Tor Links 2020: A Look Back

Sections

1. The State of Tor Network in 2020
2. Major Marketplace Links Active in 2020
3. Privacy and Security-Focused Services
4. Forums and Community Hubs
5. Cryptocurrency Mixing and Financial Services
6. Information and Whistleblowing Platforms
7. Law Enforcement Actions and Link Takedowns
8. Evolution of Onion Link Discovery Methods
9. Technical Changes and V3 Onion Migration
10. 2020 Dark Web Timeline: Key Events
11. Common Misconceptions and Mistakes
12. Key Takeaways
13. Still wondering?
14. Sources and further reading

The State of Tor Network in 2020

In 2020, the Tor network experienced significant changes and challenges, impacting its users and service operators. Daily user statistics indicated a robust engagement, with the United States recording an average of 570,526 daily users, accounting for 26.71% of total users. Russia followed with 308,295 users, representing 14.43% of the network's usage⁴. This highlighted a continued interest in privacy and anonymity online, despite the challenges faced by the ecosystem.

Major Events

Several pivotal events shaped the landscape of the Tor network in 2020. The most notable was the closure of Empire Market on August 22, 2020, which was believed to have been an exit scam, taking approximately 2,638 BTC (around $30 million) with it². Prior to its disappearance, Empire Market had over 55,000 listings and processed about $6.5 million in transactions weekly⁵. This incident exemplified the volatility within darknet markets.

Law enforcement actions also significantly affected the network. Operation DisrupTor, announced in September 2020, led to the arrest of 179 darknet drug traffickers across the United States and Europe, with 121 arrests in the United States alone³. This operation seized over $6.5 million in cash and virtual currencies, alongside approximately 500 kilograms of drugs and 63 firearms from various darknet vendors³. These actions underscored the ongoing battle between law enforcement and illegal activities on the dark web.

Technical Updates

Technically, Tor was transitioning from version 2 (v2) onion services to version 3 (v3). On September 15, 2020, warnings began to appear for operators and clients regarding the deprecation of v2 services, which were set to become obsolete in future updates¹. The Tor Project announced that v2 support would be completely removed by July 15, 2021, with all stable versions disabling it by October 15, 2021¹. V3 onion addresses, which are more secure and contain 56 characters compared to v2's 16, became the standard as they reached feature parity by 2020⁶⁷.

Overall, while user numbers appeared stable or growing, the underlying infrastructure and market dynamics faced significant upheaval, indicating a complex and evolving environment for Tor users.

Major Marketplace Links Active in 2020

In 2020, several prominent darknet markets operated within the Tor network, each contributing to the landscape of illicit online commerce. Key players included White House Market, DarkMarket, and Monopoly Market, each with distinct characteristics and user bases.

White House Market

White House Market emerged as a significant player in 2020, known for its user-friendly interface and focus on vendor reputation. By mid-2020, it reportedly attracted around 30,000 users and processed transactions estimated at approximately $1.5 million weekly. The marketplace prioritised anonymity and often required vendors to use Monero for transactions, enhancing privacy for its users.

DarkMarket

DarkMarket was another notable marketplace, especially known for its variety of offerings. While precise user numbers were less documented, it was estimated to host around 10,000 listings at its peak. Transaction volumes fluctuated, but it remained a popular choice for users seeking a diverse range of products. However, its operations faced challenges from law enforcement, culminating in significant raids throughout the year.

Monopoly Market

Monopoly Market, although less prominent than its competitors, still maintained a steady user base. It was known for its strict vendor requirements and a focus on quality over quantity. User estimates suggested it had around 15,000 active users, with transaction volumes reaching around $500,000 weekly. The marketplace's reputation for reliability helped it retain users amid the turbulent environment of 2020.

Notable Takedowns

One of the most significant events in 2020 was the exit scam of Empire Market on August 22, which led to the loss of approximately 2,638 BTC (around $30 million)². Prior to its closure, Empire Market was the largest darknet marketplace, boasting over 55,000 listings and processing $6.5 million in transactions weekly⁵. This incident highlighted the inherent risks of participating in darknet markets, as users could lose substantial sums due to unforeseen market exits.

