Sage Journals: Discover world-class research

Abstract

Cryptomarkets are increasingly requiring users to purchase products with Monero (a ‘privacy coin’) to further obfuscate the digital trail of money compared to conventional cryptocurrencies (e.g. Bitcoin). This is the first study to explore how cryptomarket communities are used to facilitate norms and behaviours to expedite these emerging cryptocurrency practices. Through a qualitative analysis of Monero threads in a Reddit cryptomarket community (3451 total posts), this research illustrates how online communities often underpin the adoption of new technologies in cryptomarkets. The findings reveal: how the online community functions, adapts, and fails to support cryptocurrency transitions; the appraisal and contestation of cryptocurrency risks; and the ideological drivers and symbolic resources used to align community practices to adopt Monero. This research contributes to an understanding of the processes that underpin the constant evolution of online illicit markets as human and non-human elements are constantly re-assembled.

Keywords

Cryptocurrency cryptomarket cybercrime Monero online community online illicit markets

Introduction

Online illicit markets – digital platforms that provide mechanisms to distribute illicit goods and services – have evolved significantly over the last two decades. These markets have undergone generational shifts as new technologies emerge and cybercrime actors harness digital spaces that best suit their needs (Collier et al., 2021; Steel, 2019). The growing diversification of online illicit drug markets provides a prime example of these shifts in recent years. While the archetypal Silk Road marketplace previously dominated academic and media discourses on cryptomarkets (Martin, 2014), the years since its closure have launched many different competing cryptomarket formations including ‘single-vendor’ (Flamand and Decary-Hetu, 2019) marketplaces that are not conducive to the browsing and comparison features that popularised early cryptomarkets. Furthermore, in the case of illicit drug supply, trade on cryptomarkets now only represents a small portion of the overall online trade as a variety of digital technologies such as social media and encrypted messaging applications are integral in contemporary supply arrangements (Demant et al., 2019; Moyle et al., 2019; Van der Sanden et al., 2022). These shifts in online illicit markets are noted for a wide range of products and services (e.g. fraud and hacking services, child exploitation material, and firearms distributors) as actors utilise new technologies and contribute to the ongoing evolution of market formations. The relatively short history of online illicit markets has shown that these are often unstable sites of exchange as new technologies are quickly embraced (and then rejected) and new practices are adopted (and then abandoned).

This is the first study to explore how cryptomarket actors are responding to emerging shifts in cryptocurrency practices. Contributing to recent criminological work on cryptocurrencies and online illicit marketplaces (Holt et al., 2023), this study examines the rising popularity of ‘privacy coins’ in cryptomarkets. Privacy coins, such as Monero,¹ entail new barriers to entry compared to traditional cryptocurrencies (e.g. Bitcoin), and thus, this offers an opportunity to examine how new technologies are adopted in illicit market ecosystems. This article begins by first describing the rise of ‘privacy coins’ such as Monero and how they are distinguished from other cryptocurrencies. Next, as a way to conceptualise these constant transformations taking place within online illicit markets, the notion of assemblage (Deleuze and Guattari, 1988) is used to contextualise the various human and non-human elements that (re)shape online illicit markets over time. Attention is placed on the social processes the shape technology adoption among cybercrime actors as online communities are used to share experiences, resources, and sentiments on new technologies. Understanding these processes of how online communities shape the adoption of new technologies can provide valuable insights on the dynamics and evolution of online illicit markets.

The shift to ‘privacy’ coins in cryptomarkets

The use of cryptocurrencies to facilitate exchanges is one of the defining features of cryptomarkets that demarcates them from other forms of illicit activity in Tor browser environments (Martin, 2014). Bitcoin, the first widely popularised cryptocurrency, is ‘a computer-based currency with no physical legal counterpart, used as a medium of exchange through an open system of computer networks and online communication protocols’ (Wamba et al., 2020). Bitcoin was developed to enable peer-to-peer digital transactions without a third-party institution (e.g. bank) as transactions are instead facilitated through the blockchain: an open source and distributed digital ledger that records publicly visible records of transactions between cryptocurrency wallets (Mik, 2017; Wamba et al., 2020).

Despite its widespread use, however, cryptocurrencies such as Bitcoin are only ever pseudonymous and lack the anonymity it is believed to possess by cybercrime actors. Empirical research from Al Jawaheri et al. (2020), for example, highlights that Bitcoin addresses can deanonymise users retroactively and Dearden and Tucker (2023) recently showed how transactions can easily be examined from cryptomarkets. The many private companies that have emerged to trace cryptocurrency transactions also demonstrates the increasing recognition that Bitcoin transactions are not entirely anonymous for cybercrime actors. For example, blockchain analytics companies such as MistTrack² ‘use on-chain analytics to assist in the tracing of illicit funds’ and CipherBlade³ use blockchain forensics to investigate ‘Bitcoin belonging to suspects in hundreds of cybercrime cases’. As a response, contemporary cryptocurrency practices in online illicit markets often includes the use of a combination of mixing services that obfuscate the digital trails of cryptocurrencies (Desmond et al., 2019; Holt et al., 2023) and, the focus of this article, the use of ‘privacy coins’.

Privacy coins provide higher levels of privacy and anonymity in comparison to other cryptocurrencies through hidden transactions, no public blockchain, untraceable wallets and decoy coins to make tracing funds extremely difficult (if not impossible; Moser et al., 2017; Silfversten et al., 2020). Recent evidence suggests that there is a considerable shift towards privacy coins in online illicit marketplaces. Monero has been accepted by major cryptomarkets as a payment method since 2016, and it was estimated in 2019 that one-third of markets accepted Monero (United Nations Office on Drugs and Crime (UNODC), 2020). This corresponds with wider evidence (Chainalysis, 2022; Web-IQ, 2021) indicated the increasing acceptance of privacy coins in dark web environments. Some cryptomarkets (e.g. White House Market, Archetyp) even transitioned to privacy coins as the default payment method on their marketplaces (Horton-Eddison et al., 2021; Spilotro, 2020). The evidence discussed earlier indicates the growing adoption of Monero, however, there is no extant research investigating how cybercrime actors respond to these shifts and the processes that underpin the adoption of new technologies. This study responds to this lack of research by exploring how online communities negotiate these shifts in technology practices.

