Threat Management, Threat Management

Litecoin emerges as popular Bitcoin alternative among dark web underground community

An analysis of 150 of popular dark web message boards, marketplaces and illegal services has revealed that underground vendors have been gravitating toward Litecoin cryptocurrency as a viable alternative to Bitcoin when conducting transactions.

Conducted by Recorded Future's Insikt Group research team between Jan. 20 and Feb. 1, the study found that Litecoin – the second oldest cryptocurrency in existence (after Bitcoin) – is now accepted as a Bitcoin alternative by 30 percent of the 150 observed dark web vendors. The next most widely accepted cryptocurrencies are Dash (20%), Bitcoin Cash (13%, not to be confused with Bitcoin itself), Ethereum (9%), and Monero (6%).

Recorded Future suspects that this development could portend a greater diversification of cryptocurrency-based transactions on the dark web in the next six to 12 months.

"Bitcoin will lose its place as a dominant payment method in the dark web in the next six to 12 months. However, contrary to a widespread assumption that criminals are abandoning Bitcoin altogether, we are convinced it will remain one of the main payment instruments, albeit with a significantly smaller market share," wrote Andrei Barysevich, Recorded Future's director of advanced collection, and intelligence analyst Alexandr Solad, in a company report that was released today. "On the other hand, Litecoin and Dash will take their place next to Bitcoin as the everyday payment currencies of the dark web."

Bitcoin has already notably fallen out of favor with cybercriminals who extort their victims in ransomware attacks, because other digital currencies are more anonymity. In this instance, however, the dark web vendors are seeking Bitcoin alternatives because Bitcoin has become too mainstream and popular, resulting in higher fees.

“The meteoric rise in popularity of Bitcoin among household users, speculators, and institutional investors around the world since mid-2017 has placed an enormous load on the blockchain network, resulting in larger payment fees,” the report states. “As a result, Bitcoin payments have become economically infeasible, because the subsequent cost of transaction increased ten-fold, sometimes as much as 30 percent of the smaller payment amounts.”

The report also notes that some vendors are fed up with waiting up to 24 hours to triple-confirm Bitcoin transactions, as a protection against users who may be trying to use the same coin more than once in quick succession, in what's known as a double spend attack. “As with any business agreement, speed of payment completion is crucial – this is especially true for the dark web. With its inherent risk of transacting and distrust among its members, every minute of delay increases the chance of being ripped off,” the report explains.

Barysevich and Solad add that it was around mid-2016 that Recorded Future first took note of cybercriminal networks “discussing their growing dissatisfaction with Bitcoin as a payment vehicle, regardless of their geographical distribution, spoken language, or niche business.”

Interestingly, the dark web vendors' digital currency preferences don't necessarily gibe with their customers' desires. During their dark web investigation, Insikt Group researchers came across a criminal forum poll that asked several hundred members which cryptocurrency type should be accepted next. There was no unanimous consensus – Monero was the most popular choice (21.82% of survey-takers), followed by Dash (20.61%), Ethereum (19.39%), Litecoin (15.15%), Bitcoin (13.33%), and Bitcoin Cash (9.70%).

Recorded Future also found a notable divergence between Eastern European dark web sites, who accept Litecoin payments above any other non-Bitcoin cryptocurrency (35% of sites), and English-speaking dark web service providers, who accept Monero more often than any other digital currency (15% of sites, although Litecoin was the second most accepted, at 11%).

“While Russians favored the accessibility and convenience of Litecoin, with a more diverse and established supporting infrastructure, English-speak[ers] seem to be more security-oriented, choosing Monero for its built-in safety features,” the report states, noting that only three percent of Eastern European dark web sites take Monero.

Ryan Taylor, CEO of the Dash Core team, took issue with the report, refuting its findings that Dash was among the more popular cryptocurrencies of choice among the cybercriminal community. “The Dash network is not aware of a single Darknet market that uses Dash on its platform,” said Taylor, in an emailed statement. “Numerous publicly available reports, even with Tor and VPN assisted searches, have indicated no adoption of Dash as an alternative payment method for these transactions. Currently, less than one percent of transactions on the Dash network utilize the PrivateSend feature, which contradicts the assertion that Dash is on the rise as a dark net payments alternative."

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.