The criminal forum predates the dark web. Trade in stolen card numbers was established on dial-up bulletin boards in the 1980s, more than a decade before Tor’s hidden services made an anonymous website possible, and the model had assumed recognizable form by 2001 on CarderPlanet, founded in the Ukrainian city of Odessa, and a year later on ShadowCrew, its English-language counterpart. Both dealt in stolen card data, but their more significant achievement was procedural: establishing how anonymous participants could transact without being routinely defrauded.
The solution they arrived at has outlasted every site that has since used it, and it is what constitutes a forum: reputation earned in public, escrow that holds funds until both sides confirm delivery, arbitration that can end a seller’s career, and vetting strict enough to deter amateurs and investigators. Storefronts sell the goods; the trust that makes a sale possible is manufactured elsewhere, and it does not transfer to a new domain.
That is why the past two years have been an unusual test. Between January 2025 and January 2026 almost every significant forum in the English- and Russian-language underground was seized, abandoned or decapitated. Cracked and Nulled went down first, along with the payment infrastructure behind them; police arrested the administrator of XSS in Kyiv in July; BreachForums fell in October; and in January 2026 the FBI took RAMP, until then the only one on which ransomware-as-a-service had ever been openly permitted. The volume of stolen data in circulation did not fall. Researchers examined roughly 18.7 million infostealer logs across 2025, each the harvest of one infected machine, and by March 2026 the threat intelligence firm CloudSEK put the quantity of stolen credentials circulating underground at more than 24 billion. The venues had changed again; the institution had not.
What Dark Forums Are
Dark forums are discussion platforms built for the exchange of illicit goods, services, data and technical knowledge. Nothing about them is technically sophisticated; most run the same off-the-shelf software as any hobbyist message board. What matters is not how they are built but what they do for people who operate outside contracts, courts and verified identity.
The central difficulty is transacting under anonymity. A buyer seeking VPN credentials to a European manufacturer cannot confirm the seller holds the access advertised, has no recourse if the money leaves and nothing arrives, and has no way of telling an experienced broker from an undercover officer. What these communities built to solve that is, unexpectedly, bureaucracy. Reputation is public and bound to a handle, so an aged account is worth buying, while escrow holds funds until both parties confirm delivery. When a deal is disputed, a moderator hears evidence in a thread and rules on it, and because the loser is generally banned, the ruling ends that seller’s business. Entry is rationed too: the ransomware forum RAMP asked applicants for a verified account at least two months old on XSS or Exploit.in, or $500. Forums serve as labor markets as well, recruiting ransomware affiliates, and as schools where each intake is trained by the one above.
A forum is not a darknet marketplace, though the two are constantly conflated. The marketplace is transactional and reproducible: code, a vendor roster, an escrow balance. The forum is a social graph and years of accumulated standing, which is why one can be rebuilt and the other cannot.
One clarification matters before going further: the word “dark” is misleading. Several of the most consequential platforms — RaidForums, Cracked, Nulled, BreachForums and DarkForums among them — have run on the ordinary indexed web, keeping Tor mirrors only as contingency. A sample posted to an indexed forum is found by journalists, cited in reporting and read by the victim’s own security team within hours. Monitoring confined to Tor therefore misses the platforms where corporate data actually surfaces.
Origins: The Clear-Web Era (1980s–2004)
The order in which these appeared explains much of what follows. The forum was already a working institution before anonymous hosting existed, so it never depended on that technology, and no subsequent change has disturbed the arrangement underneath. Seizing a site therefore removes somewhere to trade, not the trade itself.
Bulletin board systems gave card fraudsters, phone-network intruders and early hackers their first reliable means of locating one another, and the traffic migrated to conventional forum software as the commercial web matured. Two sites then set the pattern still in use. CarderPlanet, founded in May 2001, became the first Russian-language platform of any real scale, selling stolen card data and teaching phishing methodology. Its lasting contribution was organizational: it imported a hierarchy modeled on organized crime, in which the most senior members held titles such as Godfather and capo di capi. ShadowCrew did the equivalent in English between August 2002 and October 2004, with an unusually formal structure: administrators sat as a governing council, moderators ran subject-specific sections, and designated reviewers tested goods before any vendor could advertise them.
Both were gone within months of each other. Dmitry Golubov, a CarderPlanet founder, closed the site in July 2004, saying it had attracted too much attention from law enforcement, and that October the Secret Service arrested twenty-eight ShadowCrew members in Operation Firewall. Neither community disbanded, though, and neither stopped trading. Both instead broke apart and re-formed across smaller, more selective and considerably more security-conscious successors, establishing the cycle that has repeated ever since: enforcement removed the meeting place while scattering the population across venues individually far harder to observe.