Online illicit marketplaces as assemblages

A focus on emerging cryptocurrency practices in cryptomarkets can be situated within the assemblage of human and non-human forces that assemble in online illicit marketplaces. The notion of the assemblage emphasises the emergent coming together of heterogenous forces to form a dynamic system (Deleuze and Guattari, 1988). Delanda’s (2006) further reflections of the assemblage also notes that this assemblage of heterogenous elements does not cause individual components to lose their individuality. In addition, assemblages are not a static constitution of human and non-human elements, but rather, are constantly changing as new elements are added/removed and the relations between various elements shifts. Following bourgeoning criminological work incorporating Science and Technology Studies and assemblage-thinking (see Crewe, 2010; Goldsmith and Wall, 2022; Van der Wagen and Pieters, 2020), assemblages can also provide a useful depiction of the elements and relations that come together to construct online illicit markets (Childs et al., 2020a). This provides the impetus for recognising online illicit markets as the coming together of individual practices and norms, the technological infrastructure required for coordinating activity (e.g. encryption, platforms and their technological affordances), as well as the cultural and legal contexts shaping marketplaces. Online illicit markets are, therefore, always in a process of ‘becoming’ (Renold and Ringrose, 2011) as they are constantly (re)shaped with the incorporation and removal of human and non-human elements.

Knowledge sharing in cybercrime communities

The notion of assemblage allows researchers to attend to the various elements that come together to shape online illicit markets as they evolve over time. This can also open up new lines of inquiry to examine ‘. . . the socio-material, human and non-human, political and economic structures which determines the way it [the assemblage] operates and the work that it does’ (Maalsen, 2020). This study focuses on the evolution of technological change in online illicit markets by exploring how online communities negotiate these shifts in technology practices. The study of subcultures and online communities has become increasingly important in understanding how social networks facilitate adherence to particular values, norms, and behaviours in cybercrime (Holt, 2020b; Leukfeldt and Holt, 2019; Webber and Yip, 2019). Bada et al. (2021) further note how online forums are foundational to cybercrimes in ‘facilitating and spreading of ideas, specialist knowledge and norms’. These processes of collective sensemaking, a process of reflecting on and interpreting phenomena to produce intersubjective accounts, is essential to understand how online communities resolve ambiguity, reflect on practices, and establish norms (Bourne, 2017; Weick, 1995).

Online knowledge-sharing communities have become a critical part of the cybercrime ecosystem where actors are continually required to adopt new technologies. This is prominent in particular market structures, such as cryptomarkets, that emphasise the need for online communities to counter the lack of information provided by marketplace administrators (Kowalski et al., 2019). In the case of cryptomarkets, the social networking site Reddit is an integral part of accumulating information before purchasing (Jardine, 2021). Despite the closure of previous spaces (e.g. r/DarkNetMarkets⁴), dedicated Reddit forums (termed ‘subreddits’) provide a space for community members to share guides and resources, ask questions, and reflect on practices (Bancroft and Reid, 2017). The integral nature of these information channels and the popularity of these communities for cryptomarket users suggests that new technologies, such as Monero, are not passively integrated into cryptomarket practices, but become adopted following collective sensemaking processes that occur in online communities.

The current study

Cryptomarkets, as is the case with online illicit markets more broadly, are continually being reshaped as they take on new formations that requires cybercrime actors to adapt their practices. This is the first study to explore how online communities have responded to, and adopted, emerging cryptocurrency practices in cryptomarkets. This is achieved through a qualitative study investigating Monero discourses on a cryptomarket community hosted on Reddit where a range of cryptomarket users share experiences and information on cryptomarket use. This reveals how online communities negotiate and interpret technological shifts that take place in constantly evolving markets.

Methods

Digital environments have provided new opportunities for studying hard-to-reach populations (Kaufmann and Tzanetakis, 2020). The criminological use of forum data in qualitative research understanding emerging cybercrime topics also continues to show promise (Holt, 2015, 2020a). To that end, this study uses forum data from the social networking site Reddit (www.reddit.com) to explore the collective sensemaking practices involved in shifting to Monero in a cryptomarket community. Reddit is a popular online discussion forum that is home to a diverse community of users who share and discuss content on a wide range of topics. The platform is organised into ‘subreddits’ that are dedicated to specific topics or interests and are moderated by volunteers. Users can submit initial posts as text, images or links, and then engage in discussions through reply comments, upvotes or downvotes. Due to its user-driven nature, Reddit has become a popular site for the study of online communities and understanding how users interact and share information in digital spaces (Proferes et al., 2021).

This study uses forum posts collected from the r/darknet community. At the time of this research in early 2023, the r/darknet community had over 250,000 members, thus making it the largest Reddit-based cryptomarket community. To understand the adoption of Monero in cryptomarket communities, this study collected 100 ‘top’ (most upvoted posts) ranked Monero posts, along with the associated comments within each of these forum posts. This meant that both the original post and subsequent discussions that unfolded throughout the post were captured in the data collection (i.e. the entire ‘thread’). Studying Reddit forums through ‘top’ posts and keyword searches is a common approach (see Johnson et al., 2023; Moore and Abetz, 2019), and so, to collect the posts for this study, a keyword search was conducted on the word Monero. The threads were collected from ‘all time’, as capturing the development of this topic over time was important. The number of posts collected was determined through a reflexive approach (Braun and Clarke, 2021), whereby, following an initial scope of the collected threads, there was significant diversity in the content of posts (e.g. discussions between community members, comparisons of cryptocurrencies), variation in the community members contributing to discussions and progressions in certain topics over time to capture the evolving assemblages of illicit practices. The Google Chrome plug-in tool Simplescraper was used to collect the text data on relevant forum posts to provide a ‘middle-ground’ approach between automated scraping processes (e.g. crawling URLs) and manually copying forum posts. The benefit of this approach was that it allowed a manual inspection of all comments prior to collection to ensure that some comments, such as those that had been deleted or comments were from bots,⁵ were not copied across or included in the final analysis. The result was a total collection of 3451 English-language posts containing Monero discourse that ranged over a significant period (3 March 2019 to 24 December 2022).

