Darknet Glossary
Thorough A-Z terminology guide for understanding darknet concepts, technologies, and culture with 200+ terms defined.
Darknet terminology spans cryptography, networking, economics, and underground culture. Understanding these terms provides the important vocabulary needed to discuss anonymous networks, privacy technology, and digital security with precision. From technical concepts like onion routing and ring signatures to marketplace slang like FE (finalize early) and vendor bond, this glossary defines 200+ terms required for darknet research and thorough understanding.
Each definition balances technical accuracy with accessibility for diverse audiences. We explain what terms mean, how they're used in context, and why they matter for understanding the ecosystem. Cross-references connect related concepts enabling deeper exploration. Examples illustrate practical usage in real situations. Whether you're a researcher analyzing court documents, a journalist covering cybercrime, a student entering the field, or simply curious about anonymous networks, this glossary serves as your definitive reference for darknet vocabulary updated for January 2026.
The glossary supports multiple use cases. Quick lookups answer specific questions during reading. Systematic browsing builds thorough vocabulary for entering the field. Category exploration reveals conceptual connections between related terms. Academic citation provides verified definitions for scholarly work. This flexibility makes the glossary valuable for both casual reference and serious research.
Why Terminology Matters
Precise terminology enables clear communication about complex topics. When discussing Tor, does "node" mean guard, middle, or exit relay? What's the difference between a circuit and a connection? Darknet and deep web aren't synonyms—they describe fundamentally different internet layers with different access requirements and content types. Using terms correctly prevents confusion, demonstrates understanding of the subject matter, and ensures accurate communication between researchers, journalists, and professionals.
The darknet developed specialized vocabulary mixing technical jargon with marketplace slang and community culture. OPSEC (operational security) comes from military usage but gained darknet-specific meanings emphasizing identity separation and pattern avoidance. Multisig shortened from multi-signature wallets describing cryptographic escrow systems. Terms like "exit scam" and "vendor bond" emerged from marketplace economics describing trust mechanisms in anonymous commerce. Understanding this vocabulary reveals how the ecosystem functions practically, not just theoretically—and why certain mechanisms evolved to address specific challenges.
Researchers reading academic papers, court documents, or technical specifications encounter terminology assuming prior knowledge. What are stealth addresses and why do they matter for transaction privacy? How does garlic routing differ from onion routing in terms of message handling and threat models? Why does ring signature technology matter for cryptocurrency privacy when Bitcoin already provides pseudonymity? This glossary provides quick reference for these concepts without requiring full article reading, serving as an entry point for deeper exploration.
Media coverage frequently misuses darknet terminology, confusing deep web with darknet, describing Bitcoin as "untraceable," or treating all anonymous networks as equivalent. These errors mislead readers and undermine informed public discussion. Our glossary provides accurate definitions enabling readers to recognize and correct such misconceptions. Journalists consulting this resource can avoid common errors that damage credibility and spread misinformation.
Terminology Categories
- Network protocols and architecture (Tor, I2P, Freenet)
- Cryptographic concepts and algorithms (PGP, AES, signatures)
- Marketplace economics and operations (escrow, disputes, reputation)
- Privacy technology and tools (Tails, Whonix, Tor Browser)
- Law enforcement terminology (NITs, controlled delivery, warrants)
- Cryptocurrency and blockchain terms (wallets, mixing, chain analysis)
- Cultural slang and community language (FE, OPSEC violations, burn)
- Security and OPSEC concepts (air gap, compartmentalization)
The glossary evolves as technology and culture change. New terms emerge from protocol updates, marketplace innovations, and investigation techniques. V3 onion addresses replaced V2 in 2021, requiring updated address format explanations. Lightning Network gained adoption for Bitcoin payments, introducing new vocabulary around payment channels. Ring confidential transactions enhanced Monero privacy, adding technical terms to cryptocurrency discussions. We update definitions to reflect current 2026 usage and technical reality.
Some terms have multiple meanings depending on context. "Node" means different things in Tor discussions (relay servers) versus Bitcoin discussions (network participants validating transactions). "Mixing" describes cryptocurrency tumbling but also network traffic analysis concepts. Our definitions note contextual variations to prevent confusion when terms appear in different domains.