Tor, Bitcoin and the First Marketplaces (2004–2013)
Tor hidden services made hosting survivable against domain seizure, and Bitcoin permitted settlement without an identifiable intermediary; together they produced the darknet marketplace, and with it the mistaken assumption that this history begins in 2011.
The first serious attempt came five years earlier. The Farmer’s Market, founded in or before 2006 and moved onto Tor in January 2010, handled some $2.5 million before the DEA closed it in April 2012. Tor hid the site but not the money, which moved through PayPal and Western Union and was traceable. Silk Road, launched in February 2011 by Ross Ulbricht under the alias Dread Pirate Roberts, solved that by pairing Tor hosting with Bitcoin, centralized escrow and vendor ratings, and the Department of Justice later put its transactions at $1.2 billion. Its forum may have mattered more than the marketplace, since a good deal of what later became standard practice appears to have been worked out there: PGP use for signing and verification, the vetting of vendors, and what counted as acceptable operational security.
What was taking shape elsewhere attracted far less coverage and matters more today. While the English-language press treated Silk Road as a curiosity, the Russian-language underground was assembling the professional tier of the industry. Hack-All, founded in 2005 by an actor using the handle toha, became Exploit.in in 2006 and grew into the most technically demanding site in the Russian-language scene, its membership rules deliberately excluding amateurs and non-Russian speakers. DaMaGeLaB had been running since 2004. After its administrator Sergey Yarets was arrested in Belarus in late 2017, toha, by then a former Exploit.in administrator, bought a backup of its database and reopened it as XSS in late 2018.
The Chinese-language scene developed over the same years under very different conditions, which produced a markedly different institution. Deepmix, also known as Exchange Market (交易市场), has operated since 2013 under pervasive surveillance and severe criminal penalties, and Intel 471, assessing the scene in 2020, characterized it as less organized than its Russian counterpart, with participants identifying themselves by short numeric handles rather than names, though holding those handles long enough to build recognition. On that evidence, the scenes differ in how identity is displayed, not how much reputation counts. By 2013 there was no single underground but several, separated by language, trust model and legal exposure.
Disruption Becomes Routine (2013–2019)
By the middle of the decade the sequence had become predictable: seizure, dispersal, reconstitution, and a successor that could not be trusted.
Operation Bayonet, in July 2017, altered behavior more durably than anything preceding it. AlphaBay, the largest darknet marketplace of its day, carried some 300,000 listings from more than 40,000 vendors at its height, was seized after the arrest of Alexandre Cazes in Bangkok, and its users migrated to a rival marketplace, Hansa. What they did not know was that Dutch police had taken control of it in advance and were running it as a honeypot, harvesting credentials, delivery addresses and transaction records from each arrival for twenty-seven days. Migration itself thereby became hazardous, since the standard response to a takedown was relocation to the nearest functioning venue, which after Hansa carried the risk that it too was police-run. That suspicion has never dissipated, and it accounts for much of the distrust now attaching to any successor emerging intact.
While attention remained fixed on narcotics, the data trade that would matter far more to corporate defenders was assembling on the clear web. Nulled launched in 2015 and Cracked in 2018, low-barrier sites dealing in cracked software, compromised accounts and combolists (bulk lists of username and password pairs); their importance was demographic rather than technical, since they carried very large memberships and trained successive intakes of entry-level fraudsters. RaidForums, founded around 2015 by Diogo Santos Coelho, a Portuguese national then fourteen years old, became the principal clearing house for stolen databases, while Genesis Market began selling browser fingerprints and session cookies in 2018, bundled with a plugin that let a buyer assume the victim’s browser session and bypass multi-factor authentication entirely, until an international operation closed it in April 2023. Non-English communities moved on their own timetables: Cebolla Chan 3.0, the principal Spanish-language forum, went offline in September 2016 and scattered a community that never reassembled, while Tea Horse Road (茶马古道), a Chinese-language marketplace, opened in June 2019 using Telegram channels as a parallel communications layer years before Western sites did.
Corporate Data and the Ransomware Split (2020–2024)
From around 2020 the composition of the trade shifted. Narcotics still generated the most revenue, but the activity carrying the greatest consequence for organizations became the trade in corporate data: databases, credential sets, session tokens, and network access sold by initial access brokers (IABs), the intermediaries who obtain entry to a network and resell it. Influence moved with the product, from Tor marketplaces to clear-web leak forums, which are searchable and quotable and therefore far more useful for pressuring a victim.