Some limitations of this methodological approach should be noted. This method intended to capture perceptions of Monero across a wide range of actors who use cryptomarkets (e.g. ransomware services, drugs, fraud documents, firearms), however, the posts appeared to overwhelmingly discuss the use of the cryptomarkets for illicit drug purchases compared to other listings. Although this is not surprising given the overrepresentation of drug listings on cryptomarkets compared to other goods and services (Broséus et al., 2017), it does provide some caution against interpreting the perception and adoption of Monero as equally shared among different groups that use cryptomarkets. There are also noteworthy limitations with keyword searches. For instance, searching only for ‘Monero’ posts might have excluded some popular community posts when Monero abbreviated to ‘XMR’, but these excluded posts generally do not significantly alter exploratory findings on emerging trends (see Childs et al., 2020b).

The database of collected forum posts was uploaded into NVivo to assist in the analysis of online community discussions. I then followed the broad principles outlined in reflexive thematic analysis (Braun and Clarke, 2019; Campbell et al., 2021): familiarising oneself with the data, identifying and generating initial codes, generating themes, reviewing and refining themes, and defining and naming themes. During this process, I took an inductive and deductive approach to analysis that allowed the development of themes to be guided by the aims and theoretical frameworks used in this research (e.g. exploring how communities assist in the transition of new technologies, understanding online illicit markets as assemblages), the researcher’s role in unpacking meaning, as well as remaining open to unanticipated discourses in the forum posts. This study relied on publicly available data but followed widely published ethical guidelines on working with available online forum data, such as not collecting usernames or identifying information on contributors and, where appropriate, slightly editing reported quotes to minimise identification at a later stage (Franzke et al., 2020). Some topics (e.g. investment speculation for cryptocurrencies, personal attacks on users, spam) were noted during the analysis as a minor portion of the overall data, but as they were ultimately not relevant to addressing the research question, they were not deemed as significant to be reported in depth. The result is a set of findings that illustrate how online communities perform collective sensemaking practices in order to incorporate new cryptocurrency practices.

Findings

The “Findings” section reports on three themes generated from the thematic analysis of Monero posts in r/darknet: (1) The functions, adaptations and failures of communities that captures the role of community for newcomers and experienced users, shifting marketplace structures and the challenges of relying on online communities to guide technology transitions; (2) appraising and contesting cryptocurrency risks explores the varied perceptions of digital traces and risk management strategies that shape cryptocurrency adoption; and (3) the ideological and symbolic drivers of Monero adoption in cryptomarkets discuss how cyber libertarianism, the imagined futures of cryptomarkets, the normalisation of practices and communication of ideologies facilitates technology adoption.

The functions, adaptations and failures of communities

Community support is essential in understanding the processes and barriers for Monero transitions and how the community functions, adapts and fails at supporting these cryptocurrency shifts. Most posts included in the analysis involved direct requests for help from other community members in the form of step-by-step instructions on the appropriate strategies for purchasing and using Monero in cryptomarkets. Unsurprisingly, this appeared to be mostly helpful for actors who had never previously engaged in cryptomarkets, as indicated by the community members that prefaced their requests for support by describing themselves as a newcomer to the scene:

. . . I’m super new to all this dark web stuff

This is amazing for those of us completely new to darknet and crypto . . .

These statements, along with a wide body of criminological research on how crime can be facilitated by social networks (Mills et al., 2021), suggest how online communities are integral in facilitating the adoption of technology for new entrants into online illicit markets. Interestingly, there were also posts from community members that had a long history of involvement in cryptomarkets and were only beginning their transition to using Monero. The range of different levels of experience and technological expertise in the online community indicated some diversity in the types of actors requiring support in adopting new cryptocurrency practices.

The requests for assistance from experienced users also showed how technological shifts in cryptomarket practices may not always be the result of individual choices. Rather, what was noticeable in the forum posts were how the structures of cryptomarkets restricted personal choices of technology preferences by imposing the adoption of new technologies on actors, and communities had to adapt corresponding to these market shifts. The following posts reveal how community members noted changes in their cryptocurrency practices as something primarily driven by marketplace structures and the instability of cryptomarkets:

I’ve been away from markets for a while. Last time was when [market] was booming. Now it seems like Monero is the go-to thing?

[Reply in response to a community member asking: ‘What happened to Bitcoin’] Alright, well you let me know if you still see any markets left that operate with Bitcoin . . . it’s virtually just [market] left now who doesn’t want to use Bitcoin anymore.

These posts also revealed the adaptation of cryptomarket communities to community facilitate shifts in behaviours following policing interventions. Policing efforts on cryptomarkets, often resembling large inter-agency operations that aim to shut down popular marketplaces, have mostly been unsuccessful, short-lived, or resulted in unanticipated changes in behaviour (Decary-Hetu and Giommoni, 2017). Spatial displacement, where vendors are swiftly able to begin trade on an alternate market, is often a repercussion of such policing efforts on cryptomarkets (Ladegaard, 2019; Ouellet et al., 2022). Crime displacement in online illicit markets also has tactical attributes as vendors and buyers modify their tactics and adopt new technologies to maintain efficient exchanges (Childs et al., 2022). Although individual perceptions of the requirement to adopt Monero varied significantly, as explored later in this article, it was evident that policing activity in cryptomarket environments has caused marketplace administrators to alter their market structures to protect their trade and this subsequently has flow-on effects for customers (new and experienced) who use online communities to navigate these technology shifts.