Glossary FAQ
What's the difference between darknet, deep web, and dark web?
Deep web refers to all internet content not indexed by search engines—password-protected sites, databases, private pages, webmail interfaces. This includes most of the internet by volume. Darknet specifically means overlay networks requiring special software like Tor or I2P to access. Dark web often serves as a catchall term in media but technically means web content hosted on darknets. Most deep web content is mundane (your email, bank accounts); darknet represents a small subset with intentional anonymity.
Is "onion routing" the same as "garlic routing"?
No, they are different approaches to anonymous routing. Onion routing (used by Tor) encrypts messages in layers with each relay peeling off one layer to reveal the next destination. Garlic routing (used by I2P) bundles multiple messages together like garlic cloves, encrypting them as a group for enhanced privacy. Both provide anonymity but through different technical approaches with different threat model implications.
What does "OPSEC" mean in darknet contexts?
Operational Security (OPSEC) refers to practices protecting anonymity and security from surveillance and investigation. In darknet contexts it specifically means: avoiding username reuse across platforms, using dedicated devices separate from personal equipment, never mixing anonymous and identified activities, maintaining consistent false personas without revealing real information, and eliminating any behavioral patterns that could link anonymous identities to real people.
What's an "exit scam"?
When marketplace administrators disappear with all user funds held in escrow. Since markets hold Bitcoin/cryptocurrency deposits from pending transactions, administrators can steal everything by shutting down unexpectedly and keeping the deposited money. Evolution Market's March 2015 exit scam took approximately $12 million from users. Empire Market's 2020 closure reportedly involved even larger amounts.
What's the difference between Bitcoin and Monero?
Bitcoin provides pseudonymity—transactions are public on the blockchain but use addresses rather than names. With effort, transactions can be traced. Monero provides stronger privacy through ring signatures (hiding senders), stealth addresses (hiding recipients), and RingCT (hiding amounts). Monero became preferred for darknet transactions as Bitcoin tracing improved, though both remain in use.
What is a "NIT" in law enforcement contexts?
Network Investigative Technique (NIT) is FBI terminology for malware deployed to identify anonymous users. NITs exploit browser vulnerabilities to reveal real IP addresses despite Tor protection. The Playpen investigation used NITs to identify over 8,700 users. Courts have debated whether NIT deployment exceeds warrant authority, with most upholding their use in serious cases.
Can I cite this glossary in academic work?
Yes, but supplement with academic sources when possible for scholarly rigor. Cite as: "DarkWiki Darknet Glossary. DarkWiki.ink, 2026." For critical terms in research papers, trace our definitions back to original academic papers, protocol specifications, or court documents cited in related articles for primary source verification.
How often is the glossary updated?
We review quarterly and update as needed when new terminology emerges or existing definitions require revision. The January 2026 update reflects current usage and technical developments through late 2026. Major protocol changes, significant court cases, and new technology adoption trigger review of affected terms between scheduled updates.
Understanding Terminology Categories
Darknet vocabulary spans multiple domains, each with distinct origins and usage patterns. Understanding these categories helps contextualize terms and reveals connections between concepts.
Network Architecture Terms
Network terminology describes how anonymous communication systems function. Terms like onion routing, relay, circuit, and guard node come from Tor's technical documentation. Understanding these terms requires grasping how traffic flows through anonymity networks—how packets are encrypted, routed through multiple hops, and delivered without revealing source or destination. The distinction between entry nodes (which know your IP), middle relays (which know neither endpoint), and exit nodes (which see destination) illustrates the layered architecture providing anonymity.
Cryptographic Concepts
Cryptography vocabulary appears throughout darknet discussions. PGP, public keys, private keys, encryption, hashing, and digital signatures form the foundation of secure communication. More advanced terms like zero-knowledge proofs, ring signatures, and stealth addresses describe privacy-enhancing cryptographic techniques. Understanding these concepts explains how anonymity and transaction privacy actually work at the mathematical level.
