Litecoin Emerges as the Next Dominant Dark Web Currency

Click here to download the complete analysis as a PDF.

Executive Summary

In mid-2016, Recorded Future noticed members of the cybercriminal underground discussing their growing dissatisfaction with Bitcoin as a payment vehicle, regardless of their geographical distribution, spoken language, or niche business. Recorded Future conducted an extensive analysis on 150 of the most prominent message boards, marketplaces, and illicit services, which unexpectedly revealed that Litecoin is surpassing other cryptocurrencies in preference, and is currently the second most dominant coin on the dark web after Bitcoin.

Background

Beginning in the middle of 2016, Recorded Future began noticing an increase in frequency of discussions regarding the functionality, security, and usability of cryptocurrency among members of the cybercriminal underground. Regardless of their geographical distribution, spoken language, or niche business, everyone was sharing their growing dissatisfaction with Bitcoin as a major payment vehicle.

The meteoritic rise in popularity of Bitcoin among household users, speculators, and institutional investors around the world since mid-2017 has placed an enormous load on the blockchain network, resulting in larger payment fees. As a result, Bitcoin payments have become economically infeasible, because the subsequent cost of transaction increased ten-fold, sometimes as much as 30 percent of the smaller payment amounts. An active member of criminal discussion boards expressed his concerns about the latest Bitcoin performance, originally written in Russian:

$18 Bitcoin payment requiring 40 percent commission fee.

As we described in our previous blog, the underground economy is dependent on smaller transactions in its day-to-day operations, with the cost of the average product or service beginning between $50–$300. With the addition of exuberant transaction fees, the price of such products and services suddenly inflates tremendously.

The concept of Bitcoin payments is based on the idea of decentralized ledgers that maintain the entire record of each transaction independently, which makes it almost (but not entirely) tamper-proof. The same technology that makes blockchain networks resilient, relying on the distributed network of miners to maintain transaction history, creates an opportunity for dishonest users to double-spend their coins, if they act quickly. To address this abuse, most vendors adopted a rule requiring three confirmations before treating transactions as complete.

As with any business agreement, speed of payment completion is crucial — this is especially true for the dark web. With its inherent risk of transacting and distrust among its members, every minute of delay increases the chance of being ripped off. The prospect of having to wait up to 24 hours to confirm their transactions, in addition to exuberant payment fees, has rendered Bitcoin payments unusable for a large group of bad guys.

The same class of power users who helped to establish Bitcoin as a unified payment instrument across the dark web, spurring the underground economy and plaguing the world with never-ending ransomware attacks, illicit drugs, and weaponry, now see it as a roadblock to proliferating criminal business.

The following examples illustrate the inevitable adoption of alternative payment methods. One of the oldest and most respected members of the Russian hacking world stated:

While another active member supported his idea by saying:

Despite the overwhelming support of and references to Dash as the up-and-coming cryptocurrency, a poll conducted among several hundreds of members of a popular criminal forum revealed that there is no unified agreement for which currency should be adopted next. Our subsequent research showed that the vendors alone represent the primary deciding factor regarding which payments will be implemented and which will not.

Reproduction of the hacking forum poll results.

Analysis

To understand and anticipate any upcoming shift in the next six to 12 months, Recorded Future analyzed 150 of the most prominent message boards, marketplaces, and illicit services. Contrary to what we learned by observing the chatter between criminals during the past several weeks, Bitcoin remains the gold standard in the dark web, with all vendors accepting it as a payment, and Litecoin emerged as the second most popular currency, with 30 percent of all vendors who implemented alternative payment methods willing to accept it. Dash is closely trailing Litecoin with 20 percent of the market. Unexpectedly, Bitcoin Cash was the third most common cryptocurrency with 13 percent of vendors trusting it as a payment method.

Litecoin is the second oldest cryptocurrency after Bitcoin. It was introduced in 2011 and was intended to be a superior version of Bitcoin. Litecoin’s core technology is almost identical to Bitcoin’s, but improved, allowing it to conduct transactions faster, resulting in significantly lower commission fees and a larger number of coins being mined. In the seven years since its inception, Litecoin has been able to piggyback off an extensive infrastructure of Bitcoin. However, with all its advantages, Litecoin does not offer any additional security to its owner. Like Bitcoin, Litecoin transactions are entirely transparent.

Bitcoin remains the primary payment currency of the dark web, accepted across all marketplaces and forums. However, alternative coins have been added recently, among which Litecoin is dominant.

Further analysis not only showed that Eastern European criminals are more proactive in the implementation of alternative payment options compared to the English-speaking communities, but also which currency is the most preferred for each group. While Russians favored the accessibility and convenience of Litecoin, with a more diverse and established supporting infrastructure, English-speaking members seem to be more security-oriented, choosing Monero for its built-in safety features.

Outlook

This analysis relied on our manual research of each forum, marketplace, and service. As a result, we discovered trends that were not only not revealed via chatter or automation, but contradicted those sources. We expect that the cryptocurrency diversification trend will only intensify, and Bitcoin will lose its place as a dominant payment method in the dark web in the next six to 12 months. However, contrary to a widespread assumption that criminals are abandoning Bitcoin altogether, we are convinced it will remain one of the main payment instruments, albeit with a significantly smaller market share.

On the other hand, Litecoin and Dash will take their place next to Bitcoin as the everyday payment currencies of the dark web. At the same time, as these currencies become more readily available to a general population, malicious tools such as ransomware will also continue to evolve to take advantage of the mainstream trend.