This restructuring of cryptomarkets required individuals to seek help from other community members on the process of using Monero. This usually entailed comparisons to other cryptocurrencies to establish how Monero is harder to acquire and use than Bitcoin, and the function of the community was to locate the cryptocurrency exchanges and wallets that support Monero. One of the primary points of concern in understanding the process of Monero acquisition was the influence of ‘Know Your Customer’ (KYC) regulations on cryptocurrency exchanges (‘Don’t want to use a centralised exchange as I don’t want to KYC’). KYC requirements stem from heightened regulations in the financial industry to curb money laundering and terrorist financing and require financial institutions to collect and authenticate information on clients’ identity, proof of address and risk profile. Cryptocurrency exchanges (albeit inconsistently) are increasingly subject to these requirements (Dupuis and Gleason, 2021) and this is now influencing the perceived anonymity of cryptocurrencies by cybercrime actors. To maintain the hidden nature of cryptomarket activity by using Monero, online community members posed solutions to avoid KYC requirements, primarily by using decentralised exchanges that function as peer-to-peer cryptocurrency trading services. However, these solutions to avoiding KYC requirements inevitably made the cryptocurrency acquisition process more complex and increased the difficulty of being able to use cryptomarkets.

The r/darknet community was used as a hub to guide the transition to Monero. However, the analysis also revealed that there were various challenges when using online communities for supporting changing practices. First, because these communities often emphasise self-reliance, the requests for help were sometimes met with frustration from community members at having to consistently repeat information on the processes involved for acquiring and using Monero (‘. . . the time it took to find this sub and type out the same question they could type it in Google and get more accurate information in the first page of results . . .’). Encouraging greater self-reliance in the cryptomarket community was a mechanism to make sure that certain topics (e.g. discussions on nefarious vendors, important marketplace updates) would be more prominent within the community rather than tedious technical requests. Second, although a benefit of online communities is that they encourage participation from actors regardless of geographical location, this also caused challenges in community sensemaking practices because Monero acquisition strategies could differ depending on regions (‘Don’t think that’ll work for him since he’s in the US . . .’). Finally, the cryptomarket community members also had to contend with the disruption of information caused by technology companies’ content moderation processes and the general instability of digital environments (e.g. shared website links becoming unavailable). In one example, a link sharing cryptomarket drug buying information that also included resources for acquiring Monero was provided in a shared ‘Google Docs’ that was deleting for violating Google’s Terms of Service:

Figure 1.

Google disrupting the flow of information in the online community.

This section has examined the functions, adaptations and failures of the cryptomarket community in helping cryptomarkets users adopt new cryptocurrencies. The analysis has highlighted the impetus behind community requests for assistance, how the online community navigate barriers and some of the challenges faced when seeking support and guidance from online communities.

Appraising and contesting cryptocurrency risks

These shifts in cryptocurrency practices entail greater technical barriers for individuals wanting to use cryptomarkets. The technical difficulties required to purchase products and services from cryptomarket is historically one of the primary barriers against higher utilisation of these illicit markets (Childs et al., 2022; Kowalski et al., 2018). This section shifts from the role of the community to explicate how the cryptomarket community justified these increased barriers by appraising (and contesting) cryptocurrency risks.

Cryptomarkets are constructed to alleviate many of the risks associated with engagement in illicit markets by introducing features to gauge seller trustworthiness and product reliability (Bakken et al., 2018). However, participating in digital environments can also introduce new risks due to digital traces associated with criminal involvement, and actors are often aware of ever-expanding intelligence and surveillance capabilities that can exploit their digital traces (Childs, 2023). These risk perceptions regarding law enforcement were important in justifying the increased barriers required by the Monero transition in cryptomarkets, particularly when comparisons were made to previously used cryptocurrencies:

‘. . .What a fucking hassle, I miss the good old days of just sending Bitcoin and that was that’. [Reply]: ‘Do you miss the days of cops showing up at your door because your OPSEC blows?’

Cryptomarkets require the constant negotiation of accessibility and control from perceived risks (Van Hout and Bingham, 2014). Martin et al. (2020) similarly discusses how cryptomarket vendors will aim to operate in a ‘goldilocks zone’ by acquiring sufficient profit without attracting unnecessary risks. The cryptomarket community in this study widely acknowledged that although privacy coins made effectively using cryptomarkets more difficult these barriers to adoption were required to safeguard markets and participants:

It’s supposed to be a little difficult and make you do your research so that way you actually understand what you’re doing when you’re doing it. Otherwise you’re low hanging fruit.

Rather than finding the cryptomarket community overwhelmingly endorsed the transition to Monero as a risk-reduction strategy, the forum posts also showed that there was considerable diversity in opinions. Specifically, the notion that Monero was needed to reduce risk from law enforcement appeared to differ depending on an individual’s role in cryptomarkets (‘Does Monero matter if you’re not a vendor or anything though?’) and the quantity of purchases being made:

I agree but just use btc if your just buying low/personal stuff don’t think the feds are going to trace your btc for small amount of stuff lol

No one is following a trail of your bitcoin to buy personal shit . . .

These varying risk perceptions on cryptocurrencies reflected Lupton’s (2013) view that risks should be understood as fluid and ongoing rather than static. Some forum posters also believed that using Monero would actually increase risks as it was comparable to painting ‘a big “I buy drugs” bullseye on you’. These assessments of risks were constructed in the cryptomarket community by also integrating relevant news articles (‘Discussing the insights from the Justice Department’s criminal complaint of market . . . LE seems to have no problem following Bitcoin transactions . . .’) and industry reports (‘Chainalysis new crypto crime report does NOT mention Monero or XMR ONCE . . .’) to inform their judgements.

The contestation of cryptocurrency risks, and ability for risk to be managed, was also revealed in the forum posts employing humour and trolling:

Only secure way is to secure with public key, copy it all, secure again, send to dealer in chunks with a riddle stating the order these chunks go into to remake the message (of course, this would also be double PGP’d with every A replaced with a C and every C replaced with a * and every * replaced with two A’s, as per standard OPSEC guidelines). If you didn’t do this, look for the black helicopters buddy

Humour is often used to negotiate and manage risk experiences (Dickinson and Wright, 2017; Parkhill et al., 2011). In this study, the humour-related posts demonstrated the subjectivity and fluidness of risk perceptions in cryptomarket users. Security strategies that are overly onerous, and therefore not commensurate with the actual risks faced when using cryptomarkets, were mocked, and too much discussion of cryptocurrency risks (and other security processes that must be rigidly followed) was perceived as something that could heighten anxieties in the online community. Humour was employed to challenge conventional assumptions of risk and initiate further discussions about security practices. As highlighted elsewhere (Barratt and Maddox, 2016), these forms of trolling in cryptomarket communities can occasionally escalate into toxicity and arguments between community members. In these instances, the technological affordances of Reddit assisted in ensuring these disputes between community members would not derail important conversations. The ability to ‘upvote’ and ‘downvote’ comments on Reddit simultaneously helped signal the community’s agreement on certain security measures as well as hiding the toxic comments with too many downvotes.

