We present a comprehensive description of Hydra, the largest darknet marketplace in the world until its shutdown in April 2022 [sequelae].
We document the main features of Hydra such as dead-drop delivery, feedback and reputation system, escrow, and dispute resolution.
Using data scraped from the platform, we quantitatively examine the scale and the structure of the marketplace.
We find that it has been highly competitive, geographically covering >69% of the Russian population and trading a wide variety of drugs, while also allowing the wholesale trade of drugs and precursors. The dead-drop delivery system used on Hydra was expensive, as the courier costs comprised a substantial proportion of the sale price of drugs on Hydra.
Policy Implications: We contribute to the research on drug cryptomarkets by studying an unprecedentedly large non-Western marketplace that existed substantially longer than any other known darknet market. The phenomenon of Hydra shows that shut-down policies applied to darknet marketplaces have a large effect and implicitly shape the whole drug market. Without these policies, a pervasive digitalization of drug trade can occur. The major cost of allowing marketplaces to grow is the probable increase in the consumption of illegal drugs due to convenience for consumers and facilitated cooperation between suppliers. This cost must be weighed against the potential benefits, including a higher quality of drugs, a decrease in potential violence, and the incentives for a large marketplace to self-regulate. The case of Hydra also suggests the relevance of financial regulation to limit the growth of darknet marketplaces.
[Keywords: Hydra, darknet, marketplace, illegal drugs]
…Unlike their Western counterparts, Russian drug enforcement appears not to have directly attempted to close Hydra, despite regular arrests of low-level market participants, eg. couriers (VICE 2020b). As a result, Hydra existed for a substantially longer period than any other popular darknet marketplace, thus allowing it to grow substantially larger than any market that has ever operated in the US or Western Europe.
…To the best of our knowledge, this paper is the first comprehensive quantitative assessment of this marketplace in academic literature. 2017 RU is an early analysis of data scraped from Hydra and RAMP, the marketplace that Hydra initially competed against until RAMP was closed in 2017. 2019 [Vsya eta dur. Issledovanie o tom, na chem sidit Rossiya] is a journalist-led investigation conducted in 2019 which was one of the first discussions of Hydra in the media.
Operating on The Onion Router (Tor) network, Hydra facilitated the anonymity of market participants by using cryptocurrency for payments and dead-drops [re-hidden drug stashes that made the transactions possible without any physical interaction between sellers and buyers] for deliveries. At the same time, Hydra was a marketplace with active self-regulation, a system of advertisement for individual sellers/shops, and a feedback system of reviews and ratings for individual items and sellers. It also employed dispute resolution and special statuses, such as “trusted sellers”. Finally, Hydra attempted to provide its own version of conventional harm reduction strategies. It selectively tested some of the drugs offered on the platform to ensure quality and provided telemedicine consultations for customers.
…We observe over 417,000 unique dead-dropped drug packages throughout Russia in April 2020 and find that mephedrone (31%), cannabis (18%), amphetamine (13%), and alpha-PVP (12%) were the most popular drugs on the marketplace.
Hydra operated in 1,129 different settlements (cities, towns, and countryside) in every region of Russia, providing potential instantaneous access to illegal drugs for 69% of the Russian population. Larger cities had a higher concentration of sellers and drug listings. More expensive drugs were distributed predominantly in wealthier areas, in particular around business districts.
We also analyze the market concentration using the Herfindahl-Hirschman index and find that the online market of illegal drugs was extremely competitive, both in general as well as at the level of individual drug types and regions.
We estimate a model to disentangle the distribution cost from the sale price of drugs sold on Hydra. We find that the dead-drop system is a costly type of delivery; for some drugs, the distribution cost accounts for more than 50% of the price of the median dead-drop.
Finally, we turn to reviews, which anecdotally were important for customers on Hydra. We analyze the text of reviews and find that the language used by reviewers reflects multiple dimensions of customer experience, while ratings left by users are usually less informative and skewed towards the highest possible value of 10. Our findings suggest that it is the text of reviews that is likely to matter.
