Alerting Compliance & Risk Teams · Surikata-X Darknet Intelligence
The darknet money isn't staying on the darknet.
Every day our Surikata-X engine collects roughly 800 cryptocurrency addresses directly from active darknet operators. 44% of the addresses we collected in the last 30 days already show on-chain funding. Those flows don't stop at the darknet's edge — a meaningful share moves on to regulated exchanges, OTC desks, and payment processors. The question for your team isn't whether this money is moving. It's whether it has already touched your platform.
Collected at the source. Measured continuously.
These are live operating figures from the Surikata-X darknet collection engine — addresses pulled from inside operators' own payment funnels, not scraped off the surface.
Why this lands on your desk.
Funded darknet wallets are not dormant. Once money moves, it seeks liquidity — and liquidity means regulated venues. If a deposit, a counterparty, or a downstream hop on your platform traces back to one of these operators, it becomes your exposure the moment the transaction settles. Attribution collected before first funding gives your team the lead time to see it coming.
What's behind the darknet sites we collect from.
Two views of the same collection — by operator site, and by address volume. Every address is typed and jurisdiction-tagged across Bitcoin, Ethereum, Monero, TRON, and Solana.
By site — where we collect
By address — what the volume looks like
Carding shops dominate by site count but reuse a small number of static wallets, while CSAM operators mint a fresh address for almost every payment. That is why site share and address share diverge so sharply — and why a sample drawn purely by volume looks nothing like the operator landscape behind it. We stratify by entity type, so the mix you receive is the one you asked for rather than whatever the raw counts happen to be.
CSAM findings are referred to NCMEC and law enforcement. This work is about prevention and disruption — protecting victims and cutting off the money.
Request an exposure check
We'll take the darknet-attributed addresses and clusters from the entity types that matter to you, and help you check them against your own operations and records — so you can see whether these flows have already reached your platform, and get ahead of the ones that haven't.
Operator-level attribution collected inside the darknet — upstream of the chain-analytics layer you already run.
Each address ships with the content-filtered source that establishes it — suitable for risk-committee review or law-enforcement referral.
BTC, ETH, Monero, TRON, Solana — clustered by shared payment rails to map the network behind the operator, not a single wallet.
See whether these flows have reached you.
Request an exposure check and we'll scope it to the entity types and chains most relevant to your platform — matched against your operations and records. Our team responds within 1–2 business days.