Ransomware then split the Russian-language scene in a way that reveals how these forums govern themselves. After the DarkSide attack on Colonial Pipeline disrupted fuel supply across the eastern United States in May 2021, administrators read the attention as an existential threat, and XSS and Exploit.in prohibited discussion of ransomware outright. Neither presented this in ethical terms; it was risk management, reflecting a judgment that the traffic had become commercially damaging to the platforms hosting it. The activity relocated rather than ceasing. In July 2021 Mikhail Matveev, operating as Orange, converted the Babuk ransomware domain into RAMP, the only significant forum to permit affiliate recruitment in the open. Over the next four years it hosted recruitment for most of the major ransomware operations of the period.
The events of 2022 then broke the marketplace and the forum within weeks of one another. On 5 April German and American authorities seized Hydra, the largest darknet marketplace in operation, which had taken approximately $5.2 billion in cryptocurrency since 2015 and accounted for an estimated 80% of all darknet-marketplace volume during 2021. RaidForums had already ceased functioning on 25 February, its founder Coelho having been arrested in the United Kingdom on 31 January. Seven days later, on 4 March 2022, Conor Brian Fitzpatrick, then nineteen and using the handle pompompurin, launched BreachForums — one week, in other words, between the destruction of the principal English-language stolen-data forum and the opening of its replacement.
Three months before BreachForums opened, unremarked at the time, Chang’an Sleepless Night (长安不夜城) appeared in the Chinese-language scene with integrated escrow and support for Bitcoin, Ethereum and Tether, and went on to carry large-scale telecommunications, healthcare and identity breach data, frequently before any of it surfaced in the West. In March 2022 a small site called DARK4RMY Forums was established by a crew calling itself DarkArmy, administered by two individuals whom the research firm KELA places in India. At that point it served a single group and attracted no notice beyond it.
BreachForums was never the largest or most capable site in history — Exploit.in is far more sophisticated, and Nulled carried a larger membership — but it became the effective reference-of-record for data breaches. Sitting on the clear web and easy to cite, it cut the interval between a breach happening and becoming public knowledge down to hours: a post with a sample and a record count reached journalists and the victim’s own security team within the working day. Handles such as pompompurin, IntelBroker and ShinyHunters accumulated track records anyone could check, and a record taken seriously could be sold. Once a forum becomes the place where a breach acquires public reality, the threat to post there is the extortion in itself. What appeared there included data on more than 80,000 members of InfraGard, an FBI-affiliated critical infrastructure program, and DC Health Link records covering United States congressional members and staff.
The next two years demonstrated how little a server seizure achieves against an established name. Fitzpatrick (BreachForums’ founder) was arrested in March 2023 and the FBI seized the clear-web domains that June, after which ShinyHunters and the administrator Baphomet reopened the forum on new infrastructure under the same name; when the FBI took the site, its onion service and its Telegram channel in May 2024, it was operating again within a fortnight. Hosting was never the weak point. What ended BreachForums in 2025 was the removal of the people behind the handles, and the collapse of confidence that followed.
Enforcement at Scale (2025–2026)
The period from January 2025 to January 2026 brought the heaviest sustained enforcement these communities have faced, and it differed from earlier waves in three respects: it pursued forums and payment infrastructure instead of drug marketplaces, it was coordinated across a far wider range of jurisdictions, and in several instances it attacked the credibility of named administrators rather than their servers.
Operation Talent, January 2025: An international action seized the domains and infrastructure of the Cracked and Nulled forums, the StarkRDP hosting service and the Sellix payment platform, with two arrests in Spain. It removed the low-barrier entry layer of the English-language scene together with the payment infrastructure many users relied on to run their storefronts.
XSS, July 2025: Ukrainian and French authorities, supported by Europol, arrested a thirty-eight-year-old man in Kyiv named as the administrator, closing a four-year investigation led by the Paris public prosecutor’s office. XSS at that time had more than 50,000 registered users. The agency estimated that the administrator had made around $8 million from advertising and facilitation fees, and characterized his role as that of a trusted third party who arbitrated disputes and guaranteed the security of transactions, not as an offender in his own right. It is the clearest official statement on record that what a criminal forum sells is trust.
BreachForums, through 2025: The site was dismantled through accumulated attrition instead of a single action.
IntelBroker, identified as Kai West, a twenty-five-year-old British national, was arrested in February. In April the administrators announced that law enforcement had gained covert access to the site’s servers, and they took it down themselves; that interruption scattered the user base. French police arrested four suspected administrators in their twenties in June. On 10 October the FBI and French authorities seized the domains, servers and database backups reaching back to 2023. The seizure came hours before a deadline set by Scattered LAPSUS$ Hunters, an alliance that included ShinyHunters, for publishing close to a billion records stolen from Salesforce customers. The group’s reply, posted to Telegram, was that “the era of forums is over.” In January 2026 roughly 324,000 of the forum’s own user records were published.