Marketplace Economics
Marketplace terminology evolved from darknet commerce needs. Escrow, finalize early (FE), vendor bond, reputation, listing, and dispute resolution describe economic mechanisms enabling anonymous transactions. These terms emerged from practical marketplace development rather than academic theory. Understanding marketplace vocabulary reveals how trust systems function without legal enforcement or identity verification.
Cryptocurrency Terms
Cryptocurrency vocabulary intersects heavily with darknet discussions. Bitcoin, Monero, wallet, transaction, blockchain, mixing, and tumbling describe payment systems enabling pseudonymous or anonymous transactions. Privacy-specific terms like ring signatures, stealth addresses, and RingCT explain how privacy coins like Monero enhance anonymity beyond Bitcoin's pseudonymity. Chain analysis describes investigative techniques tracking cryptocurrency flows.
Law Enforcement Terminology
Investigation vocabulary describes how authorities pursue darknet cases. Controlled delivery, undercover, informant, NIT (Network Investigative Technique), warrant, and seizure describe operational methods. Operation names like Bayonet and Onymous reference specific multi-agency efforts. Understanding law enforcement terminology helps interpret court documents and news coverage of darknet cases.
Security and OPSEC
Operational security vocabulary describes practices maintaining anonymity against sophisticated adversaries. OPSEC itself became a darknet term borrowed from military usage, where it means protecting mission-critical information. Compartmentalization separates identities and activities to prevent cross-contamination. Air gap physically isolates sensitive systems from networks. Burn notice warns that identities or methods are compromised. Pseudonymity uses consistent fake identities rather than complete anonymity. Understanding this vocabulary reveals how sophisticated actors attempt to maintain anonymity—and where failures occur leading to arrests.
Investigation and Legal Terms
Legal vocabulary appears frequently in darknet discussions. Warrant authorizes searches and seizures. Subpoena compels testimony or documents. Controlled delivery intercepts and tracks packages under surveillance. Parallel construction develops independent evidence trails protecting classified sources. Informant provides inside information to investigators. Understanding these terms helps interpret court documents and news coverage of darknet investigations.
Term Origin Sources
- Academic: Tor Project papers, cryptography research, peer-reviewed studies from security conferences
- Technical: Protocol specifications, software documentation, developer communications on mailing lists
- Legal: Court documents, indictments, sentencing memoranda, appellate decisions
- Cultural: Forum discussions, marketplace announcements, community usage on Dread and similar platforms
- Journalistic: Investigative reporting, expert interviews, verified news coverage
How Darknet Terminology Evolved
Darknet vocabulary developed in waves corresponding to technological and cultural changes. Understanding this evolution provides historical context for current terminology and reveals how the ecosystem's priorities shifted over time.
Pre-Tor Era (1990s-2002): Early privacy technology vocabulary came from cypherpunk mailing lists and academic research. Terms like PGP, anonymity network, mix network, and digital cash emerged from this period. The idealistic focus on privacy rights shaped terminology emphasizing protection against surveillance rather than criminal activity. Tim May's "Crypto Anarchist Manifesto" and similar writings introduced concepts like untraceable payments that later became operational realities. This foundational period established the philosophical vocabulary underlying later technical development.
Tor Development (2002-2010): Tor Project introduced onion routing vocabulary including circuits, relays, guard nodes, exit nodes, and hidden services. Technical documentation standardized terms that became universal in darknet discussions. The .onion address format created a recognizable identifier for Tor hidden services. Protocol specifications defined terms precisely, though popular usage sometimes diverged from technical accuracy. This period saw vocabulary transition from academic research to practical application.
Silk Road Era (2011-2013): Marketplace terminology exploded during this period. Escrow, vendor, FE, dispute, reputation, and listing became common vocabulary describing economic mechanisms. The Dread Pirate Roberts username became synonymous with Silk Road administration and anonymous leadership. Bitcoin vocabulary integrated with marketplace terms as cryptocurrency enabled anonymous payments. Terms like "stealth shipping" described operational practices. This period generated most marketplace-specific terminology still in use today.
