The seizure of Hydra's servers by German authorities in April 2022 left users of the largest Russian-speaking darknet marketplace without a platform. However, the vacuum was quickly filled, and a new marketplace emerged, known as Kraken (not to be confused with the cryptocurrency exchange of the same name).
Thousands of stores migrated to this marketplace, which developed its own money laundering system. According to on-chain investigations, Kraken processed at least $186.5 million, with nearly $147.5 million reaching various cryptocurrency exchanges.
BitOK analysts investigated the operational structure of the marketplace and its connection to Hydra, tracking the flow of funds generated from drug trafficking.
Understanding Kraken Market
Kraken serves as a prominent Russian-speaking darknet marketplace that operates via the Tor browser. Unlike a centralized organization, it acts as a coordinating platform: the administration provides the interface, accounts, internal BTC balance, catalog, reviews, arbitration, and a mechanism for issuing "stash cards," while hundreds of independent stores manage their own procurement, packaging, storage, and distribution of goods.
Essentially, Kraken functions as a shadowy equivalent of AliExpress, offering a wide array of illegal goods and services instead of inexpensive Chinese products.
Marketplace Interface. Source: Kraken.The scale of the platform is evident from blockchain analytics. By 2025, Kraken had claimed the top spot among Russian-speaking darknet markets. In 2023, it accounted for 30.9% of the identified segment for customers in Russia, with an estimated on-chain influx of around $737 million in 2024. This figure is comparable to the GDP of countries like Dominica and Tonga.
It's important to clarify that this data does not reflect the platform's profit, but rather the total flow through its infrastructure, including buyer payments, store turnovers, wallet transfers, and exchange operations. The actual owners of Kraken remain publicly unidentified.
Due to its decentralized operational model, Kraken is nearly impossible to dismantle with a single arrest. When hundreds of independent stores conduct trade, and the central hub only manages the front-end and financial transactions, apprehending an individual seller or dealer does not cripple the system—another quickly takes their place. For analysts, this implies that the focus should be on finding the financial nodes through which all store funds pass; these nodes are the true heart of the marketplace.
Transition from Hydra to Kraken
The story of Kraken began with the downfall of the notorious Hydra. On April 5, 2022, German law enforcement shut down the servers of the then-largest Russian-speaking darknet marketplace, leaving thousands of participants without a platform, profiles, or familiar communication channels. The resulting market void became a battleground for several new projects.
The first mentions of the future Kraken appeared in May 2022, as the project was openly promoted as a successor to Hydra. Its organizers capitalized on the legacy of the legendary marketplace.
Rumors circulated that Kraken was created by former owners or administrators of Hydra, but no direct evidence of shared ownership, funds, servers, or keys was found at that time.
WayAway, a forum historically linked to the Hydra ecosystem, played a crucial role in the launch. After July 2, 2022, it became a promotional platform for Kraken, where sellers reestablished contacts and reputations, discussed safety, and transferred knowledge from the previous ecosystem.
For analysts, the "legacy of Hydra" is not just a poetic metaphor but a working hypothesis that can be verified through blockchain analysis. If two platforms share personnel and procedures, their financial channels will eventually intersect—similar withdrawal schemes, identical services, and sometimes even shared addresses. Spoiler alert: such intersections were indeed found in this investigation.
Market Capture
Kraken did not limit itself to covert advertising in the darknet; it also made a move into the offline world. In the autumn of 2022, the project showcased a teaser on a 3D screen in Moscow City.
https://www.youtube.com/watch?v=0wB3M4AYBZE
On December 19 of the same year, a bus adorned with Kraken's logo and QR code blocked traffic near the Russian Ministry of Foreign Affairs.
Kraken Bus in Central Moscow. Source: Kraken.On YouTube, you can find compilations that include other advertising campaigns for the darknet marketplace, including posters in the metro.
The new platform became fully operational by the end of December 2022. In one of the early snapshots, over 1,720 stores were registered on it—though many profiles were inactive, so this number cannot be considered the count of active sellers, it reflects the scale of the launch.
A curious twist occurred in the project’s fate. On December 28, a competing platform, Solaris, imposed restrictions against WayAway and Kraken. On January 13, 2023, Solaris was hacked. Hackers gained access to its control channels and began redirecting users to Kraken.
How the Platform Operates
For buyers, the process appears straightforward: they log in and register through Tor, top up their internal balance or pay for specific orders, select a store, product, and city. It's similar to traditional marketplaces.
After payment, the client receives a "stash card" detailing the location and photos of the stash. There is usually no direct contact between the buyer and seller.
