Onion Sites 2020: A Look Back

Sections

1. The State of Onion Sites in 2020: Overview
2. Major Marketplace Activity and Shutdowns in 2020
3. The V2 to V3 Onion Migration During 2020
4. Notable Non-Commercial Onion Sites in 2020
5. Cybercrime Forums and Data Breach Ecosystems
6. Dark Web Search Engines and Directories Status in 2020
7. 2020 Security Incidents and Scams
8. What Changed Between 2020 and Today
9. Onion Sites 2020: Major Events Timeline
10. Common Misconceptions and Errors
11. Key Takeaways
12. Still wondering?
13. Sources and further reading

The State of Onion Sites in 2020: Overview

In 2020, the landscape of onion sites underwent significant changes, influenced by both technical developments and law enforcement actions. A notable event was the announcement by the Tor Project regarding the deprecation of version 2 onion services, which began on September 15, 2020. This transition to v3 onion addresses was a critical milestone, with full removal of v2 support planned for July 15, 2021¹.

Law enforcement's Operation DisrupTor marked a pivotal moment in the dark web's operational environment. Launched in September 2020, the operation resulted in 179 arrests across six countries and the seizure of over 500 kilograms of illegal drugs from various darknet marketplace vendors². Additionally, the operation led to the confiscation of $6.5 million in cash and cryptocurrency, highlighting the financial impact on illicit activities³.

The closure of Empire Market on August 22, 2020, further contributed to the turbulent state of onion sites. This marketplace was the largest in 2020 and was believed to have executed an exit scam involving approximately 2,638 BTC (around $30 million)⁴. Such events not only disrupted existing supply chains but also prompted users to seek out new marketplaces, including the emerging White House Market.

Statistical insights reveal a dramatic escalation in dark web activity. According to Sixgill's 2020 Annual Report, there were 1,344,415 non-digital products listed for sale, representing a staggering 223% increase from the previous year⁵. Forum activity also surged, with over 50 million posts collected, a 153% rise compared to 2019, peaking in April 2020 as users turned to the dark web during pandemic lockdowns⁵. The average number of unique monthly users on the top 11 cybercrime forums reached 206,011, indicating a 40% growth from the prior year⁵.

These shifts underline the evolving nature of dark web marketplaces and the significant influence of external factors, such as the COVID-19 pandemic, on user behaviour and marketplace dynamics.

Major Marketplace Activity and Shutdowns in 2020

In 2020, the dark web marketplace landscape was characterised by notable shifts, particularly with the emergence and decline of major players. Empire Market, the largest darknet marketplace at the time, went offline on August 22, 2020, in what is believed to have been an exit scam. Approximately 2,638 BTC, valued at around $30 million, was reportedly taken by the operators during this incident⁴. The sudden closure left many users scrambling to find alternative platforms.

Following Empire Market's exit, White House Market gained traction as a prominent player, distinguishing itself with a monero-only payment policy. This approach aimed to enhance user anonymity and security, attracting a user base concerned about privacy⁵. The marketplace's rise highlighted a shift in user preferences towards platforms that prioritised anonymity amidst increasing scrutiny from law enforcement.

Other significant marketplaces active in 2020 included Versus and Cannazon, which catered to various illicit goods, and Dark Market, which operated until its shutdown in early 2021. Each of these platforms contributed to a diverse ecosystem where users could access a wide range of products, despite the ongoing threats from law enforcement operations.

The impact of law enforcement was profoundly felt throughout the year. Operation DisrupTor, announced in September, resulted in 179 arrests across six countries, alongside the seizure of over 500 kilograms of illegal drugs². The operation also confiscated $6.5 million in cash and cryptocurrencies linked to dark web drug trade operations, underscoring the financial ramifications of law enforcement efforts³. Such actions not only disrupted existing marketplaces but also instilled a sense of uncertainty within the community.

The overall activity in dark web marketplaces was reflected in statistical data, with a staggering 1,344,415 non-digital products listed for sale in 2020, representing a 223% increase from 2019⁵. This surge in listings was accompanied by an increase in forum activity, which peaked in April 2020, driven by pandemic-related interest and lockdown boredom⁵. The year exemplified a turbulent period for onion sites, shaped by both marketplace dynamics and external pressures.

The V2 to V3 Onion Migration During 2020

The transition from version 2 (v2) to version 3 (v3) onion addresses was a significant event in 2020. This change was prompted by the Tor Project's announcement in June 2020, which stated that v2 onion services would begin deprecation on September 15, 2020¹. The full removal of v2 support was scheduled for July 15, 2021¹.