…In the last decade, the Russian drug market went through a steady increase in the level of darknet sales of drugs. The first large marketplace that operated in Russia was RAMP (WIRED 2014), which opened in 2012. In addition to RAMP, several darknet forums were also used for trading drugs, among which the most popular ones were Rutor, LegalRC, and WayAWay. In 2015, LegalRC and WayAWay partnered to popularize a new marketplace, Hydra, which competed with RAMP until the latter was shut down by the Russian police in September 2017 (VICE 2020b). After that, Hydra had the opportunity to grow without any substantial competition.9
This dominant position was actively maintained by Hydra through restrictions such as forcing sellers not to operate on competing platforms (see §3.2). The role of Hydra in the Russian drug market was partially admitted by the government when the marketplace was discussed during hearings in the lower house of the Russian parliament in 2019 (2019). We are not aware of attempts by Russian law enforcement to shut down the marketplace. The closure of Hydra happened due to the intervention of the US and German governments, which we discuss in more detail in §5.
Being allowed to exist for 7 years, Hydra was able to grow and reach an unprecedented size of operations. The US Government estimated that Hydra facilitated more than $5 billion in illicit transactions January 2016–March 2022 with ~80% of all darknet market cryptocurrency transactions in 2021 occurring on Hydra (United States v. 2022). Similarly, 2021 estimates the share of Hydra in the worldwide darknet market revenue in 2020 to be 75%. Hydra’s scale meant that it had a substantial impact on the overall cryptocurrency market with transactions by consumers using Hydra constituting a substantial share of the revenue for some cryptocurrency exchanges (2022; United States District 2023).
…To situate our quantitative analysis, we conducted a set of interviews with activists from harm reduction organizations and investigative journalists who studied Hydra (which we describe in detail in §3). Our informants confirmed that Hydra was a common way to buy narcotics in Russia, and was likely the most popular way in densely populated regions such as Moscow & Saint Petersburg. Additionally, informants suggested that there were other online venues to buy drugs in Russia, particularly individual shops operating via Telegram groups and bots. However, these were less popular and focused on selling drugs locally in specific cities and districts. Also, a small proportion of the drug trade continued offline, particularly amongst marijuana growers and economically disadvantaged opiate users who did not have access to the Internet. Overall, all informants suggested that Hydra was the most popular way to illegally buy drugs, at least in Moscow, Saint Petersburg, & other large Russian cities.
…Similar to other illicit marketplaces, Hydra also facilitated the sale of other illegal and gray-market goods (forged passports, counterfeit documents, counterfeit money, SIM cards, etc.) and services (graphic design for the new shops on Hydra, use of private-access databases to find personal information about individuals [cf. extensive leaks about Russian elites & intelligence services exploited by Bellingcat]). However, our informants suggested that these accounted for a substantially smaller proportion of transactions than drugs. The scope of illegal business was limited by the platform itself, which explicitly forbade selling guns, poisons, contract killing, explosives, government secrets, and pornography. In addition, drugs considered particularly dangerous, such as fentanyl and its derivatives, were also banned.
…Once a customer decided on the desired product, payment was made via Bitcoin. Customers generally had two options for depositing Bitcoin on the platform.13 One was to externally purchase Bitcoin, which could then be transferred to the address provided by the marketplace. Another option was to use a QIWI wallet, a payment service provided by the Russian financial company QIWI. As the company has ATM-like terminals throughout Russia, a customer can simply deposit cash to exchange it for Bitcoin using one of many crypto-exchange services operating on Hydra. Given that no identification is required for the use of the terminals, this way of depositing money provided sufficient anonymity for buyers. To the best of our knowledge, these terminals were crucial to the popularity of Hydra as they made it substantially simpler to anonymously obtain cryptocurrency.
…After payment, the customer received detailed information on the location of the dead-drop, including photos and GPS coordinates. Thus, there would be no physical contact between the seller and the buyer. Moreover, the communication between them was isolated by the website on the Tor network. The financial transaction was also anonymous provided the customer used Bitcoin or directly deposited cash to a QIWI terminal.