Successfully navigating risks is one of the key aspects of using online illicit markets. Although it was widely acknowledged that privacy coins such as Monero have greater barriers for adoption and use in cryptomarkets, the cryptomarket community played an important role in justifying these additional barriers by appraising cryptocurrency risks. Cryptocurrency risk assessments varied considerably, and these fluid assessments of risk would depend on an individual’s market position (as a vendor or buyer), their purchasing habits, and their ability to engage in the community dialogue to form their own judgement on whether they should transition to privacy coins.

The ideological and symbolic drivers of Monero adoption

The above sections of this analysis emphasised how marketplace adaptations and risk assessments of police have been significant forces in evolving cryptocurrency practices in cryptomarkets. Here, I turn attention to the ideological and symbolic drivers of Monero’s adoption in the cryptomarket community. The practical components of Monero were well-known to many online community members (e.g. obfuscating the digital trails of purchasing behaviours), but Monero has also emerged as the preferred option because it is more closely aligned to the ideologies of cryptomarkets. Cryptomarkets were initially constructed to resemble libertarian values of open expression and free trade (Maddox et al., 2016; Moore and Rid, 2016). Although discourses on politics and the expressed ideologies of cryptomarket users has declined over time (Munksgaard and Demant, 2016), it was nonetheless clear that Monero had ideological appeal for cryptomarket users who sought technology to free them from centralised institutions and preserve their online privacy:

We have Linux. We have Tor. We have Monero. These give us freedom of expression, association, and trade.

Traditional cryptocurrencies such as Bitcoin, Ethereum and Litecoin were regarded as ‘surveillance coins’ on a ‘surveillance blockchain’ and distributed through cryptocurrency exchanges that are ‘basically a big tech company’. This shared language was common in the community to criticise government regulations on cryptocurrencies (and cryptocurrency exchanges) and condemn the cryptocurrency exchanges that willingly cooperate with law enforcement. The online community members would also engage in ‘crossposting’, where posts from privacy-centric subreddits such as r/privacytoolsIO, r/tor_noobs, and r/Monero were shared into the cryptomarket community, thus highlighting the interconnected nature of this cryptomarket reddit community with privacy-centric ideologies and the platform features that make this possible.

Community members also openly shared visions of the future to spread the crypto-ideologies that facilitate technological shifts in cryptomarkets:

We must always be evolving to stay away from those that want to shut us down. This may or may not be the next step but we have to be open to new ideas

These predictions of the future generally concerned the progression of cryptocurrency and blockchain technologies and how these could be co-opted for the organisation of illicit markets. This provides an active illustration of the ways that cryptomarket communities attempt to transform their values into environments (Maddox et al., 2016). Here, these imagined futures considered ways of harnessing blockchain technology to create ‘self-infrastructuring’ communities whereby ‘people are able to participate in designing, owning, operating, governing, and/or maintaining their own infrastructure’ (Nabben, 2023). In a practical sense, community members considered the feasibility of establishing a blockchain-based decentralised market (i.e. relying on peer-to-peer network architecture rather than a central server or authority), including finding vendors willing to operate on these new market types, and understanding how customers will be protected:

Finally the cypherpunk’s dream has come to realization, a truly decentralized p2p marketplace that preserves 100% of its users privacy is getting ready to launch

Online communities will share symbolic resources to connect with community members, communicate adherence to norms and ideologies, and align viewpoints on topics (Literat and Kligler-Vilenchik, 2019). Similarly, the development of community resources, such as guides as frequently asked questions (FAQs), has material purposes in how they contribute to making cryptomarkets more user-friendly, but these symbolic resources also serve to normalise practices. The normalisation of Monero, facilitated through its integration with operational security (OPSEC) guidelines, legitimises Monero as the default cryptocurrency to use on cryptomarkets:

Anyway . . . be extra tight on OPSEC!!!! Always use Monero!!!! Always use PGP to encrypt all important emails & such!!!! Never get greedy or in such a rush to order that you put yourself at risk!!!!

The symbolic resources were also reflected in the popular Monero posts that used memes to communicate messages on Monero. Memes have received limited scholarly attention from criminologists (Wood and McGovern, 2021), but they are a vital part of online communities and offer unique insights into online practices (Highfield and Leaver, 2016). Memes are used as symbolic expressions of the ideas, emotions, and cultural values of online communities, and in their implementation, they assist in constructing the identity of individuals and online communities (Burton, 2019; Gal et al., 2016). The features of Reddit enabled the sharing of material beyond text-based posts and the platform affords meme sharing as an effective way to spread ideas in the cryptomarket community.

Figure 2.

Examples of popular Monero memes shared in the dark web community.

In this cryptomarket community, memes normalised practices and ideologies by simplifying and diversifying messages into the community. The first meme pictured, in the style of the Sure, Grandma, Let’s Get You To Bed meme,⁶ is premised on the idea that Bitcoin is an outdated form of technology and that there are dismissive attitudes towards the continued use of Bitcoin. The second meme (Distracted Boyfriend)⁷ suggests disinterest in blockchain forensics companies promoting new means of analysing blockchain transactions given the ability of Monero to implement new methods of obfuscation to enhance the privacy of the coin. These memes were symbolic resources to align norms and viewpoints in the online community, but they also promoted discussions between the community members: ‘This shitpost turned into a super helpful thread’.

Ideologies provide the underlying belief systems and values that drive the formation of online illicit markets. Monero had practical attributes and appeal from cryptomarket users to reduce the perceived risks of engaging in these markets, but it was also ideologically justified through privacy-centric and libertarian ideologies. Symbolic resources, such as memes and community resources, also served to normalise practices, reinforce expressed ideologies, and align the practices of community members.

