# OnionLinks, the Onion Directory, full text > Verified 2026-07-29. Site: http://onionlinks.shop Language: English Use: reference --- # Anubis Market Also known as: Anubis. Established 2024. Languages: English. Coins: BTC, LTC, ETH, XMR. The multi-coin entry. Four currencies including the only usable Ethereum door. Verified onion mirrors: - http://anubisgbozgus4ixulnqwqnofh7fekylnzew5alb3iklijcke2cvviid.onion - http://anubisgpdzwmwlo42mr7g3n75lfusb7uolh7y63ysubvdp6hrezduuad.onion - http://anubisqe2yramasw5yvlnipaknraza5rzb5uxb7zqhxuxroobvvm6aid.onion ## Summary Filed under the widest payment support in this directory. Anubis is an English-language market that opened in 2024 and accepts Bitcoin, Litecoin, Ethereum and Monero. The last of those is the entry's whole reason for being looked up. If Ethereum is the coin in your wallet, this is close to the only market that will take it. Everything else about the market is conventional and competent. Escrow, vendor bonds, moderated disputes, profiles that state a deal count and dispute ratio. The index cross-references the payments topic for the reasoning on which coin to actually use, and the security topic for the login trap described below. ## Payment Four coins, cross-referenced by purpose. Monero is the privacy default and the coin to reach for when the reason you are on Tor is that you do not want the transaction legible afterward. Bitcoin covers the vendors who have not moved on. Litecoin handles small orders where Bitcoin fees are out of proportion. Ethereum covers the single case where that is what you hold and converting first is friction you would rather avoid. Note the distinction the entry insists on: Ethereum buys convenience, not privacy. Its ledger is as public as Bitcoin's. If the lookup that brought you here was about keeping a payment private, the cross-reference points back to Monero every time. Deposit addresses generate fresh per order across all four coins. ## Security The login gate is six tiles, each a tilted character, placed next to a decoy input. Automated fillers hit the honeypot field and trip. A person reads the tiles and clears it in about ten seconds. Field names rotate on every page load, so a cached script cannot replay the form. See also the security topic for the general phishing pattern, which applies here as everywhere: copy an address from the market's signed mirror list, verify it against the market key before use, and never enter a password on an address the signed list does not contain. ## Access and mirrors Several onions run at once. When one is flooded the others answer, and a fresh address rotates into the pool within a few hours. The instruction that follows is standard directory practice: do not treat any single address as permanent. Keep the signed mirror list, not a lone bookmark, and consult it when something stops resolving. The rotating pool is a resilience feature. It only helps if every address you move to is one the market actually published, so the verification step is not optional even when you are only switching mirrors. ## Standing Standing: active, well regarded for payment flexibility. The entry's distinguishing value is the coin spread, and specifically the Ethereum support that has no real competitor in this directory. On escrow, moderation and phishing defence it matches the stronger entries rather than leading them. Look this entry up when the coin you hold is the constraint. Cross-reference Nexus if you want the all-round reference market instead. --- # Awazon Also known as: Awazon Market. Established 2024. Languages: English. Coins: BTC, XMR. The first-timer entry. Reads like an ordinary online shop. Verified onion mirrors: - http://awazoneqkwtrk5ylid5aammako4zc4qz2lvo4n47t62isvnet63usaid.onion - http://awazonloedcyl2otgftfg7qm6e2klbgg2dhouyli3hdno6gdkueh6byd.onion - http://awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion ## Summary Filed as the gentlest entry point in the directory. Awazon is an English-language market from 2024 built to read like a normal online shop. Product cards, a category sidebar, vendor profile pages, an order history, a working search box. Anyone who has bought something on the clear web already knows how to use it, and on this terrain that familiarity is the entire recommendation. The index points a first-time reader here so that attention goes to the parts that carry real risk, verifying the address and choosing a coin, rather than to figuring out where the buttons are. Cross-reference the desk articles on a