Behind the scenes, Kraken operates like a conveyor belt:
- external recruitment of employees;
- collateral or candidate verification;
- employee registration;
- receipt of the product batch;
- packaging;
- stash creation;
- product photography and description;
- data upload to the platform;
- automated sales.
Staff are recruited through messaging platforms and external channels. Payments are made to bank cards or within the internal BTC network.
Stores bear the costs of procurement, storage, and logistics, while the central platform profits from commissions, listings, promotions, collateral, arbitration, and related exchange routes.
Geographical Reach
The primary market for Kraken is Russia. Judicial and operational episodes confirm the operation of connected store groups across all regions of the country. Additionally, some of the audience and infrastructure extend beyond its borders.
A single store may operate in multiple cities, hire local couriers and dealers, use separate warehouses, and change personnel without direct involvement from the administrative hub.
Product Range
The core of the trade consists of drugs. Legal cases confirm transactions involving cannabis, mephedrone, and other substances. Besides drugs, Russian-speaking darknet markets also feature documents, SIM cards, sensitive data, precursors, laboratory equipment, and cyber services.
Marketplace Interface. Source: Kraken.Physical logistics are intentionally separated from the digital platform. The website offers a catalog, seller rating data, and payment options. The actual movement of goods is managed by store employees. This architecture reduces direct contacts and allows for quick replacement of apprehended employees.
Technical Aspects
Kraken operates through a Tor service. Its administration claims to utilize distributed nodes and several data centers. There is insufficient public server, DNS, or hosting artifacts to accurately determine the architecture and location of its infrastructure.
Its long-standing resilience to shutdowns indirectly suggests redundancy, the use of mirrors, and DDoS protection, but the specific configuration remains unknown.
How Kraken Launders Money
This is where it gets particularly interesting. Bitcoins obtained from sales are not withdrawn in a single transfer to one wallet. The investigation uncovered three distinct routes that collectively form a unified system.
The total identified volume is $186,497,100.89, which is a conservative estimate. This figure includes only operations from three analyzed schemes, excluding undisclosed wallets, private coins, and internal unmarked transfers.
SchemeIdentified VolumeNext Steps- Bridgers → BNB Smart Chain: $72,553,691.68; BTCB was converted to USDT/USDC; funds were sent to HTX, MEXC, KuCoin, and Gate.io.
- Avalanche → HTX: $74,193,409.21; BTCB was converted to USDT and transferred to HTX infrastructure.
- Embedded Exchanges → Bridgers → TRON: $39,750,000.00; BTC was converted to USDT and subsequently dispersed across TRON, Near Intents, and exchanges.
Each of these technically distinct schemes served the same purpose: to sever the direct link between incoming BTC and the ultimate recipients. Let's look at each in more detail.
Scheme 1: Through Bridgers to BNB Smart Chain
The first route operates as follows. Small bitcoins from sales are automatically aggregated into large batches through a script, which are then left dormant for several days at a separate address. This pause is intended to obscure the trail: when there is a delay between the receipt of funds and their subsequent transfer, it becomes more challenging to link the two.
Then, the batch is split into transfers of approximately 1 BTC and sent via the Bridgers exchange service to the BNB Smart Chain, where the bitcoins are converted into BTCB, or "wrapped" bitcoin. BTCB is then exchanged for stablecoins USDT and USDC through PancakeSwap and distributed across numerous wallets, from which the funds flow to other exchanges. The total withdrawal volume through this route is $72.55 million.
Let’s break it down step by step.
Part of the Scheme. Visualization created using the Graph tool from BitOK.Step 1: Aggregation into Standard Batches. Initially, numerous small payments are combined into a single large transfer. In bitcoin, this can involve many "inputs"—separate amounts from different addresses that are summed—and several "outputs," meaning addresses to which the funds are sent. This aggregation allows disparate inflows to be consolidated into one batch.
A characteristic example is transaction 5aff3115267898ff464c566f7a3dc28c9b02eb89c4e1c6fdbf971aa4bce834d6, which aggregated 43 separate inputs totaling 10.50668671 BTC and distributed them across six addresses, with the main amount—9.99676527 BTC—going to intermediate address bc1qep5e35…2wl0r.
Such a batch typically maintains a consistent size—around 9.995–9.997 BTC (slight discrepancies are due to network fees). The batch is then divided roughly in half, with approximately 5 BTC sent in transfers of about 1 BTC. This uniformity in batch size, timing, and division repeatedly suggests an automated—likely programmed—process.
Consider an example: several days later, on January 9, 2026, the dormant amount (transaction 7f7b89f6c7b3620807f758464faa72019d074343e51a0c8f2eccf2e38febb561) split into two transfers:
- 5.08065441 BTC → bc1q5r45pv…st42a;
- 4.91610381 BTC → bc1qx6hq03…wc8ul.