Law enforcement actions also had a profound impact on the marketplace landscape. Operation DisrupTor, which began in September 2020, resulted in the arrests of 179 darknet drug traffickers and the seizure of over $6.5 million in cash and cryptocurrencies³. Such operations underscored the ongoing cat-and-mouse game between law enforcement and darknet market operators.

The events of 2020 reflect a volatile environment for darknet markets, with significant risks for users and operators alike. As the landscape evolves, remaining informed about these marketplaces and their operational status remains crucial for anyone engaging with the Tor ecosystem.

Privacy and Security-Focused Services

In 2020, various legitimate privacy tools accessible via the Tor network played a crucial role in safeguarding users' anonymity. These services provided essential support for journalists, activists, and individuals seeking to communicate securely.

SecureDrop Instances

SecureDrop is a platform designed for whistleblowers to share information with journalists securely. By using this service, whistleblowers can submit documents and communicate anonymously, mitigating the risks associated with exposing sensitive information. Many news organisations have deployed SecureDrop instances, allowing them to receive tips without compromising the identities of their sources.

ProtonMail Onion Service

ProtonMail, a well-known encrypted email service, launched an onion service to enhance user privacy. This service allows users to access ProtonMail through the Tor network, ensuring that email communications remain secure from surveillance. By using the ProtonMail onion address, users can send and receive encrypted emails without revealing their IP addresses, offering an additional layer of anonymity.

DuckDuckGo Onion Address

DuckDuckGo, a popular search engine prioritising user privacy, also provided an onion service. Accessible via its .onion address, DuckDuckGo allows users to search the web without tracking their queries. This service is particularly valuable for users who wish to avoid surveillance and maintain their privacy while browsing the internet.

Encrypted Communication Platforms

Various encrypted communication platforms operated on the Tor network, facilitating secure messaging and voice calls. Services like Signal and Matrix offered encrypted messaging that could be accessed through Tor, enabling users to communicate without fear of interception. These platforms are vital for activists and journalists, who often face threats in their work.

The role of these privacy and security-focused services was paramount in 2020, especially during times of increased scrutiny and risk for those engaged in sensitive activities. By providing robust tools for anonymous communication, these services contributed significantly to the safety of users operating in high-risk environments.

Forums and Community Hubs

In 2020, several forums and community hubs emerged as key discussion platforms on the Tor network, catering to various user needs such as harm reduction, technical discussions, and community building. Notable platforms included Dread forum, Hidden Answers, and specific subreddit alternatives that migrated to Tor.

Dread Forum

Dread forum, often likened to Reddit, quickly became a central hub for discussions related to the dark web. It provided a platform for users to share experiences, ask questions, and seek advice on navigating the complexities of the Tor ecosystem. By late 2020, Dread attracted an estimated 50,000 active users, showcasing its popularity among privacy enthusiasts and darknet explorers.

Hidden Answers

Hidden Answers served as a question-and-answer site focused on providing information related to the dark web. Users could post queries about various topics, including security practices and marketplace recommendations. The platform's design encouraged knowledge sharing, making it a valuable resource for those new to the Tor network. Estimates suggested that Hidden Answers had around 10,000 active users by the end of 2020.

Subreddit Alternatives

With the closure of mainstream subreddits discussing dark web topics, several alternatives moved to the Tor network. These subreddits aimed to maintain discussions about privacy, security, and illicit activities without the risk of censorship. User counts for these alternatives varied, but they collectively attracted thousands of users seeking a secure space for open dialogue.

Community Focus

The primary purposes of these forums included harm reduction, technical discussions, and community building. They provided vital support for individuals seeking to engage safely in the dark web environment. Users often exchanged tips on Bitcoin mixing, privacy tools, and safe browsing practices, contributing to a culture of informed engagement within the Tor network.

These community hubs played a crucial role in 2020, as they facilitated interactions among users, helping them navigate the challenges and risks associated with the dark web. As the landscape continues to evolve, such platforms remain essential for fostering a supportive environment for Tor users.

Cryptocurrency Mixing and Financial Services

In 2020, cryptocurrency mixing services gained popularity within the Tor network, providing users with enhanced privacy for their transactions. Bitcoin mixers and tumblers obfuscate transaction histories, making it difficult to trace the flow of funds. This service appealed to users seeking to maintain anonymity, especially in light of increasing scrutiny from law enforcement.

