The latest news, articles, and resources, sent to your inbox weekly. FinCEN imposed a civil penalty in October 2020 that remains unpaid. The term darknet refers to parts of the internet not indexed by standard search engines and are typically accessed through tools like Tor to enable anonymity. Police say Donatas Kasputis was arrested at a post office carrying 16 drug packages. Scattered Spider shifts from data leaks to brokering insider access, targeting firms like Microsoft and Apple through a structured cybercrime… Cyberattacks surge in APAC as Akira ransomware exploits VPN flaws, Microsoft 365 logins, and Python scripts to bypass MFA and…
U.S. authorities have finalized the forfeiture of more than $400 million in assets tied to Helix, a darknet crypto mixer used to launder proceeds from online drug markets and other criminal activities. Prosecutors said Harmon ran Helix as an unregistered money services business that obscured the source of Bitcoin transactions, processing more than 1.2 million transfers worth over $311 million at the time. Helix’s operator, Larry Dean Harmon, built the platform and the Grams search engine to integrate directly with major darknet markets, taking fees from transactions that investigators later traced back to “tens of millions of dollars,” per the DOJ statement. The civil action follows a criminal case in which Harmon was indicted in 2019 and pleaded guilty in 2021 to conspiring to launder money. Authorities also noted that the service was used to move funds linked to drug sales, fraud, child exploitation, and extremist groups. The DOJ’s actions feel like “removing a purpose-built laundering hub," and doing so "forces illicit actors to abandon a trusted, integrated service and move through less direct, more exposed paths,” he said.
Helix was a widely used darknet mixing service that began operations in 2014, processing up to about 354,468 Bitcoin, worth roughly $311 million at the time, according to a statement from the DOJ on Thursday. Coin Ninja’s DropBit product allowed Bitcoin transfers via text messages or social media handles and was marketed by Harmon as a way to bypass KYC (know-your-customer) requirements, according to a separate civil case from 2022. Court filings further allege that Harmon never registered Helix with the Financial Crimes Enforcement Network, failed to implement an anti-money laundering program, and failed to file any suspicious activity reports. The U.S. government’s civil case against Harmon was based on violations of the Bank Secrecy Act tied to the service’s operation from 2014 to 2017. “It can feel like whack-a-mole, but each takedown adds real friction to the laundering process by breaking familiar routes and pushing funds into new, more traceable channels, so even when activity shifts, it becomes slower and riskier,” he added. Three U.S. insiders indicted for BlackCat ransomware attacks on five companies, extorting over $1M using cryptocurrency between 2023–2025.
The shadowy recesses of the internet continue to be a hub for illicit activity and a barometer for emerging cyber threats. Recent law enforcement actions and cybersecurity reports reveal a landscape in constant flux, where criminal marketplaces adapt and new forms of digital contraband emerge with alarming regularity. From the takedown of major platforms to the sale of novel attack tools, the dark web remains a critical front in the ongoing battle for cybersecurity.
- Helix was a widely used darknet mixing service that began operations in 2014, processing up to about 354,468 Bitcoin, worth roughly $311 million at the time, according to a statement from the DOJ on Thursday.
- The civil action follows a criminal case in which Harmon was indicted in 2019 and pleaded guilty in 2021 to conspiring to launder money.
- The Cyber Express weekly roundup for week two of 2026 highlights cyber risks from intelligence leadership changes, Iran’s blackout, major…
- PCPcat triggered a massive cyber espionage campaign, breaching over 59,000 React Servers by exploiting critical vulnerabilities in Next.js.
- Much of the crypto involved came from or went to “darknet drug markets,” with its operator retaining “a percentage of these transactions as his commissions and fees for operating Helix,” the DOJ wrote.
Dark Web News
Marketplace Takedowns and Resilience
In a significant blow to cybercriminal commerce, international operations recently dismantled the "Kingdom Market" darknet platform. This marketplace, which facilitated the trade of drugs, stolen data, and malware, saw its infrastructure seized across several countries. However, analysts note that such takedowns often have a hydra effect; as one site falls, users and vendors quickly migrate to alternative or newly established platforms. The resilience of these networks highlights the ongoing challenge for global law enforcement agencies.
The Rise of AI-Driven Cybercrime Tools
A disturbing trend gaining traction is the proliferation of AI-powered hacking services for sale. Threat actors are now offering "GPT-like" prompts designed to craft sophisticated phishing emails or generate malicious code, lowering the barrier to entry for would-be cybercriminals. Furthermore, there has been a noticeable increase in the sale of large, compromised datasets used to train these AI models, creating a vicious cycle that empowers more advanced attacks.
Critical Infrastructure in the Crosshairs
Recent intelligence gathered from dark web forums suggests a sharp focus on operational technology (OT) systems. Threat groups are actively trading exploits and access points targeting industrial control systems in energy, water, and manufacturing sectors. This shift from financial data to critical infrastructure represents a significant escalation in potential risk, moving from theft to tangible disruption of essential services.
The evolution of dark web activity serves as a stark reminder of the dynamic nature of digital threats. While successful prosecutions and platform seizures are crucial, the underlying ecosystem demonstrates a remarkable capacity for adaptation and innovation in the face of pressure. Continuous monitoring of these hidden channels is not just beneficial but essential for proactive cybersecurity defense.