Conclusion

Online illicit markets are assemblages of always re-arranging elements that shape the organisation and structure of markets. One recent change that has attracted little attention from criminologists, and was the primary focus of this article, has been the growing popularity of ‘privacy coins’ (e.g. Monero) in cryptomarkets as opposed to traditional cryptocurrencies such as Bitcoin. Studying Monero discourses in a cryptomarket community therefore offered an opportunity to understand the processes of collective sensemaking in online communities that shapes how new technologies and user practices become integrated into cryptomarkets. In this sense, the notion of assemblage was beneficial to help unpack the constantly re-arranging human and non-human elements (e.g. individuals, cryptocurrency regulation, the development of digital infrastructures, cultures of digital communities) that assemble to make cryptomarkets function.

Cryptomarket transitions to ‘privacy coins’ were explained in this article through the development of the following three overarching themes: (1) The functions, adaptations and failures of communities, (2) appraising and contesting cryptocurrency risks, and (3) the ideological and symbolic drivers of Monero adoption in cryptomarkets. Collectively, these themes explicate how the cryptomarket community help each other transition in cryptocurrency shifts by explaining the processes involved, justifying the risks of outdated practices that could make community members more vulnerable to law enforcement, and ideologically justifying new cryptocurrencies. This research has highlighted the centrality of online communities in shaping pathways into crime and facilitating adherence to cryptomarket norms, but it is also worth noting the challenges faced by cryptomarket communities that rely on digital environments for information: cryptocurrency acquisition practices were still often subject to localised laws and regulations, individuals had to navigate unstable information ecosystems, and there was considerable diversity of opinions on the need to transition cryptocurrency practices. The willingness of some cryptomarket users to still rely on Bitcoin, and thus have their cryptomarket transactions more ‘visible’ than Monero users, reiterates the need to understand the nuances of risk perceptions among cybercrime actors.

This study has also extended on previous research exploring interactions and cultures within cybercrime forums by engaging with the technological affordances that shape online communication in digital spaces. On Reddit, the digital space explored in this study, technological features such as downvoting/upvoting content and being able to diversify content (e.g. text posts, visual posts, sharing hyperlinks, crossposting from other communities) were all important in how the design of the platform influenced its ability to spread communication across the community to adopt new technologies and practices. Digital platforms differ substantially in their histories, cultures, and technological affordances, and this affects the characteristics of users on these platforms and how platforms shape community discussions (Kor-Sins, 2023). Studying community practices in other relevant spaces such as Telegram group chats and cryptomarket forums hosted by marketplaces, will provide valuable future research in further understanding how technological affordances shape community discussions and facilitate the adoption of new technologies in cybercrimes.

This research was undertaken at a time when the cryptomarket ecosystem is undergoing considerable periods of unavailability because of DDoS attacks on the Tor network (Rashid, 2023). This has greatly affected the availability of Tor-based markets and caused reliance on new methods such as the i2p protocol. Overall, changes in the cryptomarket ecosystem have been constant since the popular Silk Road marketplace emerged, but community resilience and the ability to adapt to external pressures and new technologies have been common for actors participating in these markets. As this research has examined in the context of the Monero shift taking place in cryptomarkets, these moments of flux in assemblages provides opportunities for researchers to examine the online community practices that facilitate the adoption of new technologies during these evolutions.

Footnotes

Acknowledgements

The author wishes to thank Elena Morgenthaler for her contribution as a research assistant.

Declaration of Conflicting Interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Funding

The author(s) received no financial support for the research, authorship, and/or publication of this article.

ORCID iD

Dr. Andrew Childs

Notes

Author biography

Dr. Andrew Childs is a Lecturer in the School of Criminology and Criminal Justice at Griffith University. He explores how new technologies contribute to the evolution of illicit markets.

References

Al Jawaheri

Al Sabah

Boshmaf

, et al. (2020) Deanonymizing Tor hidden service users through Bitcoin transactions analysis. Computers & Security 89: 101684.

Bada

Chua

Collier

, et al. (2021) Exploring masculinities and perceptions of gender in online cybercrime subcultures. In: Kranenbarg

Leukfeldt

(eds) Cybercrime in Context: The Human Factor in Victimization, Offending, and Policing. Cham: Springer, pp. 237–257.

Bakken

Moeller

Sandberg

(2018) Coordination problems in cryptomarkets: Changes in cooperation, competition and valuation. European Journal of Criminology 15(4): 442–460.

Bancroft

Reid

(2017) Challenging the techno-politics of anonymity: The case of cryptomarket users. Information, Communication & Society 20(4): 497–512.

Barratt

Maddox

(2016) Active engagement with stigmatised communities through digital ethnography. Qualitative Research 16(6): 701–719.

Bourne

(2017) Sensemaking in an online community after financial loss: Enterprising Jamaican investors and the fall of a financial messiah. New Media & Society 19(6): 843–860.

Braun

Clarke

(2019) Reflecting on reflexive thematic analysis. Qualitative Research in Sport, Exercise and Health 11(4): 589–597.

Braun

Clarke

(2021) To saturate or not to saturate? Questioning data saturation as a useful concept for thematic analysis and sample-size rationales. Qualitative Research in Sport, Exercise and Health 13(2): 201–216.

Broséus

Rhumorbarbe

Morelato

, et al. (2017) A geographical analysis of trafficking on a popular darknet market. Forensic Science International 277: 88–102.

10.

Burton

(2019) Look at us, we have anxiety: Youth, memes, and the power of online cultural politics. Journal of Childhood Studies 44: 3–17.

11.

Campbell

Orr

Durepos

, et al. (2021) Reflexive thematic analysis for applied qualitative health research. The Qualitative Report 26(6): 2011–2028.

12.

Chainalysis (2022) The Chainalysis 2022 crypto crime report. Available at: https://go.chainalysis.com/2022-crypto-crime-report.html

13.