Step 2: Transition to BNB Smart Chain. The divided bitcoins (the 1 BTC transfers) are sent to the Bridgers exchange service, which accepts an asset in one network and issues an equivalent in another. The bitcoins are directed to its address bc1q7t4vye…m78fz.
To inform the service where to send the funds, each bitcoin transfer includes a short OP_RETURN marker—an internal transaction note with the recipient's address in the other network. It appears as follows: cHi:to:BTCB:0x0eAe2b8A…C210D, indicating "issue BTCB to this address in the BNB Smart Chain."
The issuance of BTCB on the BNB Smart Chain is consistently managed by the same Bridgers smart contract—a processing program at address 0xb685760ebd368a891f27ae547391f4e2a289895b.
A total of 122 payments from 15 bitcoin addresses amounting to 120.8449 BTC passed through this channel, with payments occurring in two series: a trial series on January 18, 2026 (four payments totaling 4.0198 BTC) and a main series from July 6 to 25, 2026 (118 payments totaling 116.8251 BTC). The total output was 119.998853 BTCB, with a difference of about 0.70%—the service fee.
To illustrate one operation: on January 18, 2026, address bc1qnhjhvn…9dvye sent 1 BTC (transaction 4063840f9683efd375c62769249837c599e0513f0464e6436a18aa9a98c6b986) with a marker to address 0x73b2ef85…2949e and received 0.992999 BTCB shortly after. After four such payments, 3.991657 BTCB accumulated at the address, which was sent further to handler wallet 0x2cb8755a…a5678.
Step 3: Aggregation, Exchange for Stablecoins, and Distribution. The BTCB received were pooled into processing wallets—service wallets that aggregate, exchange, and redistribute funds. There were five such wallets, each with different roles:
- Four wallets handled the primary processing: 0x2cb8755a…a5678, 0x5ff82bb9…8121, 0xe9de4dd0…b34e, 0xae66f81a…bfd1. The main one, 0xae66f81a…bfd1, collected BTCB (incoming from 14 of the 15 recipient addresses), exchanged them for stablecoins, and distributed them onward;
- A separate wallet, 0xae6643c8…8fd1, only accumulated BTCB (from 11 of the 15 addresses) without exchanging anything.
The exchange of BTCB for stablecoins took place through PancakeSwap—using its contracts Infinity Vault 0x238a3588…e6c4, two V3 pools (0x9c4ee895…2cce and 0x9f599f3d…da61), and the Universal Router 0xd9c500df…9aeb. The scale can be illustrated by a recorded exchange of 4.3 BTCB for approximately 280,000 USDT or USDC.
Subsequently, the stablecoins were dispersed across numerous wallets—just the main wallet 0xae66f81a…bfd1 made 84 transfers to 58 addresses (typical sums were 112,000, 166,000, 168,000 USDT per transfer). Ultimately, the funds reached exchange wallets identified by analysts as part of the HTX, MEXC, KuCoin, and Gate.io infrastructure. In total, this route processed and withdrew $72,553,691.68 in USDT and USDC.
An important note: this scheme had a minor offshoot where 6,653,600 USDT was sent to a separate TRON wallet, circulating through service nodes (Sun.io, deBridge) with reciprocal and return transfers. This is internal service turnover, not a separate loss amount.
Chronologically, the scheme unfolded as follows: bitcoin aggregation began in late December 2025, a trial exchange occurred on January 18, 2026, the main wave of transfers took place from July 6 to 25, and the distribution of stablecoins concluded by July 29, 2026.
Part of the Scheme. Visualization created using the Graph tool from BitOK.Scheme 2: Through Avalanche to HTX
The second route operates differently. Bitcoins associated with the platform are divided and transferred through a specific bridge to the Avalanche network, where BTC.b—a local version of "wrapped" bitcoin—is issued. Subsequently, BTC.b is exchanged for USDT stablecoin and sent to the HTX exchange. This is the largest of the three routes, processing 788.89 BTC, resulting in $74.19 million. Notably, this route revealed a connection to Hydra.
Funds Path. A total of 788.89449332 BTC passed through the associated Avalanche infrastructure. They traveled in two streams: 390.497092 BTC through two intermediate addresses (bc1q203yu…aljpy and bc1qwggq…4dv2), and the remaining 398.39740132 BTC through other addresses, following the same scheme and with identical endpoints.
