What’s Driving the 117% Rise in CSAM Marketplace Payments — and Where AI Fits

Key takeaways

• Payments to CSAM marketplaces rose about 117% in the most recent 12-month period (July 2025–June 2026) compared with the year before — the highest on record and more than ten times the 2021–22 level
• Two marketplaces account for roughly two-thirds of payments. The rise reflects a small number of commercial platforms scaling quickly and consolidating the market.
• Payments kept climbing through a run of major law-enforcement takedowns. Flows dip after individual closures and recover to new highs, because the demand behind them re-forms on new platforms.
• AI is not driving the increase. There are no AI-only marketplaces and no measurable shift of demand toward synthetic material; offender communities quarantine AI-generated content rather than adopt it.
• The newest marketplaces increasingly settle in privacy coins, so figures drawn from transparent blockchains are a floor on the real activity

{{horizontal-line}}

Commercial child sexual abuse material (CSAM) marketplaces are dedicated darknet platforms that take payment for imagery and video documenting the sexual abuse of children. After years of little growth, payments to these marketplaces rose about 117% in the 12 months ending June 2026 compared with the previous year. That put payments at their highest level on record, more than ten times the 2021–22 level.

This trend challenges the assumption that commercial CSAM marketplaces were in structural decline. Major law enforcement seizures were expected to disrupt the marketplace model, leaving smaller operations with less ability to generate revenue. Instead, a handful of marketplaces have grown rapidly, pushing payments to a new high in the 12 months ending June 2026.

In reality, a small number of commercial marketplaces drove a massive increase in activity, scaling quickly and pulling more volume from a loyal customer base toward them.

‍

What is driving the growth in CSAM marketplace payments

The recent growth is concentrated in a handful of marketplaces. Two accounted for roughly two-thirds of payments measured in July 2025–June 2026, and the four largest accounted for more than 90%. As these platforms grew, quarterly volume roughly tripled between the start of 2025 and the third quarter.

That scaling rests on a specific revenue model. A large number of small payments — often only a few dollars — from a broad and recurring base of buyers make up marketplace revenue. Because different buyers transact at different times, the total stays stable and grows as the base grows, without the platform needing to recruit new participants continuously.

This is what lets a small number of well-resourced marketplaces absorb demand and expand, while activity once spread across individually attributed vendors declines. Payments to those vendors peaked in 2023 and have fallen every year since, confirming this structural ecosystem change.

The marketplaces are the durable form the ecosystem settled into after an earlier disruption. For years, CSAM communities relied on free file-hosting services on the open web and on links that could be copied and shared. As detection and takedowns of those hosts increased, the links became unstable, and the community moved to resilient, Tor-hosted infrastructure it controlled.

Maintaining that infrastructure costs money, and commercial marketplaces emerged to fund it — charging nominal prices, often under USD 1 for a file, primarily to sustain hosting and attract new uploaders. By 2026, some marketplaces had passed 10,000 uploaders, a scale the older forum model could not support.

Why the market keeps growing through takedowns

This growth continued even through a run of major law-enforcement actions. Over the same period, authorities dismantled several of the largest platforms in this ecosystem — the Boystown forum (2021), a streaming platform and a Bitcoin- and Monero-funded marketplace (both 2025), and linked marketplace sites taken down by US, German, and Brazilian authorities in September 2025 — with further operations continuing into 2026. The Kidflix takedown is one recent example of the pattern.

‍

Total volume to these marketplaces dipped after individual closures and then recovered to new highs, because the demand behind them does not disappear when a single platform does.

Onchain data points to why enforcement has not slowed the money. The risk enforcement creates is unevenly distributed. Operating a marketplace carries visible consequences — authorities seize infrastructure and identify administrators — but paying for access carries little visible risk. Thousands of transactions continue without an observable consequence for the individuals making them, and in communities where operational assumptions circulate peer to peer, buyers read that absence as evidence that no one is monitoring crypto payments.

Where AI fits

AI has dramatically impacted the crime ecosystem over the past year, helping many types of crimes surge to unprecedented levels. Within the CSAM category, however, generative AI is not driving this growth. There are no AI-only marketplaces, and no evidence that synthetic material is displacing demand for imagery documenting real abuse. Where AI-generated content appears, offender communities file it into separate, clearly marked sections — tolerated at the margins and kept out of the main market — and the producers experimenting with it remain a small group.

The way the “AI” label is used complicates measurement. Some offenders tag real material as AI-generated in the belief that content marked that way draws less enforcement attention. The label therefore measures a belief about enforcement rather than actual AI use, which breaks metadata-based measurement in both directions.

Claims that AI is driving a new mass market for CSAM are not supported by what is observable or in these communities, and they invite a demand — show the marketplace, show the entity — that the evidence cannot currently meet. Unlike fraud or malware, where AI lowers the cost of scalable, low-consequence crime, the severe consequences attached to CSAM concentrate the AI threat elsewhere.

AI belongs in this conversation as a capability worth watching. It is not what drove the growth documented here.

What this means for investigators and compliance teams

The commercial market now concentrates demand in a small number of high-value, Tor-hosted marketplaces, and most of the payments move through a handful of operators. Disrupting infrastructure removes a platform without removing the demand behind it. Financial tracing and cross-chain attribution reach the activity that takedowns leave intact, and they point to the operators who receive most of the money — the same approach that has supported law-enforcement disruption of CSAM networks.

The enforcement signal that would change buyer behavior does not yet exist. Action against individual buyers reads as exceptional when thousands participate, even where a single payment has been enough to open a case — as in the Harrisonburg preschool case. A visible deterrent would require enforcement at scale against the payment side, so that paying for access carries the same observable risk as running a platform.

The newest marketplaces increasingly settle in privacy coins, which moves activity off transparent blockchains and makes onchain totals a floor on the real volume. As the market consolidates further, tracing the flows into the dominant marketplaces and the operators behind them remains the highest-leverage work. For the wider picture of how illicit flows are shifting, see the 2026 Crypto Crime Report.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. Is AI generating a new mass market for CSAM?

On current evidence, no. There are no AI-only marketplaces and no sign that synthetic material is displacing demand for imagery of real abuse. The growth in commercial CSAM payments comes from a small number of Tor-hosted marketplaces scaling, not from AI.

2. If law enforcement keeps taking marketplaces down, why is the market growing?

Takedowns remove infrastructure, but the demand behind the payments persists and re-forms on new platforms. Measured payments dip after major closures and then recover to new highs.

3. Does a rise in onchain payments mean there is more CSAM overall?

Not necessarily. The figures measure commercial payments to attributed marketplaces on transparent blockchains. Part of the increase reflects activity consolidating into these paid platforms. Because the newest marketplaces increasingly use privacy coins, the transparent-chain figures are a floor on total activity.

4. What should investigators and compliance teams take from this?

Commercial CSAM is consolidating into a small number of high-value, Tor-hosted marketplaces that increasingly use privacy coins. Disrupting infrastructure alone has not reduced the money reaching this market; financial tracing, attribution across chains, and attention to the small set of high-volume operators remain the highest-leverage points.

About these figures

Figures in this analysis are reported as growth rates and as an index relative to a base period rather than as absolute totals, and represent a dynamic baseline expected to be revised as attribution expands.