Bitcoin Mixing and Tumblers

Bitcoin mixers operate by pooling together multiple users' coins and redistributing them in a way that obscures the origin of the funds. This process typically involves taking an input of Bitcoin from various users, mixing it, and then sending back an equivalent amount to each user, effectively breaking the link between the original and new addresses. Although specific transaction volume estimates for these services are not widely published, anecdotal evidence suggests that they were extensively used amid concerns over privacy and security.

Monero Adoption Trends

Monero, a privacy-focused cryptocurrency, also saw increased adoption in 2020. Its built-in privacy features, including stealth addresses and ring signatures, make it a preferred choice for users seeking anonymity. Many darknet markets began accepting Monero as a payment option, further driving its usage. For instance, White House Market strongly encouraged the use of Monero for transactions, highlighting a trend towards privacy-centric financial services within the dark web ecosystem.

Wallet Services

Several wallet services integrated privacy features to cater to the needs of Tor users. Wasabi Wallet, for example, offered a Tor integration that allowed users to mix their Bitcoin while maintaining an anonymous connection. This wallet employed a CoinJoin mechanism, enabling multiple users to combine their transactions for added privacy. The increasing focus on privacy in wallet services reflects a broader trend in the cryptocurrency space towards safeguarding user identities.

Transaction Volume Estimates

While direct estimates for transaction volumes concerning mixing services and Monero adoption remain elusive, the overall cryptocurrency market experienced significant activity in 2020. The closure of major darknet markets, such as Empire Market, which processed around $6.5 million in transactions weekly prior to its exit scam, underscores the dynamic nature of financial services within the Tor network²⁵. As users sought alternatives for secure transactions, the demand for mixing services and privacy-centric cryptocurrencies like Monero likely surged.

The landscape of cryptocurrency mixing and financial services in 2020 illustrated a growing emphasis on privacy and anonymity, driven by the evolving challenges of operating within the Tor ecosystem.

Information and Whistleblowing Platforms

The Tor network has long been a refuge for information-sharing and whistleblowing platforms, providing a secure means for individuals to expose wrongdoing without fear of reprisal. Prominent among these is WikiLeaks, which utilises the Tor network to facilitate the anonymous submission of documents. This platform has been vital for journalists and whistleblowers aiming to bypass censorship, particularly in authoritarian regimes.

News Outlets with Onion Mirrors

Major news organisations have also established onion services to ensure their content remains accessible in regions where censorship is prevalent. For instance, both the BBC and The New York Times offer onion mirrors of their websites. These mirrors allow users to access news articles and reports without being tracked or blocked by local authorities. The BBC's onion service is particularly noteworthy, as it provides essential news coverage to audiences in countries with strict media controls.

Archive Services

Archive services play a crucial role in preserving information that may be subject to censorship. Platforms like The Hidden Wiki and Ahmia index onion services and provide users with access to a wealth of information. These archives are particularly important in regions where access to information is restricted, ensuring that users can still find resources and discuss topics freely.

Importance for Censorship Circumvention

In regions with oppressive governments, the ability to access information freely is often severely limited. The use of Tor and its associated services allows individuals to circumvent these restrictions. According to statistics from 2020, the United States had the highest number of mean daily Tor users at 570,526, followed by Russia with 308,295 users⁴. This highlights the global reliance on the Tor network for maintaining access to information.

The significance of these platforms cannot be overstated. They empower individuals to share critical information while protecting their identities. As censorship continues to evolve, the role of information and whistleblowing platforms on the Tor network will remain vital for fostering transparency and accountability.

Law Enforcement Actions and Link Takedowns

In 2020, law enforcement agencies intensified efforts to disrupt darknet operations, resulting in significant marketplace seizures and arrests. Notably, Empire Market, one of the largest darknet marketplaces, went offline on August 22, 2020, with an estimated loss of 2,638 BTC (approximately $30 million) believed to be part of an exit scam². This marketplace had over 55,000 listings and processed around $6.5 million in transactions weekly before its disappearance⁵.