The scheme for one chain appeared as follows: bitcoins were divided, and the amount gradually decreased—8.08 → 7.08 → 5.08 BTC. After mixing with other funds, a transfer of approximately 1.25 BTC was formed: initially, 1.24999450 BTC arrived at the intermediate address bc1q203yu…aljpy, and from there, 1.24996414 BTC went to the Avalanche Bitcoin Bridge (bc1q2f0tc…9u90)—a service that transfers bitcoins to the Avalanche network.
Aggregation and Exchange. After the bridge, BTC.b was issued in the Avalanche network, and funds were collected in eight main trading wallets: 0xfb3e8bf8…ba7b, 0x75528496…36a4, 0x30ac143a…bb78, 0xec4800ee…491f, 0x0f24046f…a7ba, 0x15a731e4…43da, 0x1ac121a4…1451, 0x693b5ee3…a448.
BTC.b was then exchanged for USDT via LFJ. From the eight wallets, the funds were sent to four recipient addresses (0x718b982b…1790, 0xebbb2960…96e8, 0x57422970…490f, 0xd85536b4…d605), which then forwarded the total to the HTX exchange wallet 0xa77ff0e1…687d. The total transfer to HTX amounted to $74,193,409.21 in USDT. This infrastructure was reportedly also used to withdraw a significant portion of funds to the Lombard Finance service.
Part of the Scheme. Visualization created using the Graph tool from BitOK.Link to Hydra. This finding is particularly intriguing. BitOK analysts meticulously tracked the flow of funds on the blockchain and uncovered a connection.
The starting point was the bitcoin address 3DqTZnes…vHVt. This address itself is linked not to Kraken but to Hydra: it previously received two substantial cash flows from the now-closed platform, which is why it drew the analysts' attention as a "Hydra money wallet." The connection surfaced later when some of these funds moved onward and entered the same withdrawal system utilized by Kraken. However, to fully grasp this, we first need to explore the funds at this address.
At this address converged two distinct chains associated with the closed Hydra platform, totaling 190.31347104 BTC:
- Chain of 140.51915109 BTC (from transaction 65cea574f93948ee9d0068ee007f4649743aba83b03e1cc8f8e7d8aabc0771fc:1). Analysts traced this back through at least 15 transactions, following a dozen addresses to confirm that the funds originated from Hydra's infrastructure. The last address before convergence was 32U4qPfz…fiKdw. These funds were utilized on February 11, 2023, with 139.13137164 BTC sent to 3P956DQo…42ZLa, while 1.38774645 BTC split off to bc1qzdcf7…p29x.
- Chain of 49.79431995 BTC (from transaction 8f53171e12c3a79fff46f8a49d10c8f07495f6448771c2b1f89807784feb265c:1). These funds remained dormant for nearly three years, and on January 28, 2026, they began to be transferred. The amount was split into two parts: 43.84497954 BTC went to 3AY6ULj4…STbf and remains untouched, while 5.94930741 BTC (bc1qqdz02…c0u7) started to be divided into smaller transfers.
The most crucial part follows. One of the split transactions was traced through a chain of wallets that mix funds, leading back to the same Avalanche Bitcoin Bridge used by Kraken: bc1qqdz02…c0u7 → bc1qckm39…3m7p → bc1qayrpp…sspa → bc1q3h4a3…krun → bc1p2y3pw…78af3 → the Avalanche Bitcoin Bridge (bc1q5cx6l…n9j9).
At the bridge's output in the Avalanche network, 1.199983 BTC.b was issued (transaction 0x9b097326f3ff3d52ac74316c5d4ac287ae6221a249240ec5636a34bfcf163c98) to address 0x66ad917d…8674.
What This Means in Simple Terms. Funds leftover from the old Hydra platform followed the same laundering path as those from the active Kraken: the same fragmentation of bitcoin wallets, the same Avalanche Bitcoin Bridge, the same conversion to BTC.b, the same exchange for USDT, and the same withdrawal to HTX. Both platforms utilize the same money withdrawal system.
Why This Indicates a Common Financial Network. It’s not just one detail that matches, but the entire processing route from start to finish. When the whole chain aligns rather than isolated addresses, it becomes challenging to dismiss this as coincidence. Likely, the finances of both platforms were managed by the same team, or both engaged the same operator for fund withdrawal and laundering. Blockchain data allows for tracking the shared laundering system, but it does not, by itself, confirm that the platforms belong to the same owner.
Scheme 3: Embedded Exchanges and USDT Payouts in TRON
The third route involves Kraken's internal exchanges. For a fee, they accepted bitcoins from sellers generated within the platform and issued a more convenient and liquid stablecoin, USDT, in the TRON network. Sellers did not need to seek out a bridge and navigate through multiple networks; they simply sent BTC and received USDT. The coins were then processed through a dense network of wallets, where they were mixed with other funds and diluted. The total identified volume for this branch was $39.75 million.
