Bolster AI Reveals Fabricated Scale Behind Dark Web Counterfeit Market

Bolster AI on September 3, 2026 published research reporting that a Tor-hosted marketplace selling counterfeit currency manufactured the appearance of scale, security and legitimacy to attract buyers, finding that the site’s payment system had generated fewer than 2,400 orders while its three major vendors displayed a combined 57,803.

According to the company’s announcement, the Santa Clara, California-based company’s Threat Intelligence Lab spent nine days monitoring the marketplace, which it calls ShadowMarket. The three vendors claimed orders across five currencies: U.S. dollars, British pounds, euros, Canadian dollars and Australian dollars. The company characterized the operation as counterfeiting trust itself rather than only currency.

Order Counts and Payment Records Diverged

Across 123 captures of the site, researchers observed 27 changes to vendor order counts, and every change occurred between 00:00 and 06:00 UTC rather than throughout the day as purchases occurred, the company reported. The marketplace’s advertised order counts changed only during that same six-hour overnight window, while payments were routed through roughly 600 reused Bitcoin addresses. The supposedly independent vendors also shared payment infrastructure, according to the researchers.

Bolster AI also reported discovering an exposed, sequentially numbered payment endpoint that revealed the marketplace’s order-to-Bitcoin-address mapping. The company said it reported the exposure through the appropriate channel rather than exploiting it, and that it did not transact with the marketplace during the investigation.

Security Features Advertised but Absent From the Code

The researchers described the marketplace’s security claims as unsupported by its implementation. The site’s advertised “Multisig Escrow System” contained no buyer key generation, PGP or multisig functionality in the code the researchers examined, the company said. Buyer-seller communications were transmitted to the marketplace server without end-to-end encryption despite being marketed as secure messaging. Bitcoin addresses and payment amounts were also sent to a third-party service on the public internet to generate QR codes, extending payment data beyond the dark web.

Dinesh Arora of Bolster AI’s Threat Intelligence Lab said the authenticity of the notes on sale cannot be established from outside the platform. “The counterfeit notes on sale may be paper, polymer, or nothing at all, and from outside the platform that can’t be proven either way. What we can prove is that the trust the marketplace sells is manufactured. The order counts, the escrow, the buyer protection badges — all of it is engineered to make a first purchase feel safe. The credibility is the product, and the credibility is counterfeit,” he said.

Rod Schultz, CEO of Bolster AI, said fraud infrastructure has become very good at looking legitimate. “Attackers understand that trust is what converts a visitor into a victim, so they manufacture it,” he said, adding that the company sees the same playbook across impersonation sites, scam storefronts and other attacks targeting legitimate brands and their customers.

Bank of England Counterfeit Figures

The announcement noted that the investigation comes as counterfeit banknote detections rise in some major markets. According to the Bank of England’s banknote statistics, approximately 200,000 counterfeit notes were taken out of circulation in 2025 with a notional face value of £3.97 million; in 2024, the figures were 99,000 notes with a notional face value of £2.095 million. The announcement described the 2025 total as more than double the previous year. The Bank of England’s 2025 figures included 178,000 counterfeit £20 notes, 15,000 £10 notes, 5,000 £50 notes and 2,000 £5 notes, while a further 18,000 notes were recorded as removed before entering circulation through bulk seizures. The central bank’s figures are rounded to the nearest 1,000 and include counterfeits of both current and old series notes.

The Bank of England states that counterfeiting has substantially reduced since 2019, citing the introduction of more robust polymer banknotes, the withdrawal of older paper designs, police action against sources and distribution, and the general move to electronic payments. Counterfeit notes are removed from circulation by banks and the police and sent to the central bank for analysis. With more than 4.98 billion Bank of England notes in circulation, worth about £91.5 billion, counterfeit notes typically represented less than 0.0041% of banknotes in 2025, or fewer than 1 in 24,390, the bank reported.

Evidence Shared With Authorities

Bolster AI said it shared its findings with relevant law enforcement and financial authorities ahead of publication. The company said it has preserved the complete evidence set, including timestamped captures, recovered code and observed Bitcoin addresses, and will make it available to verified law enforcement upon request.

The company also announced a live briefing scheduled for September 10, 2026, which it said will take attendees inside the investigation, unpack the findings and discuss what they reveal about how online scams manufacture trust.