Major Operations

Operation DisrupTor, announced in September 2020, marked a significant crackdown on darknet drug trafficking. The operation led to the arrest of 179 individuals across the United States and Europe, with 121 arrests occurring in the United States alone³. Over the course of this nine-month operation, authorities seized approximately 500 kilograms of drugs, 63 firearms, and over $6.5 million in cash and virtual currencies from various darknet vendors³. This operation was informed by intelligence gathered from previous takedowns, such as the Wall Street Market seizure in May 2019.

Exit Scams vs. Legitimate Shutdowns

The distinction between exit scams and legitimate shutdowns became blurred in 2020. While marketplace closures like Empire Market's were attributed to exit scams, others, such as the planned deprecation of v2 onion services, were legitimate shutdowns initiated by the Tor Project¹. V2 services were deemed insecure and set for complete removal by October 2021, prompting many operators to transition to v3 onion services, which offer enhanced security⁷⁸.

Impact on the Ecosystem

The impact of these actions on the darknet ecosystem was profound. Users faced substantial financial losses, with estimates suggesting that the closure of Empire Market alone resulted in losses exceeding $30 million². The community's response included heightened discussions around security practices and the need for alternative platforms, as many users sought to navigate the changing landscape of the Tor network.

Community Response

Forums and community hubs became essential for information sharing, as users looked for guidance on safe practices and new marketplace options. The Dread forum and other platforms facilitated discussions on coping with the disruptions caused by law enforcement actions. The overall sentiment within the community reflected a mix of resilience and caution, as users adapted to the evolving risks associated with operating in the darknet environment.

The ongoing cat-and-mouse game between law enforcement and darknet operators continues to shape the landscape, underscoring the importance of vigilance and adaptability for users navigating this complex ecosystem.

Evolution of Onion Link Discovery Methods

In 2020, users employed various methods to discover onion links, reflecting the evolving landscape of the Tor network. Directory services and search engines played a significant role, while verification challenges and phishing risks prompted community responses.

Directory Services

The Hidden Wiki remained a well-known directory service, albeit with mixed reliability. Users often turned to it for links to onion services, but the constant changes in the dark web made it difficult to maintain accuracy. The community frequently debated the legitimacy of listed links, highlighting the need for caution when navigating these directories.

Search Engines

Search engines like Ahmia and Torch emerged as crucial tools for link discovery. Ahmia, in particular, indexed onion services while filtering out illegal content, allowing users to search for specific topics. This approach helped mitigate risks associated with accessing potentially harmful sites. However, search engines faced challenges in ensuring the accuracy of their results as the dark web landscape shifted rapidly.

Verification Challenges

With the transition from v2 to v3 onion services, verification became increasingly important. V3 addresses, containing 56 characters and based on ed25519 public keys, offered enhanced security compared to their v2 counterparts, which were deemed fundamentally insecure⁶⁸. Users had to adapt to these changes, as many sites transitioned to v3, making it crucial to verify the authenticity of links before engaging.

Phishing Risks and Community Responses

Phishing remained a significant concern in 2020, with malicious actors exploiting the anonymity of the dark web. Users were often cautioned against clicking unfamiliar links. The community responded by promoting best practices for safe browsing, including the use of secure connections and verifying sources before accessing services.

Comparison to Pre-2020 Methods

Before 2020, link discovery methods largely relied on forum discussions and personal recommendations. The emergence of dedicated directory services and search engines marked a shift towards more structured approaches. While the dark web continued to present risks, the increased availability of tools for discovery and verification reflected an evolving understanding of user safety.

In summary, the methods for discovering onion links in 2020 demonstrated a blend of traditional and innovative approaches, emphasising the need for caution and verification in an ever-changing landscape.

Technical Changes and V3 Onion Migration

The transition from v2 to v3 onion addresses marked a significant shift in the Tor ecosystem throughout 2020. This change was driven by the need for enhanced security and usability for onion services.

Timeline of Migration

On September 15, 2020, the Tor Project began issuing warnings to onion service operators that v2 addresses were deprecated. The complete removal of v2 support was scheduled for version 0.4.6.x, set for release on July 15, 2021, with all stable versions disabling v2 by October 15, 2021¹. This timeline provided a clear framework for operators to transition to the newer v3 addresses.