The main channel of communication between the buyer and seller occurred through the chat system on the Hydra website. While it is possible that market participants could use other means of communication, the marketplace aggressively prohibited this. In particular, the rules of the platform prescribe large penalties (up to $106,698.37₿22022) for sellers attempting to establish connections with buyers outside of Hydra and rewards for buyers exposing such attempts.
…After payment, the customer received detailed information on the location of the dead-drop, including photos & GPS coordinates…There were 4 methods used to hide packages: “magnet”, “dig”, “snow dig”, or “hiding”. The first involved attaching a magnet to the package and then sticking it to an object, such as the inner surface of a rain gutter. The second and third methods were burying the package in a suitable location, such as a park or public garden, in either soil or snow respectively. Finally, the package could simply be hidden somewhere it was unlikely to be accidentally found (such as the attic in multifamily housing)…Activities such as digging in parks or searching the yards of multi-family houses became indications that someone was likely retrieving drugs.
…The average rating is close to 10, and the share of orders with a rating below 10 is just 4% (we present the detailed analysis of reviews and ratings later in §4.6). This may partly be explained by the fact that if the user did not post a rating during the 24-hour period, the marketplace automatically assigned a rating of 10 to the order. It may also be due to the effects of reputation inflation where raters begin leaving higher ratings despite not being satisfied ( et al 2022). This is supported by the fact that we observe numerous instances where a user expressed negative sentiment in the review text despite leaving a rating of 10⁄10 which is line with the findings of et al 2022 that inflation in review text is less sensitive to “inflation” than numerical ratings. See Table 9 in Appendix C for examples of such reviews on Hydra.
Certified producers: For sellers of synthetic drugs, the marketplace allowed sellers to obtain the status of a certified producer. This status could increase sales by signaling the relative safety of the items purchased, with buyers also able to filter search outputs only to show certified producers.
This feature of the marketplace required a substantial degree of involvement by marketplace employees. Based on the description on the website, Hydra was supposed to check the whole production cycle: the chemical reagents bought and used, the equipment, and the qualifications of the workers. The marketplace also claimed to test the final product in its lab. It is not clear from the description whether the Hydra employees conducting these tests physically visited the production facilities. The platform stated that Hydra required photos of the production facility and detailed information regarding it (eg. the reagents purchased) as part of the application for this status.
…3.5.5 Professional education: Hydra also hosted a page called “School of couriers”, where it sold a few online courses for couriers and services for resolving employer-employee disputes for shops. Based on the reviews, the training sold by Hydra was credited with reducing the risks associated with depositing dead-drops. Hydra also provided consulting services for aspiring producers. The services were stated to range from helping with the purchase of precursors and equipment to the education of production facility workers.
Front page: The sellers could pay for one of the 20 positions on the main page of the website. These positions were distributed through a monthly auction, with the highest bidder getting the first position, the second highest bidder getting the second position, etc. The bids could be observed by store owners. 2019 reports that by the time the article was written, the cost of the positions on the main page was on the order of magnitude of >$20,000 per month.
…4.1 Data: For our quantitative analysis, we use two complementary datasets. The first dataset is a set of drug listings scraped from the Hydra website. The dataset contains daily snapshots of drug listings on Hydra 2020-04-01–1m2020-05-02. For each listing, we observe the characteristics related to the product and its delivery method. The former includes the type of drug, amount, price, name and title of the listing, and the name and ID of the seller. Information on delivery includes whether the listing is a preorder or an instantaneous listing, and whether the order is mailed. For instantaneous listings, we observe the type of hiding and the approximate location of dead-drops. In total, the dataset contains 31,035,506 listings.
This data was purchased from an independent data collector, who also provided data for several journalist investigations (Knife 2020, Chto proishodit s rossiskoi narkotorgovlei iz-za koronavirusa?; 2019). Scraped listings from Hydra have also been used in studies of drug use and opiate listings were shown to be statistically-significantly correlated with fatal drug overdoses ( et al 2021).