Bitcoin Collection. Small inflows were aggregated at intermediate addresses, culminating in a large cluster. In this investigation, it is illustrated through the "anchor" address 131Jpd7HWUEY7JKfVf6VarGK6twJm6mr8f—but this is merely a marker: the anchor address made only two transactions and received 0.03327756 BTC.
Confirmed Sample. Within this branch, 104 payments from 20 bitcoin addresses totaling 60.93786109 BTC were definitively confirmed (from December 25, 2025, to July 31, 2026). The bulk came from four addresses:
BTC SourcePaymentsBTC AmountPeriod- bc1psas63…4nwny: 2.69898720 BTC (February 5 to July 5, 2026)
- bc1pv708a…chjpd26: 11.19856160 BTC (December 25, 2025, to June 27, 2026)
- bc1p4nlq2…2v0t62: 10.59869360 BTC (January 12 to June 8, 2026)
- bc1pc2awm…jhdx51: 17.58994592 BTC (April 27 to June 27, 2026)
These four addresses accounted for 85 of the 104 requests—approximately 69% of the confirmed sample volume.
How the Payout Address Was Determined. Each bitcoin transfer included an OP_RETURN marker with the recipient's address in TRON—for example, Nk6:to:USDT(TRON):TKy7zLaq…4CNQv. From the 104 transactions, nine TRON addresses were extracted, four of which were used consistently: TGVYCMm7…N7Ud (26 requests), TWHLCn95…7ceJG (26 requests), TRwxvc2w…A2Es6 (24 requests), and TPDfGP2w…771w (11 requests). On the TRON side, 79 incoming USDT payments matching by address and time were identified, totaling 3,272,204.79 USDT—78 of which were from address TPwezUWp…Et5s, flagged by TRONSCAN as a wallet of the Bridgers exchange.
Channel Speed. The exchanges occurred almost instantaneously. Here are two examples:
- On July 5, 2026, an address sent 0.9999 BTC to Bridgers (bitcoin transaction 50a4c0e277e3df0d782a93cb6526fe288b7878331ee850ea114990c65f331435), and within 171 seconds, 61,955.83 USDT arrived at the specified TRON address (transaction 93835bd289d456155eff57e97aad07c0a8f2e2a852122b5e4dbfca6f10ee7d09).
- On May 28, 2026, 1.2 BTC (transaction 64ae7ff21e4dd527e6e95c514a750af20f760c64d322ef7e93f96bae55786bf3) was sent, and within 157 seconds, the exchange paid out 87,158.88 USDT (transaction 9c938b725525e061485906c3792404557adadc64eb7ededca31da463bcb58abe). A fee is deducted from the payout.
Dissolution. After the USDT payout, the funds passed through a dense network of intermediate wallets, mixing with other inflows and being further fragmented—among the transfers were amounts of 708,400, 425,700, 400,000, 346,000, 337,300, and 301,800 USDT. One branch concluded with a deposit of 708,400 USDT into the WhiteBIT exchange infrastructure. This illustrates the scheme's purpose: after several levels of reorganization, the original bitcoin flow was dissolved among larger USDT turnovers.
Overall Picture
Kraken has established a comprehensive financial system. Bitcoins from drug sales are collected, held at intermediate addresses, then split into standard batches and channeled through three routes, each uniquely severing the link between incoming BTC and the final recipients.
Key figures from the investigation include:
IndicatorValue- Total identified volume across three schemes: $186,497,100.89 in USDT
- In mixed flow USDT/USDC: $72,553,691.68 (BNB Smart Chain)
- Reached exchange infrastructure: not less than $147,455,500.89 ($74.19 million HTX via Avalanche + $72.55 million BSC flow)
- Main phase (October 2025 – July 2026): approximately $146.75 million, or 99.5% of the volume
- Final exchanges: HTX, MEXC, KuCoin, Gate.io, WhiteBIT
The $186.5 million is not the entire turnover of Kraken, but the volume that was tracked to completion across three fully disclosed routes. Beyond this investigation remain private coins, undisclosed clusters, and unmarked internal transfers that on-chain analysis has yet to connect. Thus, this figure should be read as a lower boundary: real flows are likely larger; the only question is how much more.
Patterns indicating a possible close connection between Hydra's business operations and Kraken have also emerged. BitOK analysts concluded that it is highly likely that the money laundering for the successor to the legendary marketplace is being managed by a team that previously performed similar functions for its predecessor.