A darknet market is an illegal marketplace hosted on an anonymity network where payment settles in crypto, and the deposit, withdrawal and vendor addresses it operates are attributable as a cluster. When a check names darknet exposure, it is saying that value at this address is connected to that cluster, either directly or through the path it travelled. Regulated venues treat that connection as proceeds of predicate crime, which is why it usually stops a deposit rather than merely annotating it.
Darknet markets run on anonymity networks and settle in cryptocurrency, typically through per-user deposit addresses and an internal balance. Because the market controls those addresses, they group into an attributable cluster, and money entering or leaving that cluster is identifiable long after the market itself is gone. Several of the largest have been seized, and their address sets remain in intelligence data after seizure.
The consequence is that darknet exposure is not a historical curiosity. A wallet funded three transfers ago by a market withdrawal carries the connection today.
Because this is the category that most reliably ends a banking relationship. An exchange asked to explain a deposit whose value traces to a seized marketplace is not weighing convenience against revenue; it is deciding whether to file a report. For an exchanger or an OTC desk, one accepted settlement of this shape can cost the settlement account that the whole business runs on.
Ordinary users meet it through P2P. A trader sells USDT to a counterparty they met on a platform, the counterparty pays from a wallet that took a market withdrawal weeks earlier, and the receiving exchange opens a review on the trader's account. Nothing the trader did was illegal, and it does not help them. The fix is upstream: screen the counterparty address before the deal, which the Telegram bot does free, three checks a day.
| What the check shows | What it usually means for you |
|---|---|
| Exposure on the address itself | The address is attributed to the market cluster. Do not transact; document what you found. |
| Exposure in the funding path, close by | Value reached this address from the cluster through few intermediaries. Expect a receiving venue to ask, and be able to answer. |
| Exposure far back in the history | Older and more diluted, but still a question a bank can raise. Keep the record of your own counterparty. |
| No exposure named | Nothing in the checked history connects to a market cluster. Keep the result; it is your evidence later. |
The category is written out in plain words rather than as a code, and it sits next to the verdict — CLEAN, LOW, MEDIUM, HIGH or CRITICAL — with a recommendation of Proceed, Caution, Review or Reject. The decision drivers name what was found and where, so a compliance officer reading your file second-hand can follow the reasoning without you being in the room.
Teams work the same finding in the workspace, where the category filters the case queue and each result exports as a signed report suitable for a bank or an auditor. See the pricing page for plans.
Yes. Exposure travels with value, so a payment from a counterparty who did touch one brings the connection with it. That is the most common way ordinary P2P traders encounter this category.
No. The addresses stay identifiable after a seizure, and the connection is still visible on chain. Seizure changes who controls the funds, not what the history shows.
Do not complete the transfer, keep the result and the counterparty's details, and if funds already reached you, leave them in place and document the origin rather than moving them on.
Also available in: · · ·
Often not in those words. Reviews are usually described as routine checks. Running your own check before you send is how you find out in advance rather than afterwards.
Send any wallet to the Telegram bot and get a verdict in seconds. Three checks a day, free, no signup. Desks that screen every deposit run it on plans from $199/mo.