Childs

(2023) The distribution of fake Australian vaccine digital certificates on an alt-tech platform. Trends in Organized Crime 26: 136–155.

14.

Childs

Bull

Coomber

(2022) Beyond the dark web: Navigating the risks of cannabis supply over the surface web. Drugs: Education, Prevention and Policy 29(4): 403–414.

15.

Childs

Coomber

Bull

(2020a) Do online illicit drug markets afford rationality? Contemporary Drug Problems 47(4): 302–319.

16.

Childs

Coomber

Bull

(2020b) Evolving and diversifying selling practices on drug cryptomarkets: An exploration of off-platform ‘direct dealing’. Journal of Drug Issues 50(2): 173–190.

17.

Collier

Clayton

Hutchings

, et al. (2021) Cybercrime is (often) boring: Infrastructure and alienation in a deviant subculture. The British Journal of Criminology 61: 1407–1423.

18.

Crewe

(2010) Assemblage theory and the future of criminology. In: Van Calster

Lippens

(eds) New Directions for Criminology: Notes from Outside the Field. Antwerp: Malku, pp. 39–57.

19.

Dearden

Tucker

(2023) Follow the money: Analyzing darknet activity using cryptocurrency and the Bitcoin blockchain. Journal of Contemporary Criminal Justice 39: 257–275.

20.

Decary-Hetu

Giommoni

(2017) Do police crackdowns disrupt drug cryptomarkets? A longitudinal analysis of the effects of operation onymous. Crime, Law and Social Change 67: 55–75.

21.

Delanda

(2006) Deleuzian social ontology and assemblage theory. In: Fuglsang

Sørensen

(eds) Deleuze and the Social. Edinburgh: Edinburgh University Press, pp. 250–266.

22.

Deleuze

Guattari

(1988) A Thousand Plateaus. London: Athlone.

23.

Demant

Bakken

Oksanen

, et al. (2019) Drug dealing on Facebook, Snapchat and Instagram: A qualitative analysis of novel drug drug markets in the Nordic countries. Drug and Alcohol Review 38: 377–385.

24.

Desmond

Lacey

Salmon

(2019) Evaluating cryptocurrency laundering as a complex socio-technical system. Journal of Money Laundering Control 22(3): 480–497.

25.

Dickinson

Wright

(2017) The funny side of drug dealing: Risk, humor, and narrative identity. Criminology 55(3): 691–720.

26.

Dupuis

Gleason

(2021) Money laundering with cryptocurrency: Open doors and the regulatory dialectic. Journal of Financial Crime 28(1): 60–74.

27.

Flamand

Decary-Hetu

(2019) The open and dark web: Facilitating cybercrime and technology-enabled offences. In: Leukfeldt

Holt

(eds) The Human Factor of Cybercrime. New York: Routledge, pp. 60–80.

28.

Franzke

Bechmann

Zimmer

, et al. (2020) Internet research: Ethical guidelines 3.0. Association of Internet Researchers. Available at: https://aoir.org/reports/ethics3.pdf

29.

Gal

Shifman

Kampf

(2016) ‘It gets better’: Internet memes and the construction of collective identity. New Media & Society 18(8): 1698–1714.

30.

Goldsmith

Wall

(2022) The seductions of cybercrime: Adolescence and the thrills of digital transgression. European Journal of Criminology 19(1): 98–117.

31.

Highfield

Leaver

(2016) Instagrammatics and digital methods: Studying visual social media, from selfies and GIFs to memes and emoji. Communication Research and Practice 2(1): 47–62.

32.

Holt

(2015) Qualitative criminology in online spaces. In: Copes

(ed.) The Routledge Handbook of Qualitative Criminology. New York: Routledge, pp. 173–188.

33.

Holt

(2020a) Assessing traditional and nontraditional data collection methods to study online phenomena. In: Melde

Weerman

(eds) Gangs in the Era of Internet and Social Media. Cham: Springer, pp. 1–19.

34.

Holt

(2020b) Subcultural theories of crime. In: Holt

Bossler

(eds) The Palgrave Handbook of International Cybercrime and Cyberdeviance. Cham: Palgrave Macmillan, pp. 513–526.

35.

Holt

Lee

Griffith

(2023) An assessment of cryptomixing services in online illicit markets. Journal of Contemporary Criminal Justice 39: 222–238.

36.

Horton-Eddison

Shortis

Aldridge

, et al. (2021) Drug cryptomarkets in the 2020s: Policy, enforcement, harm, and resilience. Global Drug Policy Observatory. Available at: https://www.swansea.ac.uk/media/Drug-Crypto-Markets_FINAL_June_2021.pdf

37.

Jardine

(2021) Policing the cybercrime script of darknet drug markets: Methods of law enforcement intervention. American Journal of Criminal Justice 46: 980–1005.

38.

Johnson

Stjepanović

Leung

, et al. (2023) Cryptocurrency trading, mental health and addiction: A qualitative analysis of reddit discussions. Addiction Research & Theory 31: 345–351.

39.

Kaufmann

Tzanetakis

(2020) Doing Internet research with hard-to-reach communities: Methodological reflections on gaining meaningful access. Qualitative Research 20(6): 927–944.

40.

Kor-Sins

(2023) The alt-right digital migration: A heterogeneous engineering approach to social media platform branding. New Media & Society 25: 2321–2338.

41.

Kowalski

Hooker

Barratt

(2019) Should we smoke it for you as well? An ethnographic analysis of a drug cryptomarket environment. International Journal of Drug Policy 73: 245–254.

42.

Ladegaard

(2019) Crime displacement in digital drug markets. International Journal of Drug Policy 63: 113–121.

43.

Leukfeldt

Holt

(2019) Examining the social organization practices of cybercriminals in the Netherlands online and offline. International Journal of Offender Therapy 64(5): 522–538.

44.

Literat

Kligler-Vilenchik

(2019) Youth collective political expression on social media: The role of affordances and memetic dimensions for voicing political views. New Media & Society 21(9): 1988–2009.

45.

Lupton

(2013) Risk and emotion: Towards an alternative theoretical perspective. Health, Risk & Society 15(8): 634–647.