Major Services Migrating to V3

Several major services completed their migration to v3 addresses during this period. For example, the DarkMarket and White House Market were among the notable platforms that adapted to the new standards, ensuring continued access for users. In contrast, Empire Market, one of the largest darknet marketplaces, went offline on August 22, 2020, before it could transition, resulting in significant losses for its users²⁵.

Technical Improvements

V3 onion addresses offer notable technical advancements. They consist of 56 characters, compared to the 16 characters of v2 addresses. This increase is due to v3 addresses incorporating a full ed25519 public key rather than merely a hash of a public key⁶. This change enhances security by making it more difficult for malicious actors to impersonate services. Additionally, v3 onion services reached feature parity with v2 by 2020, including support for Onion Balance, improving load distribution for high-traffic services⁷.

Deprecation Warnings and Deadlines

As the deprecation of v2 onion services approached, the warnings became more urgent. Operators were advised to prepare for the transition well in advance, as the Tor Project made it clear that v2 services would be fundamentally insecure and inaccessible post-deprecation⁸. This proactive approach facilitated smoother transitions for many services, although some, like Empire Market, were unable to adapt in time.

The migration from v2 to v3 onion addresses represented a pivotal moment in the Tor network's evolution, highlighting the importance of security and the ongoing adaptation of services within the dark web ecosystem.

2020 Dark Web Timeline: Key Events

Date	Event	Impact	Details
January 2020	User Growth	570,526 daily users in USA	Highest mean daily users globally [4]
August 22, 2020	Empire Market Shutdown	Estimated $30 million lost	Exit scam with 2,638 BTC [2]
September 15, 2020	V2 Deprecation Warning	Transition to V3 required	Warnings issued to operators [1]
September 2020	Operation DisrupTor	179 arrests made	Crackdown on drug trafficking [3]
July 15, 2021	V2 Support Removal	Complete removal of v2 services	Scheduled for this date [1]
October 15, 2021	V2 Services Disabled	Inaccessibility of v2 services	All stable versions disabled [1]

Common Misconceptions and Mistakes

Assuming All V2 Links Remained Functional Throughout 2020

Many users believed v2 onion addresses would continue working indefinitely despite deprecation warnings. On September 15, 2020, Tor version 0.4.4.x began alerting operators that v2 services were deprecated¹. Relying on outdated v2 links after this date meant risking access loss, as complete removal was scheduled for July 15, 2021¹. Users should have migrated bookmarks to v3 addresses immediately upon receiving warnings rather than waiting for forced obsolescence.

Treating All Marketplace Closures as Law Enforcement Actions

The disappearance of Empire Market on August 22, 2020 was widely assumed to be a police seizure. In reality, the marketplace executed an exit scam, taking approximately 2,638 BTC (around $30 million) with it². This confusion stemmed from Operation DisrupTor's simultaneous crackdown, which arrested 179 individuals across multiple countries³. Distinguishing between exit scams and legitimate takedowns requires examining whether authorities announced seizures publicly—absence of official statements typically signals operator fraud rather than law enforcement success.

Believing V3 Addresses Were Optional Upgrades

Some operators viewed the v2-to-v3 transition as a cosmetic change rather than a security imperative. V2 services were deemed fundamentally insecure by the Tor Project, with vulnerabilities that could not be patched⁸. V3 addresses incorporate a full ed25519 public key across 56 characters, compared to v2's 16-character hash⁶, making impersonation attacks significantly harder. Treating this as optional left services exposed to known exploits until forced migration occurred in October 2021.

Trusting Directory Listings Without Independent Verification

Users frequently accessed links from The Hidden Wiki and similar directories without cross-referencing sources. Phishing sites exploited this trust, cloning legitimate services with altered addresses. The rapid turnover of onion services in 2020—exemplified by Empire Market's sudden disappearance after processing $6.5 million weekly⁵—meant directory listings became outdated within days. Verifying addresses through multiple independent channels, such as forum discussions and search engines like Ahmia, reduced exposure to fraudulent clones.