The second dataset we use is provided by a data provider established in Pennsylvania, USA [CMU]. This firm continuously collects data from the world’s largest darknet marketplaces. Details about the project can be found in 2015 and 2022. This dataset allows us to see a large subset of the reviews left on the platform. For each review, we observe the item for which it was left, the vendor, the nickname of the buyer, the time of the review, and the associated numerical rating that the buyer has given. We exclude all reviews that were left for job postings or non-drug products sold on Hydra. We end up with 325,000 reviews that were left on the marketplace from January 2019 to February 2022. Our sample only covers a fraction of all reviews as the firm providing the data was not able to scrape all pages of the website because of technical difficulties. As coverage of scraping fluctuated substantially across days, we do not use this data for quantifying how many and what drugs were sold on Hydra. We only use this dataset for analysis of the reputation system on Hydra, and our conclusions do not rely on the ability to observe all reviews on the marketplace.
…Note that one listing on the website can represent several dead-dropped packages with the same characteristics hidden in the same general location. Therefore, this table likely underestimates the actual number of drug packets hidden throughout Russia.
…Table 3 shows summary statistics for select drug types on Hydra. Consistent with studies on Western cryptomarkets (2018a), we see that heroin was a small proportion of this market. While it was allowed to be sold on Hydra, our interview informants have suggested that heroin was an exception among other drugs, and the majority of the heroin trade in Russia occurs through more informal methods such as bots on Telegram or offline and on the streets. The remaining drug types were widely available, many being sold in around 500 different cities and towns. Unlike most other darknet marketplaces, a large proportion of listings on Hydra appear to have been intended for redistribution. et al 2018 estimate that just 2.1% of transactions on Agora and The Silk Road 2.0 were wholesale transactions, defined by having a value above USD 1000, with the remainder appearing to be for either personal consumption or social distribution. Using this definition, we find that for the categories listed in Table 3, the proportion of wholesale listings varies from ≈50% for Alpha-PVP to ≈15% for heroin. Restricting our data to instantaneous orders (ie. excluding pre-orders), we find that the proportion of wholesale listings drops to 1–5% for the categories in Table 3: Hence we conclude that the majority of these business-to-business transactions occurred through pre-orders and this inference is corroborated by several of our informants.
Finally, Figure 3 shows the weight/quantity distribution of several types of drugs. It is apparent that the most frequent quantities are 0.5, 1, 2, 3, and 5 grams for most of the drugs. Quasi-legal and RX drugs, such as Xanax, are sold as tablets, and therefore have higher quantities. Interestingly, methadone is rarely sold in weights above 1 gram.
…4.3 Geography: 4.3.1 Within-city dispersion: Given that our interviews mentioned that the convenience of the pick-up location was a key factor to differentiate between listings, the distribution of listings across the different neighborhoods of a city reflected the spatial distribution of demand. Figure 4 shows the share of 3 major drug categories as a proportion of all drug listings within each district of Moscow. As can be expected, cocaine is generally hidden in the city center around the business districts. At the same time, cheaper drugs, such as synthetics and marijuana, are proportionally much more popular in the outskirts. Similar patterns can be seen in other major cities throughout Russia. In Appendix A, we show this for the case of Saint Petersburg.
4.3.2 Between-city dispersion: With Hydra operating in 1,129 settlements across every region in Russia, over 100 million people live in a settlement that had at least one dead-drop available for purchase on Hydra in April 2020. This means that of the 144 million inhabitants of Russia, 69% had access to drugs from Hydra in their city or village at the time when our data was collected.
Figure 5 shows the distribution of cities with at least one instantaneous listing from Hydra. We can see that the degree of presence of Hydra is positively correlated with population size. Moscow and Saint Petersburg, the two most populated cities in Russia, on average had 3 and 9 dead-drops per 100 residents, respectively. Among the less populated cities, Sochi stands out as one of the cities with the highest demand with 16 listings per 100 residents, likely related to its popularity as a resort location. Finally, many smaller satellite cities around Moscow (such as Aprelevka or Solnechnogorsk) have a particularly high number of listings per capita. These locations can be easily accessed by car or public transportation but have less policing and more parklands. Thus, they are likely to be convenient for hiding and picking up drugs and serve some consumers from Moscow.
