Darknet marketplaces increasingly tap into top privacy coin monero

As blockchain analysts improve their abilities to track various crypto assets, including bitcoin (BTC) and stablecoins, operators of darknet marketplaces are increasingly supporting monero (XMR), a new analysis showed.

Last year, 48% of newly launched darknet markets (DNMs) supported only XMR, compared with slightly above 40% in 2024, according to data from blockchain analysis company TRM Labs. This is also attributed to growing enforcement pressure and improved abilities to track other crypto assets.

For example, bitcoin on-chain transactions can be tracked relatively easily. However, bitcoin scaling solution Lightning Network is considered to offer superior privacy, and there's even an ongoing debate about which technology – monero or BTC on Lightning Network – protects users better. In either case, the overwhelming majority of ransom payments are still made in bitcoin.

According to TRM, this demonstrates that "usability and liquidity [of bitcoin] often outweigh privacy in practice."

XMR still represents a smaller share of overall crypto asset activity compared to other major networks. However, per TRM, these transaction volumes remain "substantial and persistent given its specialized role."

What's more, XMR's usage wasn't meaningfully affected by dozens of centralized exchanges delisting this cryptocurrency last year.

"This suggests that demand is not primarily driven by casual retail trading, but by users who deliberately seek out monero’s privacy features and are willing to accept higher friction, fewer on-ramps, and reduced liquidity to transact in it," the analysts said, noting that XMR transaction volumes in 2024 and 2025 were significantly higher than in 2020–2021.

Additionally, the analysts observed "non-standard behavior" in monero’s peer-to-peer network, with around 14-15% of reachable peers deviating from protocol expectations. The behavior is related to message timing, so-called handshakes, peer list composition, and infrastructure distribution. While TRM is not able to tell why this behavior occurs, they suggested that it might be due to unknown systemic, not incidental, causes.

Also, as with XMR usage in general, non-standard behaviour doesn’t necessarily mean something malicious.

"Deviations in timing, connection lifetimes, or peer list composition can introduce observable structure into transaction propagation, which may be relevant for inference under certain threat models," the analysts said, stressing that monero’s on-chain cryptography remains unchanged.

Unlock more exclusive Cybernews content on YouTube.