For years, the reliable way to follow money off a darknet site was simple: find the crypto address on the checkout page, watch it on-chain, attribute the operator. This is the next turn of that screw, and the one that worries me most, because it doesn’t just obscure the operator — it hides them inside legitimate traffic.
More and more darknet operators don’t run their own wallet at all. They bolt a legitimate, hosted cryptocurrency payment gateway onto their checkout — the same kind of service a normal e-commerce store uses to accept Bitcoin. The buyer sees a familiar “pay with crypto” widget. The operator never touches an address. And the address that does appear belongs to the payment processor, not the criminal.
Why this is so much harder to catch
Address-based detection assumes the address on the page is the operator’s, that it’s reasonably stable, and that once flagged bad it stays bad. A hosted gateway breaks all three.
The address is the processor’s. When funds arrive, the gateway sweeps them into its own pooled infrastructure and credits the merchant internally — so on-chain, the money flows into a large, legitimate, high-volume cluster shared by thousands of innocent merchants. Follow the address and you arrive at the gateway, not the operator.
The address rotates per invoice. Good gateways mint a fresh receiving address for every transaction, so the site never displays a stable “known bad” address to blacklist. In our data, roughly a fifth of the gateway-using sites we’ve confirmed had never surfaced a funded address through conventional flagging at all — there was nothing for an address-watch list to catch.
And the fingerprint is laundered. A site running a mainstream checkout widget looks, structurally, like any other merchant running that widget. The bespoke payment page that used to give an operator away is replaced by clean, off-the-shelf integration code. They’ve borrowed the camouflage of legitimate commerce.
The detection has to change layers
If you can’t rely on the address, you detect the integration instead. Stop asking “is this address bad?” and start asking “is this site quietly wired into a hosted payment gateway — and is the site itself illicit?”
That is what our system does. It fingerprints the gateway integration directly — the embedded widget, the JavaScript signatures, the invoice-generation endpoints, the HTML artifacts a given processor leaves behind — rather than the address it produces. A broad first-pass screen runs across everything we crawl and currently flags on the order of 1,200 candidate sites carrying gateway signatures. Those are noisy, so a second stage confirms each one: vision and language models read the actual rendered page to decide both which gateway is in use and whether the site it sits on is genuinely illicit.
What survives that pipeline right now is 217 confirmed gateway integrations across 206 distinct darknet operators — around 90 of them CSAM operators — spanning more than a dozen different gateway providers. Those providers run the full spectrum: hosted invoicing APIs, self-hosted open-source processors, even mainstream mass-market checkout widgets you would recognize from ordinary online stores.
A word about the gateways themselves
We deliberately do not name them. These are, overwhelmingly, legitimate companies whose product is being abused — the way a legitimate bank is abused when a criminal opens an account. Naming a processor as “the darknet’s gateway” would punish the victim of the abuse and tell you nothing useful. The point is not that any one provider is complicit. The point is that the category — easy, hosted, address-abstracting crypto payments — is now a standard tool in the illicit toolkit, and detection built around addresses will quietly miss all of it.
There is a constructive side to this. A gateway integration is also a relationship. The processor, unlike the darknet operator, is a real company with compliance obligations, terms of service, and the ability to cut a merchant off. When our pipeline confirms an illicit site running a specific hosted gateway, that becomes something the provider can act on — a responsible-disclosure signal delivered to the one party with both the standing and the leverage to shut the account down. The address graph could not give you that. The integration can.
The through-line
The obvious signal keeps getting hijacked. When the URL lies about identity, you follow the money. When the money is noisy, you filter for the strong edges. And now, when the money is outsourced to a legitimate processor, you cannot follow the address at all — you detect the plumbing, and read the page to know what it is plumbed into. The work is in finding the next layer down that the adversary has not learned to fake yet, and handing what you find to the one legitimate party who can actually pull the plug.