Post-Silk Road Diversification (2014-2017): Multiple marketplaces introduced variations in terminology reflecting technical innovation. Multisig escrow replaced simple escrow on advanced platforms, adding cryptographic precision to transaction vocabulary. Monero (XMR) vocabulary joined Bitcoin terms as privacy coins gained adoption—ring signatures, stealth addresses, and RingCT entered discussions. Operation names like Onymous and Bayonet entered the lexicon as law enforcement branded their actions. Exit scam became common after Evolution Market's March 2015 theft demonstrated the vulnerability.
Modern Era (2018-2026): Current terminology reflects matured ecosystem with established vocabulary and emerging additions. Chain analysis describes investigative techniques that didn't exist a decade earlier. V3 onion addresses replaced V2 following protocol updates in 2021, requiring terminology updates. Ransomware vocabulary entered from cybercrime discussions as darknet infrastructure supported extortion operations. Dread became shorthand for the major forum replacing Reddit's banned communities. Terms continue evolving as technology and culture change, though the pace has slowed as the ecosystem matures.
"Darknet vocabulary reflects its community's evolution from idealistic cypherpunks to pragmatic marketplace operators. The language shifted from abstract privacy rights to concrete transaction mechanics, though both vocabularies persist."
— DarkWiki Research, 2026
Regional and linguistic variations affect terminology. English dominates darknet discussions, but non-English marketplaces develop local vocabularies. Russian-language forums use different terms than English equivalents. Translation between communities sometimes introduces confusion. International researchers must understand these variations when analyzing cross-cultural darknet activity.
Slang and informal terminology evolves faster than technical vocabulary. Terms emerge from forum discussions, spread through repetition, and sometimes fade from use. Some slang becomes standard usage; other terms remain niche. Our glossary focuses on established terms with stable meanings rather than ephemeral slang that might confuse rather than clarify. For slang research, forum archives provide better sources than glossaries.
Future terminology updates will reflect ongoing ecosystem evolution. As new protocols emerge, new privacy technologies develop, and new investigation techniques become public, vocabulary expands accordingly. We track these developments and incorporate new terms as they gain established usage in research and community discussion.
Beyond the Glossary
The glossary provides definitions, but full understanding requires deeper exploration. Our encyclopedia articles explain concepts in detail with technical specifications and examples. History section provides context for when terms emerged and how usage evolved. Technology articles demonstrate how terminology applies in actual implementations.
For researchers writing papers or journalists covering darknet topics, the glossary serves as a starting point rather than complete reference. Technical terms benefit from reading original protocol documentation. Historical terms gain context from court documents and contemporary accounts. Cultural slang requires understanding community dynamics beyond dictionary definitions.
Related DarkWiki Sections
- Encyclopedia - Detailed concept explanations with technical depth
- Technology - Technical implementations and protocol details
- History - Terminology evolution and historical context
- Markets - Marketplace economics and transaction terms
- Incidents - Law enforcement operations and investigation terminology
- Notable Figures - Key individuals and their associated terminology
External resources supplement glossary definitions. Tor Project documentation provides authoritative technical terminology with implementation details. Academic papers from USENIX Security, IEEE S&P, and ACM CCS introduce new concepts with precise definitions verified through peer review. Court documents reveal how legal professionals use and define darknet terms in official proceedings.
We welcome suggestions for additional terms or corrections to existing definitions. Darknet vocabulary continues evolving, and community input helps keep this glossary current and accurate. Contact us through official channels with proposed additions or clarifications.
Using This Glossary Effectively
Different users should approach this glossary based on their needs and backgrounds. Students new to darknet topics should read category introductions before diving into specific terms. Researchers looking up unfamiliar terms from papers can use the quick navigation by letter. Journalists fact-checking terminology can verify specific definitions against our sources.
Each definition provides the important meaning suitable for general understanding. For deeper technical detail, follow links to related encyclopedia articles. For historical context, see our history section documenting when and why specific terminology emerged. For practical application examples, incidents documentation shows terms used in real-world contexts.
Cross-referencing multiple definitions builds thorough understanding. Reading about "escrow" leads naturally to "multisig," "dispute," and "exit scam"—concepts forming an interconnected system. Similarly, Tor terminology connects across entries: "circuit," "guard node," "exit node," and "hidden service" describe different aspects of the same network architecture. Building connections between terms deepens understanding beyond isolated definitions.
