A study of 150 of the most prominent Dark Web message boards, marketplaces, and illicit services reveals that Litecoin is currently the second most widespread cryptocurrency among cyber-criminals, and not Monero or Ethereum, as most users would have guessed.

The research, which involved Recorded Future employees visiting each of the 150 websites in turn and studying the supported payment channels, confirmed that Bitcoin is seeing a pushback from the cyber-criminal underground, seeking more stable methods of payment.

Cyber-criminals are looking for alternative payment systems

The reason is the same as why many regular Bitcoin users are abandoning the currency —the high transaction fees that take too much time to complete.

Most legitimate users are transitioning from viewing Bitcoin as an alternative digital payment system to a commodity, and the same can be said for cyber-criminals.

According to Recorded Future, most Dark Web illicit services have implemented alternative payment systems besides Bitcoin, as a way to counter recent price fluctuations, high transaction fees, and the ever-increasing transaction time.

Researchers found Litecoin payment systems implemented on 30% of the sites they investigated, while Dash came second with a 20% share. Bitcoin Cash, Ethereum, and Monero came next, with 13%, 9%, and 6% respectively.

Numbers also varied between sites. For example, Monero was the favorite on English-speaking sites, while Russian-speaking portals preferred Litecoin. Overall, English-speaking portals preferred cryptocurrencies that put a focus on anonymity, while Russian-speaking sites didn't seem to care.

A reason for this may be the viewpoint that Russian cyber-criminals are left alone by Russian authorities, as long as they don't target fellow Russians, a reason why Russian-speaking criminal forums didn't bother supporting privacy-hardened cryptocurrencies, as they don't fear they'll be targeted by local law enforcement.

Monero fanbase growing

But the chart and numbers from above show only what site administrators are already supporting, and may not necessarily reflect what cyber-criminals want.

Fortunately, researchers stumbled on a poll with hundreds of votes on one of the most popular Dark Web criminal forums. The poll showed that forum users would have preferred the site to support Monero and Dash as payment systems in the future, showing Monero's rising popularity.

For people following the malware scene, it's no surprise that Monero is gaining a bigger and bigger fanbase. This is because Monero is still pretty easy to mine and has spawned two of today's most widespread malware trends —the deployment of Monero-mining malware on servers and desktop computers; and the deployment of cryptojacking scripts (in-browser cryptocurrency miners) on hacked websites.

Currently, Bitcoin is still the dominant payment method for illegal goods on the cyber-criminal underground, but as the cryptocurrency's use as a payment system continues to decline, new and more efficient payment channels will take its place. For now, the race is between Litecoin and Dash, with Monero coming fast from behind.

This article is based on a seven-page report from Recorded Future. For more details, the report can be downloaded in PDF format from here.