Technical Differences

V3 onion addresses introduced several technical improvements over v2. The most notable change was the length and structure of the addresses; v3 addresses are 56 characters long, compared to the 16-character v2 addresses. This increase in length enhances security and makes brute-force attacks more challenging. Additionally, v3 services support features such as improved cryptographic algorithms and a more robust onion service directory protocol, allowing for better anonymity and resilience against attacks⁶.

Adoption Timeline

Throughout 2020, the adoption of v3 addresses progressed gradually. Following the official deprecation announcement, many site operators began the transition, but a significant number remained on v2 until the final cutoff date. By the end of 2020, estimates indicated that approximately 30% of onion services had migrated to v3, while 70% continued to operate on v2¹.

Challenges Faced by Site Operators

Site operators encountered various challenges during this transition. The need to update existing infrastructure and ensure compatibility with v3 services posed technical hurdles. Additionally, the fear of losing user trust during the migration process was a concern. Many operators were hesitant to switch due to the potential for decreased traffic and engagement, particularly as law enforcement activities, such as Operation DisrupTor, created an uncertain environment²³.

The combination of these factors contributed to a slow but steady migration to v3 onion addresses throughout 2020, marking a pivotal shift in the dark web landscape.

Notable Non-Commercial Onion Sites in 2020

In 2020, several non-commercial onion sites emerged as significant resources for users seeking legitimate services, privacy-focused tools, and community engagement. These sites provided valuable alternatives to the predominantly illicit landscape of the dark web.

Legitimate Services

Prominent among the legitimate onion sites were the mirrors of major news organisations such as ProPublica, the BBC, and The New York Times. These mirrors offered access to information without the risk of censorship, allowing users to engage with journalism in a secure environment. For instance, ProPublica's onion site enabled whistleblowers to share sensitive information anonymously, fostering transparency and accountability¹.

Privacy-Focused Tools and Services

Various privacy-centric tools also gained traction during this period. Services that facilitated secure communications, such as encrypted email providers and anonymous messaging platforms, became increasingly popular. This rise in privacy-focused services reflected a growing awareness of digital rights and the importance of anonymity online.

Forums and Communities

Forums like Dread and Envoy Forum served as hubs for discussion among users interested in the dark web. Dread, often compared to Reddit, provided a platform for users to share experiences, seek advice, and discuss various topics related to onion sites. In 2020, forum activity surged significantly, with over 50 million posts collected across dark web platforms, marking a 153% increase from 2019⁵. This growth was partly attributed to heightened interest in cybercrime and anonymity during the pandemic⁵.

Whistleblowing Platforms

Whistleblowing platforms played a crucial role in facilitating the reporting of corruption and misconduct. The use of these platforms increased in 2020, as individuals sought safe avenues to disclose sensitive information. Such platforms often incorporated robust encryption and anonymous submission processes, ensuring the safety of whistleblowers.

These non-commercial onion sites highlighted a distinctive aspect of the dark web, showcasing its potential for legitimate use and community building, even amidst the challenges posed by law enforcement actions and the deprecation of v2 onion services¹.

Cybercrime Forums and Data Breach Ecosystems

In 2020, cybercrime forums experienced a notable surge in activity, reflecting a growing interest in illicit online activities. The top 11 cybercrime forums tracked by Sixgill reported an average of 206,011 unique monthly users, representing a 40% increase compared to 2019⁵. This uptick was partly fuelled by pandemic-related conditions, which drove users to explore dark web opportunities out of boredom and heightened interest in cybercrime⁵.

Active Carding and Fraud Forums

Carding forums, where stolen credit card information is bought and sold, were particularly active. These platforms facilitated transactions involving compromised card data, with prices varying based on the card's limits and associated risks. The prevalence of such forums contributed to an ecosystem where fraudsters could easily access tools and information necessary for committing cybercrimes.

Major Data Breaches in 2020

Several high-profile data breaches occurred in 2020, significantly impacting user privacy. In March, hackers breached Tokopedia, compromising 91 million user accounts, which were later sold for as little as $5,000 on dark web marketplaces⁷. Additionally, a data breach broker sold databases from 14 different companies, with prices ranging from $100 to $1,100 per database⁸. The hacking group Shiny Hunters also flooded dark web marketplaces with databases containing 73.2 million user records from 11 companies, highlighting the scale of compromised data available⁹.