46.

Maalsen

(2020) Revising the smart home as assemblage. Housing Studies 35(9): 1534–1549.

47.

Maddox

Barratt

Allen

, et al. (2016) Constructive activism in the dark web: Cryptomarkets and illicit drugs in the digital ‘demimonde’. Information, Communication & Society 19(1): 111–126.

48.

Martin

(2014) Lost on the Silk Road: Online drug distribution and the ‘cryptomarket’. Criminology & Criminal Justice 14(3): 351–367.

49.

Martin

Munksgaard

Coomber

, et al. (2020) Selling drugs on darkweb cryptomarkets: Differentiated pathways, risks and rewards. The British Journal of Criminology 60(3): 559–578.

50.

Massanari

(2016) Contested play: The culture and politics of Reddit bots. In: Gehl

Bakardjieva

(eds) Socialbots and Their Friends. New York: Routledge, pp. 126–143.

51.

Mik

(2017) Smart contracts: Terminology, technical limitations and real world complexity. Law, Innovation and Technology 9(2): 269–300.

52.

Mills

Freilich

Chermak

, et al. (2021) Social learning and social control in the off- and online pathways to hate crime and terrorist violence. Studies in Conflict & Terrorism 44(9): 701–729.

53.

Moore

Rid

(2016) Cryptopolitik and the darknet. Survival 58(1): 7–38.

54.

Moore

Abetz

(2019) What do parents regret about having children? Communicating regrets online. Journal of Family Issues 40(3): 390–412.

55.

Moser

Soska

Heilman

, et al. (2017) An empirical analysis of traceability in the Monero blockchain. ArXiv Preprint: 1704.04299. Available at: https://arxiv.org/pdf/1704.04299/

56.

Moyle

Childs

Coomber

, et al. (2019) #Drugsforsale: An exploration of the use of social media and encrypted messaging apps to supply and access drugs. International Journal of Drug Policy 63: 101–110.

57.

Munksgaard

Demant

(2016) Mixing politics and crime – The prevalence and decline of political discourse on the cryptomarket. International Journal of Drug Policy 35: 77–86.

58.

Nabben

(2023) Web3 as ‘self-infrastructuring’: The challenge is how. Big Data & Society 10(1): 205395172311590.

59.

Ouellet

Maimon

Howell

, et al. (2022) The network of online stolen data markets: How vendor flows connect digital marketplaces. The British Journal of Criminology 62(6): 1518–1536.

60.

Parkhill

Henwood

Pidgeon

, et al. (2011) Laughing it off? Humour, affect and emotion work in communities living with nuclear risk. The British Journal of Sociology 62(2): 324–346.

61.

Proferes

Jones

Gilbert

, et al. (2021) Studying Reddit: A systematic overview of disciplines, approaches, methods, and ethics. Social Media + Society 7: 20563051211019004.

62.

Rashid

(2023) Tor network hit by a series of ongoing DDoS attacks. Hackread. Available at: https://www.hackread.com/tor-network-ddos-attacks/

63.

Renold

Ringrose

(2011) Schizoid subjectivities? Re-theorizing teen girls’ sexual cultures in an era of ‘sexualization’. Journal of Sociology 47(4): 389–409.

64.

Silfversten

Favaro

Ishikawa

, et al. (2020) Exploring the use of Zcash cryptocurrency for illicit or criminal purposes. RAND Corporation. Available at: https://www.rand.org/pubs/research_reports/RR4418.html

65.

Spilotro

(2020) Why the dark net’s most active market ditched Bitcoin for Monero. Newsbtc. Available at: https://newsbtc.com/news/bitcoin/why-the-dark-nets-most-active-market-ditched-bitcoin-for-monero/

66.

Steel

CMS

(2019) Stolen identity valuation and market evolution on the dark web. International Journal of Cyber Criminology 13(1): 70–83.

67.

United Nations Office on Drugs and Crime (UNODC) (2020) Darknet cybercrime threats to Southeast Asia. Available at: https://www.unodc.org/roseap/uploads/archive/documents/darknet/index.html

68.

Van der Sanden

Wilkins

Rychert

, et al. (2022) ‘Choice’ of social media platform or encrypted messaging app to buy and sell illegal drugs. International Journal of Drug Policy 108: 103819.

69.

Van der Wagen

Pieters

(2020) The hybrid victim: Re-conceptualizing high-tech cyber victimization through actor-network theory. European Journal of Criminology 17(4): 480–497.

70.

Van Hout

Bingham

(2014) Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading. International Journal of Drug Policy 25(2): 183–189.

71.

Wamba

Kamdjoug

JRK

Bawack

, et al. (2020) Bitcoin, blockchain, and fintech: A systematic review and case studies in the supply chain. Production Planning & Control 31(2–3): 115–142.

72.

Webber

Yip

(2019) Humanizing the cybercriminal: Markets, forums, and the carding subculture. In: Leukfeldt

Holt

(eds) The Human Factor of Cybercrime. New York: Routledge, pp. 258–285.

73.

Web-IQ (2021) Bitcoin and Monero are the preferred currencies for trading on the darknet. https://hollandfintech.com/2021/12/bitcoin-and-monero-are-the-preferred-currencies-for-trading-on-the-darknet/

74.

Weick

(1995) Sensemaking in Organizations. Thousand Oaks, CA: Sage.

75.

Wood

McGovern

(2021) Memetic copaganda: Understanding the humorous turn in police image work. Crime, Media, Culture: An International Journal 17(3): 305–326.

How cryptomarket communities navigate marketplace structures,risk perceptions and ideologies amid evolving cryptocurrency practices

Abstract

Keywords

Introduction

The shift to ‘privacy’ coins in cryptomarkets

Online illicit marketplaces as assemblages

Knowledge sharing in cybercrime communities

The current study

Methods

Findings

The functions, adaptations and failures of communities

Appraising and contesting cryptocurrency risks

The ideological and symbolic drivers of Monero adoption

Conclusion

Footnotes

Acknowledgements

Declaration of Conflicting Interests

Funding

ORCID iD

Notes

Author biography

References