first lookup and a first order. ## Payment Bitcoin and Monero. Reach for Monero if privacy is any part of the reason you are here, because it keeps the transaction off a readable public ledger. Use Bitcoin when a vendor accepts only Bitcoin. The deposit address is fresh per order, so there is no address bookkeeping to think about. The directory's standing advice for a first purchase: keep it small and cheap and treat it as a way to learn the flow. The right size for a learning order is an amount you could lose without it mattering. See also the desk article on a first order. ## Security The captcha is six characters of text, case sensitive, sitting beside a couple of decoy input fields. Bots fill a honeypot and the real login is never reached. Field names rotate every page load. Mirror updates are posted with a PGP signature, which is one of the checks that qualifies a market for this directory at all. The familiar interface is not a reason to relax the address discipline. The one rule that never bends applies here exactly as it does on the most spartan entry: verify the door before you knock. Cross-reference the security topic for the full phishing pattern. ## Access and mirrors Mirror updates are signed, and the address you use should come from that signed list. For a first-time reader the trap to avoid is assuming the ordinary-looking shop makes the safety steps optional. The verification is identical to every other entry in the directory. See also the access topic for the general note on why markets run multiple mirrors and how to rotate across them when one stalls. ## Standing Standing: active, and the directory's standing recommendation for a first crossing. Coin support is narrow but covers the case that matters, and the escrow and mirror discipline match the rest of the shortlist. The value here is legibility, and legibility is a survival trait on this terrain, not a luxury. Learn the shape of the directory on this entry, where the map is easiest to read, and the harder entries make sense afterward. --- # BlackOps Market Also known as: BlackOps. Established 2024. Languages: English. Coins: XMR. The Monero-only entry. One coin on purpose, and that is the whole point. Verified onion mirrors: - http://blackops5l63qnwnmlnsfvtlu66md3x3vp3fdtpna42eq7ozujr67hid.onion - http://blackops6kignp3eddmvqcfkjzf6qr6haxbmkypc2xtqlnhuu4ak4dqd.onion - http://blackops27m32abqvbhnyswgazqawxqbznbzkkkv5sjo7gve2ndpsdad.onion ## Summary Filed under the narrowest payment support in this directory, and on purpose. BlackOps is an English-language market that opened in 2024 and settles in Monero alone. There is no Bitcoin line and no swap running behind the scenes to imitate one. You fund with Monero and you spend Monero, and the whole design follows from that single decision. The reasoning is the reasoning that puts anyone on Tor in the first place. A public chain remembers every payment. Monero does not carry that history for the wallet to leak. Everything else about the market is conventional and competent: escrow, vendor bonds, moderated disputes, profiles that state a deal count and dispute ratio before you commit. ## Payment One coin, Monero, and the privacy is not a setting you switch to, it is the only setting. Amounts, sender and receiver are hidden at the protocol layer, which is the property that matters when the reason you are here is that a legible payment is the thing you want to avoid. What the entry gives up is the Bitcoin door for the vendor who only takes Bitcoin, a cost the market chose to pay. For a buyer who was going to reach for Monero anyway, the missing coins were never going to be used. Deposit addresses generate fresh per order, and the required confirmations for Monero land in around twenty minutes. ## Security The login draws the real onion fingerprint into the anti-phishing image and reprints it in the page header. Hold both against your address bar before the password field. A clone can copy the layout but it cannot put the correct fingerprint in an image without the key, and it cannot serve the real address from a fake one. See also the security topic for the general phishing pattern, which applies here as everywhere: copy an address from the market's signed mirror list, verify it against the market key, and never enter a password on an address the signed list does not contain. ## Access and mirrors Several onions run at once. When one is flooded the others answer, and a fresh address rotates into the pool. The instruction that follows is standard