Evolution of Ransomware Leak Sites

Ransomware leak sites evolved in 2020, becoming prominent platforms where attackers published stolen data from organisations that refused to pay ransoms. These sites not only served as a means for extortion but also as a public shaming tool, pressuring victims to comply. With the increasing sophistication of ransomware attacks, these leak sites became central to the cybercrime landscape, further complicating the response from law enforcement.

The environment of cybercrime forums and data breach ecosystems in 2020 illustrated a dynamic and rapidly evolving landscape. The interplay between heightened forum activity, significant data breaches, and the emergence of ransomware leak sites underscored the ongoing challenges in combating cybercrime. As law enforcement continued to target these activities, the resilience and adaptability of cybercriminals remained evident.

Dark Web Search Engines and Directories Status in 2020

In 2020, several search engines and directories played a crucial role in navigating the dark web, each with its own functionality and reliability. Prominent among these were Torch, Ahmia, and Not Evil, each offering different coverage and indexing capabilities.

Search Engine Functionality

Torch remained one of the oldest and most used search engines for onion sites, boasting a vast index of over 1 million pages. Its simplicity and effectiveness in providing search results made it a go-to resource for users seeking specific content. Ahmia, on the other hand, focused on providing a more curated experience, filtering out illegal content and ensuring that users could find legitimate resources more easily. Not Evil also gained traction, known for its straightforward interface and extensive indexing of dark web sites.

Hidden Wiki Variations

The Hidden Wiki served as a significant directory for onion sites, but its reliability varied greatly. Numerous variations existed, each claiming to be the authoritative source. Users often encountered outdated links or malicious content, making it essential to verify sources before trusting any links provided. This inconsistency highlighted the need for caution when using such directories, as they could lead to harmful or illegal sites.

Indexing Challenges During V2/V3 Transition

The transition from version 2 (v2) to version 3 (v3) onion addresses posed significant challenges for search engines and directories. The Tor Project announced the deprecation of v2 services in June 2020, with warnings issued to operators starting September 15, 2020¹. This transition created a fragmented landscape where many sites remained on v2, complicating the indexing process. As a result, search engines struggled to provide comprehensive coverage, with estimates indicating that about 30% of onion services had migrated to v3 by the end of 2020¹.

Comparison of Directory Coverage

In terms of directory coverage, search engines exhibited varying degrees of success. While Torch managed to index a significant number of v3 addresses, its performance fluctuated during the transition period. Ahmia's curated approach allowed it to maintain higher reliability, but it often lacked the breadth of coverage found in more extensive directories. Not Evil provided a balance between coverage and usability, but its effectiveness was similarly impacted by the ongoing changes in the onion service landscape.

Overall, the status of dark web search engines and directories in 2020 reflected a transitional phase marked by the challenges of adapting to new technologies and the evolving nature of the dark web itself.

2020 Security Incidents and Scams

2020 was marked by significant security incidents and scams within the dark web landscape. Major exit scams, phishing campaigns, and malware distribution methods contributed to a climate of uncertainty and risk for users.

Major Exit Scams

Empire Market, the largest darknet marketplace in 2020, abruptly went offline on August 22, 2020. It is estimated that approximately 2,638 BTC (around $30 million) was lost in this exit scam, leaving many users without recourse to recover their funds⁴. Such incidents highlight the inherent risks of engaging in transactions on unregulated platforms.

Phishing Campaigns

Phishing campaigns targeting dark web users became increasingly prevalent in 2020. Cybercriminals exploited the anonymity of the dark web to lure users into providing sensitive information, often through deceptive emails or fake websites. The combination of heightened user activity and the ongoing pandemic created an environment ripe for these malicious tactics.

Malware Distribution Methods

Malware distribution methods also evolved during this period. Cybercriminals increasingly employed tactics such as drive-by downloads and malicious software bundled with popular illicit goods. These methods allowed attackers to compromise devices without user consent, leading to data theft and further exploitation of victims.

Law Enforcement Deanonymization Techniques

In September 2020, the FBI announced Operation DisrupTor, resulting in 179 arrests across six countries and the seizure of over 500 kilograms of illegal drugs from darknet marketplace vendors². This operation revealed significant law enforcement capabilities in deanonymising users. Techniques employed included the analysis of cryptocurrency transactions and the monitoring of online activities to link real-world identities to dark web personas. The confiscation of $6.5 million in cash and cryptocurrency from drug trade operations underscored the effectiveness of these tactics³.