For specific research needs, our encyclopedia articles provide detailed exploration of key terms. The glossary gives you quick definitions; encyclopedia entries explain concepts thoroughly with examples, history, and implications. Use the glossary for quick reference and orientation; use the encyclopedia for thorough understanding of topics central to your work.
A
Address Hopping
The practice of frequently changing cryptocurrency addresses to increase anonymity and prevent transaction tracking.
Ahmia
A search engine that indexes content from the Tor network, filtering out illegal content to provide safer darknet search.
Anonymity Network
A network designed to provide anonymous communication by concealing user identities, locations, and activities from surveillance.
Anonymity Set
The group of users among whom an individual hides—larger sets provide stronger anonymity.
AES
Advanced Encryption Standard - symmetric encryption algorithm used widely for securing data.
Air Gap
Physical isolation of a computer from networks to prevent remote access and data exfiltration.
Alpha02
Username of Alexandre Cazes, founder and administrator of AlphaBay marketplace.
AlphaBay
Major darknet marketplace (2014-2017) that became the largest before Operation Bayonet takedown.
B
Bitcoin
The first decentralized cryptocurrency (2009), widely used for darknet transactions before privacy coins gained popularity.
Blockchain
A distributed ledger technology recording transactions across multiple computers in an immutable chain.
Bridge Relay
An unlisted Tor relay used to circumvent censorship in countries that block known Tor entry points.
Bulletproof Hosting
Hosting services that ignore abuse complaints and law enforcement requests, often in jurisdictions with weak cyber laws.
Burn Notice
Warning that an identity, address, or operational method has been compromised and should no longer be used.
BTC
Abbreviation for Bitcoin, the dominant cryptocurrency symbol.
C
Circuit
In Tor, a path through the network consisting of three relays: entry (guard), middle, and exit node.
Clearnet
The regular, publicly accessible internet as opposed to darknets—standard websites indexed by search engines.
Cold Storage
Storing cryptocurrency offline (paper wallets, hardware wallets) to protect against theft or hacking.
Controlled Delivery
Law enforcement technique where intercepted packages are delivered under surveillance to identify recipients.
Cryptocurrency
Digital currency using cryptography for security, operating independently of central banks.
Cypherpunk
Movement advocating widespread use of cryptography and privacy-enhancing technologies as a route to social change.
CAPTCHA
Challenge-response test to determine whether user is human, used by darknet sites to prevent automated access.
Chain Analysis
Techniques for tracing cryptocurrency transactions through the blockchain to identify users.
Chainalysis
Leading blockchain analysis company providing tools to law enforcement for cryptocurrency tracing.
D
Darknet
An overlay network requiring specific software (Tor, I2P) to access, designed for anonymity and censorship resistance.
Dark Web
Web content existing on darknets, accessible only through specialized software like Tor Browser.
Dead Drop
Method of exchanging information or goods without direct contact between parties, used for physical delivery.
Decentralized
A system without central control, making it resistant to shutdown, censorship, or single points of failure.
Deep Web
Parts of the internet not indexed by search engines—password-protected sites, databases, private pages. Distinct from darknet.
Deanonymization
The process of revealing the true identity of an anonymous user through technical or investigative means.
DDoS
Distributed Denial of Service - attack overwhelming servers with traffic, commonly used against darknet markets.
Dispute
Formal complaint process on marketplaces when transactions fail, resolved by administrators or moderators.
Dread
Reddit-like forum on Tor for darknet market discussion, launched after Reddit banned darknet communities.
Dread Pirate Roberts
Pseudonym used by Silk Road administrators, most famously Ross Ulbricht.
E
End-to-End Encryption
Encryption where only communicating users can read messages—intermediaries cannot decrypt content.
Escrow
Payment system where funds are held by marketplace until buyer confirms receipt, protecting both parties.
Exit Node
The final relay in a Tor circuit connecting to clearnet destinations, can see unencrypted traffic.
Exit Scam
When marketplace administrators disappear with user funds held in escrow, stealing deposited cryptocurrency.