Underestimating Law Enforcement Intelligence Gathering

Operation DisrupTor's 179 arrests in September 2020 surprised many who assumed marketplace shutdowns erased investigative trails. The operation was a nine-month effort beginning after the May 2019 Wall Street Market takedown, using seized intelligence to identify vendors throughout 2020³. Authorities seized over $6.5 million in cash and virtual currencies alongside 500 kilograms of drugs³. Users mistakenly believed new marketplaces offered fresh anonymity, when in fact prior compromises enabled ongoing surveillance of vendor patterns and cryptocurrency flows.

Conflating Tor User Growth with Security Improvements

The United States' 570,526 mean daily Tor users in 2020 represented 26.71% of global traffic⁴, leading some to interpret high adoption as proof of network invulnerability. User numbers reflect accessibility and censorship circumvention needs rather than security posture. The simultaneous v2 deprecation and marketplace collapses demonstrated that popularity does not correlate with safety—outdated protocols and operational security failures remained prevalent despite increased usage.

Key Takeaways

• Migrate bookmarks immediately: V2 onion addresses became fundamentally insecure after September 2020 warnings; relying on 16-character links risked access loss and exposure to known exploits that v3's 56-character ed25519 keys eliminate.

• Verify addresses through multiple sources: Directory listings like The Hidden Wiki grew outdated within days as services disappeared; cross-reference links via forums and search engines such as Ahmia before accessing any onion service.

• Distinguish exit scams from law enforcement: Empire Market's August 2020 disappearance was operator fraud, not a police seizure; absence of official seizure announcements typically signals theft rather than legitimate takedowns.

• Recognise ongoing surveillance risks: Operation DisrupTor's 179 arrests stemmed from nine months of intelligence gathering after prior marketplace compromises; new platforms do not guarantee fresh anonymity when vendor patterns remain traceable.

• Treat high user numbers as adoption, not safety: The USA's 570,526 daily Tor users reflected accessibility needs rather than network invulnerability; popularity does not correlate with operational security improvements.

For practical guidance on navigating today's onion ecosystem safely, review Exploring the Dark Web: A Comprehensive Overview.

Still wondering?

What happened to Empire Market in 2020?

Empire Market went offline on August 22, 2020 and never returned, with operators believed to have executed an exit scam taking approximately 2,638 BTC (around $30 million)². Before disappearing, the marketplace had over 55,000 listings and processed roughly $6.5 million in transactions each week⁵.

Are v2 onion addresses still working in 2020?

V2 onion addresses functioned through most of 2020, but on September 15, 2020, Tor version 0.4.4.x began warning operators that v2 services were deprecated¹. Complete removal was scheduled for July 15, 2021, with all stable versions disabling v2 by October 15, 2021¹.

What is the difference between v2 and v3 onion addresses?

V3 onion addresses contain 56 characters compared to v2's 16 characters because they include a full ed25519 public key rather than just a hash of a public key⁶. The Tor Project deemed v2 services fundamentally insecure, with vulnerabilities that could not be patched, making the backward incompatible change necessary⁸.

How many people used Tor in 2020?

From January 1 to November 16, 2020, the United States had the highest number of mean daily Tor users at 570,526 (26.71% of global traffic), followed by Russia with 308,295 users (14.43%)⁴. These figures reflect accessibility and censorship circumvention needs rather than security improvements.

What major dark web sites were shut down in 2020?

Operation DisrupTor, announced in September 2020, resulted in 179 arrests across the United States and Europe, targeting vendors on markets including Empire, Dream, White House, and Dark Market³. The nine-month operation began after the May 2019 Wall Street Market takedown and seized over $6.5 million in cash and virtual currencies alongside 500 kilograms of drugs³.

Sources and further reading

• 1. Onion Service version 2 deprecation timeline | The Tor Project
• 2. Closure of Darknet Empire Market Believed to Be $30M Exit Scam - Decrypt
• 3. International law enforcement operation targeting opioid traffickers on the Darknet results in over 170 arrests worldwide and the seizure of weapons, drugs and over $6.5 million
• 4. Users – Tor Metrics
• 5. Empire Market Falls as Admins Are Suspected of Exit Scam - Infosecurity Magazine
• 6. V3 onion services usage | The Tor Project
• 7. [tor-dev] Onion Service v2 Deprecation Timeline
• 8. V2 Onion Services Deprecation | Tor Project | Support