…Table 5 reveals two properties of the fixed-cost components of prices on Hydra. First, the fixed effects in the regressions are different for different drugs. We believe that this reflects that delivery costs for different drugs are different (VICE 2020b provides anecdotal evidence for this). For example, cocaine dead-drops are the most expensive because they appear to be the most difficult to make for several reasons. First, cocaine is typically hidden in central areas (see Figure 4), where policing is more intense and thus the risks for couriers are higher. In addition, cocaine dead-drops can be expected to be of higher “quality”: the cost of losing a dead-drop of cocaine is higher and hence the packages should be hidden better. Finally, the risk of couriers absconding with drug packages appears to have been a substantial concern for shops and the higher street value of cocaine packages makes them particularly susceptible. Hence, couriers were provided higher compensation per package in order to incentivize them not to steal the drugs…For example, comparing these findings with the median quantities from Table 3, we find that for cocaine the cost of delivery comprises around 1⁄3rd of the cost for the median dead-drop. For amphetamine, the delivery cost is more than half of the cost for the median dead-drop. This suggests that while the market has adapted, the Russian laws introducing more stringent scrutiny of posted packages have still somewhat served to inhibit the online drug trade by increasing price and thus implicitly decreasing the quantity demanded.
…5. Shutdown of Hydra: We provide a brief description of the shutdown and how the landscape of the drug market has changed. These changes highlight the impact of Hydra on the Russian drug market and will have important implications for our policy analysis in §6.
The Hydra marketplace was shut down on the 5th of April 2022, when German police seized the servers hosting the marketplace in a joint operation with US enforcement agencies (2022; Wall Street 2022). On the same day, the US Treasury issued sanctions against the marketplace (US Department of the 2022) and the US Department of Justice obtained an indictment against the alleged administrator of Hydra (United States v. 2022). We are not aware of any evidence that the Russian authorities were involved in the operation or were informed about it. The shutdown of Hydra by the two Western governments might be construed as a part of the increasing number of Western sanctions against Russia in 2022. We are not aware of any evidence that these two events are connected. Moreover, on its press release, the Federal Criminal Police Office of Germany stated that the corresponding investigation started in August 2021 (2022). Despite some market participants expressing expectations that Hydra would be brought back online, as of the time of writing, the marketplace has been inoperable for more than a year.
In the initial days after the shutdown, buyers and sellers attempted to trade using the two darknet forums that had been popular among Hydra users: LegalRC and RuTor (see also §2.2). In addition, sellers began actively using their own websites or bots on Telegram messenger as a communication channel for selling drugs (2022).26 Despite Telegram bots remaining popular, the demand for a centralized platform quickly lead to the quick growth of previously small darknet marketplaces over the following weeks. Among the marketplaces which grew in the wake of the Hydra shutdown, the largest at this moment are “OMG”, “Blacksprut”, “Mega”, and “Solaris” (2023a; TRM 2022). Another marketplace that is popular now, “Kraken”, opened in December 2022. Kraken presents itself as a successor of Hydra managed by people who were associated with the closed marketplace (Novaya Gazeta 2023).
According to media reports, there is intense competition between the new marketplaces. In particular, they are alleged to have engaged in multiple attempts to advertise themselves offline (VICE 2023) or using social media (Novaya Gazeta 2023). Importantly, it has been reported that the competitive environment spurred a long series of large-scale hacker and DDOS attacks organized by markets against their competitors (2022; Novaya Gazeta ; VICE 2023). These attacks alongside the lower technical capacity of these platforms have meant that they have struggled to support a large number of visitors and they are considered to be much slower and less convenient than Hydra. The fact that individual marketplaces will regularly be inoperable forces market participants to operate in multiple marketplaces. This increases search costs for consumers, requiring that they spend time locating multiple marketplaces and suitable sellers on each marketplace. For sellers, this increases their administrative costs due to the additional management effort required to operate on multiple platforms.
…Reports of fake listings where drugs are not deposited are considered more common and concerns about drug quality have increased. These problems are exacerbated by the lower functionality of these platforms. For example, users report a lack of reliable moderation on these platforms, which alongside the less reliable reputation/history of participants inhibits the possibility of having disputes resolved satisfactorily (2022).