Conclusion

The events of 2020 illustrated the precarious nature of engaging with the dark web. Users faced substantial risks from exit scams and phishing attacks while also contending with evolving malware distribution techniques. Law enforcement's increasing ability to deanonymise users added another layer of complexity, underscoring the necessity for caution and vigilance in navigating this clandestine landscape.

What Changed Between 2020 and Today

The dark web landscape has undergone significant changes since 2020, marked by the disappearance of key players and the emergence of new ones. Major sites like Empire Market, once the largest darknet marketplace, went offline in August 2020, with an estimated loss of 2,638 BTC (around $30 million) attributed to an exit scam⁴. This event exemplified the volatility of dark web marketplaces, prompting users to reconsider the reliability of platforms they used for transactions.

Disappearing Sites and New Entrants

Many sites that thrived in 2020 have since shut down or evolved. The deprecation of v2 onion services began in September 2020, leading to a gradual transition to v3 addresses¹. By July 2021, support for v2 was completely removed, which affected numerous existing services that failed to adapt¹. In contrast, new marketplaces such as White House Market emerged, filling the void left by the shutdown of older platforms.

Lessons from 2020 Events

The events of 2020 highlighted crucial lessons for users and researchers alike. Law enforcement's Operation DisrupTor, which resulted in 179 arrests and the seizure of substantial quantities of illegal drugs, demonstrated the increasing capabilities of authorities in deanonymising users²³. This operation served as a stark reminder of the risks involved in engaging with the dark web, prompting many to adopt more cautious approaches.

Current Status of Major 2020 Players

As of now, several major players from 2020 are still active, albeit in a transformed capacity. Marketplaces that successfully transitioned to v3 onion addresses, alongside enhanced security measures, have continued to operate. The Dread forum remains a vital community hub, facilitating discussions among users interested in dark web activities. Moreover, the rise of ransomware leak sites has reshaped the landscape, as attackers increasingly publish stolen data from organisations unwilling to pay ransoms.

In summary, while some significant sites have disappeared since 2020, others have adapted and thrived in the evolving dark web environment. The ongoing transition from v2 to v3 onion services, coupled with increased law enforcement scrutiny, underscores the necessity for vigilance and adaptability among users and researchers navigating this complex landscape.

Onion Sites 2020: Major Events Timeline

Date	Event	Details	Source
March 2020	Tokopedia Data Breach	91 million accounts compromised, sold for $5,000	[7]
April 2020	Forum Activity Peak	5,159,965 posts collected, pandemic influence	[5]
June 2020	Tor v2 Deprecation Announcement	Deprecation warnings issued for v2 services	[1]
August 22, 2020	Empire Market Closure	Estimated $30 million lost in exit scam	[4]
September 2020	Operation DisrupTor	179 arrests, $6.5 million seized	[2][3]
September 15, 2020	v2 Deprecation Begins	Warnings to operators and clients	[1]

Common Misconceptions and Errors

Assuming v2 Onion Addresses Remained Functional Throughout 2020

Many users believed that v2 onion services would continue operating normally throughout 2020. In reality, the Tor Project announced in June 2020 that deprecation would begin on September 15, 2020, with warnings issued to operators and clients¹. Sites that failed to migrate faced inevitable shutdown, yet numerous users continued bookmarking and sharing v2 addresses without recognising the impending obsolescence. By July 2021, v2 support was completely removed from the codebase¹. Researchers and users should verify whether historical addresses have v3 equivalents rather than attempting to access outdated v2 links.

Trusting Marketplace Longevity Based on Size

The common belief that larger marketplaces offered greater stability proved catastrophically wrong in 2020. Empire Market, the largest darknet marketplace that year, abruptly vanished on August 22, 2020, taking approximately 2,638 BTC (around $30 million) in what is believed to be an exit scam⁴. Size and popularity provided no protection against operator fraud. Users should maintain scepticism regardless of a platform's apparent dominance and avoid storing significant funds in marketplace escrow systems, regardless of reputation.