RAMP, January 2026: The FBI seized both the onion service and the clear-web domain, and the administrator confirmed as much on the relaunched XSS, adding that he would not rebuild. The damage was reputational rather than judicial. Accusations that he had cooperated with the FBI spread immediately; his claims about disk encryption collapsed when seized private messages were found to match conversations that had already leaked; and within a week he was banned from the major Russian-language sites. No prosecution has been reported.
The Current Landscape (2026)
What has emerged is more fragmented, markedly less trusting, and no less productive.
DarkForums: The most prominent English-language leak forum of 2026 owes its position principally to having been functional at the moment BreachForums was not. It opened in March 2022 as DARK4RMY Forums, and control passed in August 2024 to an administrator using the handle Knox. Once BreachForums collapsed in April 2025, KELA recorded a 600% rise in activity between April and June, whereupon the site redesigned itself to resemble its predecessor and absorbed that platform’s Telegram community. Its operators are aggregators rather than originators, since most of what appears there is reposted rather than originally obtained, and it has never been seized, making it the only major English-language site in this lineage to pass through the enforcement wave undisturbed. That survival is itself grounds for suspicion among its own users, though no evidence of law enforcement control has been produced publicly.
The BreachForums succession: Breached opened in January 2026, seeding its membership with the 324,000 BreachForums accounts leaked that same month, and has grown beyond a discussion site into a ransomware-as-a-service hub. In March ShinyHunters declared every site then trading on the BreachForums name fraudulent, stripping the name of whatever credibility it had left. In April a fifteen-year-old was detained after claiming a breach of French government data: with Cracked and Nulled gone, no entry layer remained to absorb newcomers of that age. A forum called PWN followed the same month, assembled by moderators from a predecessor that had collapsed in an exit scam, and in May it banned attacks on CIS countries, an English-language forum adopting a Russian-language norm for the same jurisdictional reasons. By July nothing had settled, and the RaidForums name had reappeared with a ransomware-as-a-service section attached.
The Russian-language sites: The XSS takedown of July 2025 fragmented the community without ending it, but the fragments have not recovered what the original provided. Two successors emerged: a relaunched XSS holding roughly 51,000 accounts, and DamageLib, with around 33,500. Flare’s figures indicate that the population transferred while the activity did not: DamageLib logged 248 threads in its first month, a fraction of the activity XSS carrid before it was seized.. The RAMP seizure six months later worked considerably better, because it came with the destruction of its administrator’s standing and not merely the loss of hosting, so no successor could assume his guarantor role. Exploit, meanwhile, continues to operate twenty-one years after it began as Hack-All, which suggests the configuration lasting best combines the strictest access control with the narrowest membership. fragmented the community without ending it, but the fragments have not recovered what the original provided.
The Russian-language sites: The XSS takedown of July 2025 fragmented the community without ending it, but the fragments have not recovered what the original provided. Two successors emerged: a relaunched XSS, and DamageLib, which drew around 33,500 accounts, roughly two-thirds of the 51,000 the original held. Flare’s figures indicate that the population transferred while the activity did not: DamageLib carried about 3,100 posts in its first month, against more than 14,400 on XSS in the month before it was seized. The RAMP seizure six months later worked considerably better, because it came with the destruction of its administrator’s standing and not merely the loss of hosting, so no successor could assume his guarantor role. Exploit, meanwhile, continues to operate twenty-one years after it began as Hack-All, which suggests the configuration lasting best combines the strictest access control with the narrowest membership.
Beyond English and Russian: The Chinese-language scene has continued its own cycle largely untouched by Western enforcement. Chang’an Sleepless Night and Deepmix rank among the most active sites identified in 2026, while several others have gone offline and been replaced. The rotation is identical in shape to the English-language one, yet runs on an independent timetable, in a language most Western monitoring does not cover.
For Spanish-speaking countries the scene has had no center since Cebolla Chan 3.0 went offline in September 2016, and none has been built since. Zynap’s threat intelligence team tracks the trade in card data and credentials there running almost entirely through Telegram groups.
Conclusion
The past two years changed the method of enforcement, not its result. Seizing servers had never worked; what finished BreachForums was the arrest of the people behind the handles, and what brought down RAMP was the destruction of its administrator’s standing. Reputation, not hosting, is the point of failure, and 2025 and 2026 are the first operations to aim there deliberately.
The forum as an institution itself has not changed. Escrow, guarantors, ranked membership and arbitration predate Tor hidden services and have survived every migration since, so when a site is removed what returns is not the site but the arrangement, and it returns within weeks.
None of which makes these sites less worth watching: they are where breaches become public and access is sold before use, often the first place a compromise is visible from outside the victim organization, weeks ahead of any ransom demand. The venues will keep rotating; the structure they reconstitute has not meaningfully changed since 2001.