Encryption
Process of encoding information so only authorized parties can read it using decryption keys.
Entropy
Measure of randomness in cryptographic systems—higher entropy means stronger security.
Eepsites
Websites hosted on the I2P network, equivalent to Tor hidden services.
F
FE (Finalize Early)
Releasing escrow funds before receiving goods—risky for buyers as it removes purchase protection.
Freenet
Peer-to-peer platform (2000) for censorship-resistant communication and anonymous file sharing.
Fingerprinting
Identifying users through unique browser or device characteristics rather than IP addresses.
Forum
Discussion platforms on darknet for market announcements, vendor reviews, and community communication.
FBI
Federal Bureau of Investigation - primary US agency investigating darknet crimes.
Flipped
When arrested individuals become informants, cooperating with law enforcement against former associates.
G
Garlic Routing
I2P encryption method bundling multiple messages together like garlic cloves for enhanced privacy.
Guard Node
The first relay in a Tor circuit, knowing your real IP address but not your destination.
GPG
GNU Privacy Guard - open-source implementation of PGP encryption standard.
Genesis Block
The first block in a cryptocurrency blockchain, hardcoded into the software.
H
Hidden Service
Server accessible only through Tor using .onion address, hiding both server and user locations.
HTTPS
Secure HTTP protocol using SSL/TLS encryption for web traffic, standard for clearnet security.
Honeypot
Decoy system designed to attract attackers or criminals while monitoring their activities.
Hash
One-way cryptographic function converting data into fixed-length string, used for verification.
Hardware Wallet
Physical device storing cryptocurrency private keys offline for enhanced security.
Hansa Market
Darknet marketplace secretly controlled by Dutch police in 2017 as honeypot during Operation Bayonet.
I
I2P
Invisible Internet Project - anonymous network layer using garlic routing for censorship-resistant communication.
IP Address
Internet Protocol address identifying devices on networks—revealing IP breaks anonymity.
Informant
Individual providing information to law enforcement, often in exchange for reduced charges.
IRC
Internet Relay Chat - early chat protocol still used by some darknet communities.
J
Jurisdiction Shopping
Selecting hosting locations or operational bases in countries with weak cybercrime enforcement.
JTAN
Joint Terrorist Financing Investigations (US) - multi-agency cryptocurrency investigation units.
K
Key Pair
Public and private keys used in asymmetric cryptography for encryption and digital signatures.
Keylogger
Malware recording keystrokes to capture passwords, cryptocurrency keys, or other sensitive data.
KYC
Know Your Customer - identity verification requirements at cryptocurrency exchanges that can expose users.
L
Listing
Product or service advertisement on darknet marketplace with description, price, and shipping options.
Lokinet
Anonymous networking protocol using onion routing with cryptocurrency-based incentives for relay operators.
LulzSec
Hacking group (2011) whose members including Sabu were later arrested after informant cooperation.
M
Mixing Service
Service combining cryptocurrency from multiple users to obscure transaction trails and origins.
Monero (XMR)
Privacy cryptocurrency using ring signatures, stealth addresses, and RingCT for transaction anonymity.
Multisig
Multi-signature wallets requiring multiple keys (e.g., 2-of-3) to authorize transactions, preventing unilateral theft.
Mirror
Alternative URL for the same darknet site, providing redundancy against DDoS and takedowns.
Metadata
Data about data—timestamps, sender/recipient information that can reveal patterns even with encrypted content.
Moderator
Marketplace staff handling disputes, reviewing vendors, and enforcing rules.
MITM
Man-in-the-Middle attack intercepting communications between two parties.
N
NIT
Network Investigative Technique - FBI malware deployed to reveal Tor users real IP addresses.
Node
Computer participating in a network, such as Tor relays or cryptocurrency network validators.
Nonce
Number used once in cryptographic protocols to prevent replay attacks.
O
Onion Routing
Encryption technique wrapping messages in multiple layers, each relay peeling one layer like an onion.
Onion Address
A .onion URL identifying a Tor hidden service, generated from cryptographic keys.
OPSEC
Operational Security - practices maintaining anonymity: compartmentalization, avoiding patterns, secure communications.
