Bolster AI Exposes Dark Web Counterfeit Currency Operation

Researchers uncover fabricated order volumes, fake escrow, insecure communications and shared payment infrastructure behind supposedly independent vendors

SANTA CLARA, Calif., Sept. 3, 2026 /PRNewswire/ -- Bolster AI today released new research exposing how a dark web marketplace advertising counterfeit currency manufactured the appearance of scale, security and legitimacy to attract buyers.

Bolster AI's Threat Intelligence Lab spent nine days monitoring ShadowMarket, a Tor-hosted marketplace where three major vendors claimed a combined 57,803 counterfeit currency orders across U.S. dollars, British pounds, euros, Canadian dollars and Australian dollars.

But the marketplace's own infrastructure told a very different story. Researchers found fewer than 2,400 orders generated by its payment system. The marketplace's advertised "Multisig Escrow System" contained no multisig functionality. Its supposedly independent vendors shared payment infrastructure. And its "live" order counts changed only during the same six-hour overnight window.

The counterfeiters weren't just selling counterfeit currency. They were counterfeiting trust.

Among the findings:

• Order volumes appeared manufactured. Across 123 captures, researchers observed 27 changes to vendor order counts. Every change occurred between 00:00 and 06:00 UTC, rather than throughout the day as purchases occurred.
• The advertised escrow wasn't supported by the code. Researchers found no buyer key generation, PGP or multisig functionality behind the marketplace's claimed "Multisig Escrow System."
• Payment infrastructure contradicted the storefront claims. The marketplace's payment system had generated fewer than 2,400 orders, compared with the 57,803 displayed by its vendors, with payments routed through roughly 600 reused Bitcoin addresses.
• "Secure" messaging wasn't secure. Buyer-seller communications were transmitted to the marketplace server without end-to-end encryption.
• Payment data extended beyond the dark web. Bitcoin addresses and payment amounts were sent to a third-party service on the public internet to generate QR codes.

"The counterfeit notes on sale may be paper, polymer, or nothing at all, and from outside the platform that can't be proven either way," said Dinesh Arora of Bolster AI's Threat Intelligence Lab. "What we can prove is that the trust the marketplace sells is manufactured. The order counts, the escrow, the buyer protection badges — all of it is engineered to make a first purchase feel safe. The credibility is the product, and the credibility is counterfeit."

The investigation comes as counterfeit banknote detections rise in some major markets. The Bank of England reported approximately 200,000 counterfeit notes taken out of circulation in 2025 — more than double the previous year — with a face value of £3.97 million.

"Fraud infrastructure has become very good at looking legitimate," said Rod Schultz, CEO of Bolster AI. "Attackers understand that trust is what converts a visitor into a victim, so they manufacture it. We see the same playbook across impersonation sites, scam storefronts and other attacks targeting legitimate brands and their customers."

Bolster AI also discovered an exposed, sequentially numbered payment endpoint that revealed the marketplace's order-to-Bitcoin-address mapping. The company reported the exposure through the appropriate channel rather than exploiting it and did not transact with the marketplace during the investigation.

Ahead of publication, Bolster AI shared its findings with relevant law enforcement and financial authorities. The company has preserved the complete evidence set, including timestamped captures, recovered code and observed Bitcoin addresses, and will make it available to verified law enforcement upon request.

Read the full investigation: https://bolster.ai/blog/inside-a-dark-web-counterfeit-currency-operation 

Bolster AI will also host a live briefing on September 10 to take attendees inside the investigation, unpack the findings, and discuss what they reveal about how online scams manufacture trust.

Register for the briefing: HERE 

About Bolster AI

Bolster AI helps organizations discover, remove and understand the external threats targeting their customers. By connecting activity across websites, domains, social media, paid ads, marketplaces, apps and other external channels, Bolster AI gives security teams the context to understand broader campaigns and disrupt more of the attack.

Learn more at bolster.ai.

View original content to download multimedia:https://www.prnewswire.com/news-releases/bolster-ai-exposes-dark-web-counterfeit-currency-operation-302868407.html

SOURCE Bolster AI