Overlooking the Pandemic's Impact on Dark Web Activity

Observers frequently attribute 2020 dark web growth solely to technological factors whilst ignoring pandemic-related behavioural shifts. Forum posts peaked in April 2020 with 5,159,965 items collected, partly driven by lockdown boredom and increased interest in cybercrime⁵. The top 11 cybercrime forums averaged 206,011 unique monthly users, representing 140% of 2019's figure⁵. This surge reflected broader societal disruption rather than purely technical evolution. Analysts examining 2020 data should account for these contextual factors rather than treating activity spikes as purely platform-driven phenomena.

Believing Tor Alone Guarantees Anonymity

The assumption that using Tor automatically ensures complete anonymity was decisively challenged in 2020. Operation DisrupTor resulted in 179 arrests across six countries and the seizure of $6.5 million in cash and cryptocurrency²³. Law enforcement demonstrated sophisticated deanonymisation techniques, including cryptocurrency transaction analysis and cross-platform identity correlation. Users must recognise that Tor provides a layer of protection, not absolute immunity. Operational security extends beyond network anonymity to include payment methods, communication patterns, and avoiding reused identifiers across platforms.

Treating All Dark Web Directories as Equally Reliable

Users often assume that any Hidden Wiki variation or directory provides accurate, current information. In 2020, the v2 to v3 transition created significant fragmentation, with estimates suggesting only 30% of onion services had migrated to v3 by year's end. Many directories contained outdated v2 addresses, malicious links, or phishing sites masquerading as legitimate services. The lack of centralised authority means directory quality varies dramatically. Cross-reference multiple sources, verify addresses through trusted community channels, and treat any single directory as potentially compromised or outdated rather than authoritative.

Key Takeaways

• V2 deprecation reshaped accessibility: September 2020 marked the beginning of v2 onion service obsolescence, forcing operators to migrate or disappear entirely by July 2021¹.

• Marketplace size offered no protection: Empire Market's $30 million exit scam in August 2020 proved that dominance does not guarantee trustworthiness⁴.

• Pandemic drove unprecedented activity: Forum posts peaked at 5,159,965 in April 2020, reflecting lockdown-driven interest rather than purely technical growth⁵.

• Law enforcement capabilities advanced significantly: Operation DisrupTor's 179 arrests demonstrated sophisticated deanonymisation techniques, challenging assumptions about Tor's absolute anonymity²³.

• Directory reliability varied dramatically: The v2-to-v3 transition created fragmentation, with many directories listing outdated or malicious links throughout 2020.

For practical guidance on navigating today's onion landscape safely, consult Exploring the Dark Web: A Comprehensive Overview.

Still wondering?

How can I search for .onion sites?

Specialised dark web search engines like Ahmia, Torch, and notEvil index onion services, though coverage remains incomplete compared to clearnet search. Directory sites such as The Hidden Wiki aggregate links by category, but the v2-to-v3 transition in 2020 left many directories listing outdated addresses. Cross-reference multiple sources and verify addresses through trusted community forums like Dread, as no single directory provides comprehensive or guaranteed-current listings.

Can Google access .onion sites?

Google and conventional search engines cannot index .onion sites because these addresses exist exclusively within the Tor network and lack DNS resolution on the clearnet. Accessing onion services requires the Tor Browser or similar software configured to route traffic through Tor relays. Even if Google could technically crawl these sites, the anonymity-focused nature of the dark web means most operators actively prevent indexing through robots.txt directives and other technical barriers.

Is it safe to visit onion sites?

Visiting onion sites carries substantial risks beyond technical anonymity. Operation DisrupTor in September 2020 resulted in 179 arrests, demonstrating law enforcement's ability to deanonymise users through cryptocurrency analysis and cross-platform correlation²³. Exit scams like Empire Market's $30 million theft in August 2020 show financial dangers⁴, whilst phishing attacks and malware distribution peaked during 2020's pandemic-driven activity surge⁵. Tor provides network-level protection but does not eliminate operational security requirements or legal consequences for accessing illegal content.

Sources and further reading

• 1. Onion Service version 2 deprecation timeline | The Tor Project
• 2. Operation DisrupTor — FBI
• 3. 179 Arrested in Massive Global Dark Web Takedown | WIRED
• 4. Closure of Darknet Empire Market Believed to Be $30M Exit Scam - Decrypt
• 5. 2020 Annual report_final PR.docx
• 6. [tor-dev] Onion Service v2 Deprecation Timeline
• 7. Hacker sells 91 million Tokopedia accounts, cracked passwords shared
• 8. Seller floods hacker forum with data stolen from 14 companies
• 9. Hacker group floods dark web with data stolen from 11 companies