Operation Bayonet
2017 coordinated takedown of AlphaBay and Hansa Market involving US, Dutch, and Thai authorities.
Operation Onymous
2014 international operation seizing 400+ hidden services including Silk Road 2.0.
OTR
Off-the-Record messaging protocol providing encryption, authentication, and deniability.
P
PGP
Pretty Good Privacy - encryption program for secure email and file encryption using public-key cryptography.
Pseudonymity
Using consistent fake identity (username, reputation) rather than complete anonymity.
Private Key
Secret cryptographic key that must be protected—controls cryptocurrency wallets and decrypts messages.
Public Key
Cryptographic key that can be shared publicly for encryption and signature verification.
Phishing
Fraudulent attempts to obtain credentials through fake login pages or deceptive communications.
Proof of Work
Consensus mechanism requiring computational effort to validate transactions (Bitcoin mining).
R
Relay
Server in anonymity network routing encrypted traffic between users and destinations.
Ring Signature
Cryptographic signature hiding actual signer among a group of possible signers (used in Monero).
RingCT
Ring Confidential Transactions - Monero feature hiding transaction amounts.
Reputation
Trust score accumulated through successful transactions, reviews, and marketplace history.
Ransomware
Malware encrypting victim data and demanding cryptocurrency payment for decryption keys.
S
Silk Road
The first major darknet marketplace (2011-2013), founded by Ross Ulbricht (Dread Pirate Roberts).
Stealth Address
One-time addresses generated for each transaction, preventing address reuse tracking.
Sybil Attack
Creating multiple fake identities to gain disproportionate influence in a network or voting system.
SHA-256
Secure Hash Algorithm producing 256-bit hash, used in Bitcoin and many cryptographic applications.
Seed Phrase
Recovery words (12-24) that can regenerate cryptocurrency wallet—must be kept secret and secure.
SIGINT
Signals Intelligence - intelligence gathered from electronic communications and signals.
Subpoena
Legal order compelling testimony or document production, used in darknet investigations.
T
Tor
The Onion Router - free software enabling anonymous communication through volunteer relay network.
Tumbler
Service mixing cryptocurrency transactions to break the trail between sender and recipient.
Tails
The Amnesic Incognito Live System - security-focused OS routing all traffic through Tor, leaving no traces.
Traffic Analysis
Analyzing communication patterns (timing, volume) to infer information without reading content.
Tor Browser
Modified Firefox browser configured to route traffic through Tor network and access .onion sites.
Two-Factor Authentication
2FA security requiring two verification methods—password plus code from device or authenticator app.
U
UTXO
Unspent Transaction Output - Bitcoin accounting model tracking individual transaction outputs.
Undercover
Law enforcement agents operating with false identities to infiltrate criminal organizations.
V
VPN
Virtual Private Network - encrypts internet connection and masks IP address through remote server.
Vendor
Seller on darknet marketplace offering products or services to buyers.
Vendor Bond
Deposit required from new vendors to list products, deterring scammers and Sybil attacks.
V3 Onion
Current Tor hidden service protocol (since 2021) with longer addresses and improved security.
Verification
Process confirming vendor identity, product quality, or link authenticity.
W
Wallet
Software or device storing cryptocurrency private keys and enabling transactions.
Whonix
Security-focused operating system using two VMs to isolate Tor routing from applications.
Warrant
Legal authorization for law enforcement actions like searches, seizures, or surveillance.
Wasabi Wallet
Bitcoin wallet with built-in CoinJoin mixing for transaction privacy.
Whistleblower
Person exposing wrongdoing within organizations, often using anonymity tools for protection.
X
XMR
Ticker symbol for Monero cryptocurrency, preferred on darknet markets for privacy features.
XChaCha20
Stream cipher used in modern encryption implementations for speed and security.
Z
Zero-Knowledge Proof
Cryptographic method proving knowledge of information without revealing the information itself.
ZeroNet
Decentralized web platform using Bitcoin cryptography and BitTorrent for censorship-resistant hosting.
Zcash
Privacy cryptocurrency using zero-knowledge proofs (zk-SNARKs) for shielded transactions.