The dark web has long been a sanctuary for illicit activities around the world, with illegitimate businesses operating in secrecy and using cryptocurrencies to facilitate anonymous and often untraceable transactions.
In a recent investigation, we uncovered a black market operation, which provides a range of illegal products and services, including weapons trafficking, drug trafficking, forged documents and counterfeit currency production, sale of hacking software, hackers for hire, hitman for hire, and stolen cryptocurrency wallets. These offerings are managed through more than 20 unique entities (marketplaces) across the dark web.
Wallet Details
The Nominis research team traced the transactions linked to OSSC 02, identifying their Bitcoin (bc1q*********q4g), Ethereum (0x26f*********af7, 0xff*********c6a), Tron (TVEj8*********8qR), and Dogecoin (DBgS*********nGV) wallet addresses. Some of these wallets date back to 2021 and remain active in 2026. Importantly, a new Bitcoin wallet address is generated for every purchase. Meaning, each Bitcoin wallet only manages one transaction. However, the Ethereum, Tron, and Dogecoin wallet addresses remain consistent across the different entities.
Exposure to Sanctioned Cryptocurrency Exchanges
Screening the wallets through the Nominis platform also revealed exposure to sanctioned crypto exchanges, including Nobitex and HTX. Two wallets had exposure to Nobitex, Tron (TVEj8*********8qR) and Dogecoin (DBgS*********nGV). While four wallets had exposure to HTX, Ethereum (0x26f*********af7, 0xff*********c6a), Tron (TVEj8*********8qR), and Dogecoin (DBgS*********nGV).
Nobitex, Iran’s largest crypto exchange, was sanctioned by the Office of Foreign Assets Control (OFAC) on June 2, 2026 The sanctioning was a part of the Trump administration’s “Economic Fury” campaign, which aims to disrupt Iran’s financial networks and prevent Iran from evading US sanctions. Nobitex had become a central node for processing hundreds of millions of dollars for Iran’s central bank and the Islamic Revolutionary Guard Corps (IRGC) (Crypto Briefing).
HTX (formerly Huobi) was sanctioned by the United Kingdom on May 26, 2026 under Russia-related sanctions rules, over $1.5 billion in alleged Russia-linked crypto flows (Cryptorank). Additionally, the wallets listed above simultaneously conducted transactions with some of the largest crypto exchanges globally while also engaging with the sanctioned exchanges.
The Importance of Crypto Compliance
The widespread use of cryptocurrency in illicit activities highlights the major importance of strong compliance measures in the crypto industry. Many regulated crypto exchanges and financial institutions implement compliance frameworks, fulfilling checks known as Know Your Customer (KYC) and Know Your Transaction (KYT) that ensure inspection and validation of the legitimacy of the wallet an organization is accepting a transaction from.
Without robust compliance frameworks, legitimate businesses risk unknowingly processing illicit funds, exposing them to legal and reputational risks. By utilising advanced threat intelligence, companies can proactively block transactions from suspicious wallets, ensuring compliance with regulatory authorities and critically, mitigating potential financial crime risks.
Final Thoughts
Our ongoing investigation into these dark web marketplaces underscores the persistent challenges in combating illegal activities facilitated by cryptocurrency. The use of Bitcoin, Ethereum, Tron, and Dogecoin wallets illustrates how malicious actors adapt to evade detection, requiring continuous improvements in crypto compliance efforts.
As cryptocurrency adoption continues to grow, regulatory bodies and blockchain analytics firms must work together to identify and shut down illicit operations, before they can infiltrate the mainstream financial system. Vigilance, transparency and collaboration will be key in the fight against dark web criminal enterprises.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
.png)
.png)
