outcomes. By setting out the range of disruption types observed in dark web drug markets, the typology offers a clearer conceptual lens for understanding instability in these environments and highlights important areas for future empirical research.