directory practice: do not treat any single address as permanent. Keep the signed mirror list, not a lone bookmark, and consult it when something stops resolving. A withdrawal PIN sits separate from the login, so a stolen session cannot drain the balance on its own. The rotating pool is a resilience feature. It only helps if every address you move to is one the market actually published, so the verification step is not optional even when you are only switching mirrors. ## Standing Standing: active, filed for buyers who already decided the answer was Monero. The distinguishing value is the single-coin rule, which removes a decision rather than a capability. On escrow, moderation and phishing defence it matches the stronger entries here rather than leading them. Look this entry up when privacy is the whole point and the other coins were never going to leave your wallet. Cross-reference Nexus if you want the all-round reference market instead. --- # Crown Market Also known as: Crown. Established 2024. Languages: English. Coins: BTC, XMR. The design entry. PGP on by default, Monero by default, fewer vendors. Verified onion mirrors: - http://crowncahzxbrm4rgqqkx7yhmwkie7ompgqocrjayoqos2fsofddeigad.onion - http://crownknshitgyyx3hfzn23cw6j5psngn6ennetusrzozsmnmhp66sxad.onion - http://crownm5jmtbhqnoxhexx7nyiygqgqofp3wnjyyfl74gziohqqy6oq5id.onion ## Summary Filed under interface quality and safe defaults. Crown is a 2024 English-language market that treats its interface as something a person is responsible for. Clean typography, vendor profiles you can read in seconds, an order flow that gets out of the way. It is newer than most entries, and the vendor count shows it. The trade the entry asks you to accept is catalogue depth for a market that is genuinely pleasant to use correctly. Two defaults distinguish it and both reduce common mistakes. PGP on vendor messages is on by default, and Monero is the default coin. Cross-reference the privacy and security topics for why both defaults matter. ## Payment Bitcoin and Monero, with Monero set as the default. That default is the correct one, and Crown choosing it for you closes the most common privacy slip, which is paying in Bitcoin out of habit when Monero was available. Bitcoin remains for the vendors who require it. Deposit addresses generate fresh each time. The entry's note: a market that quietly steers you toward the safer coin without a settings menu is doing useful work on your behalf. See also the privacy topic. ## Security The detail easy to miss is PGP-by-default on vendor messages. You do not have to remember to switch it on, which removes a class of error where a buyer pastes an address into a message they believed was encrypted and it was not. Mirror rotation is announced with a PGP signature, the same standard the directory holds throughout. Moderators answer quickly on the forum, which tells you most of what you need to know about how a dispute will go before you ever open one. Cross-reference the security topic for the phishing pattern. ## Access and mirrors Addresses come from the signed rotation. Confirm a new address against the signed list before use. The clean interface does not exempt a reader from the address check, it only makes the market pleasant once you are safely inside. See also the access topic. ## Standing Standing: active, strong on everything except catalogue depth. The interface is the best-drawn in the directory, PGP-by-default removes a real footgun, and Monero-by-default steers you to the safer coin. The cost is a shorter vendor list because the market is young. Look this entry up when you want the experience to be clean and can accept fewer vendors. Cross-reference Awazon for the other beginner-friendly entry. --- # Mars Market Also known as: Mars. Established 2023. Languages: English. Coins: BTC, LTC, XMR. The uptime entry. More live onions at once than any other listing. Verified onion mirrors: - http://mars24pas2vgwtr4drrsy7tlngevbvxyguejynnkeywibjzenet7knqd.onion - http://marsautbk3di5cj75eh4dakjjrngddnjwqfdltbq2sy6cf7unzkd2bad.onion - http://marsautkudspgk6j23cxdtrk36ae4fpis2eoe7izu5y2rsksvmfji2ad.onion ## Summary Filed under uptime. Mars, an English-language market from 2023, publishes more live onions at any moment than any other entry in the directory. When the active mirror is flooded, you paste another from the signed list and continue, rather than staring at a market that has gone dark for two days. For anyone who has lost an order to downtime, that is the whole lookup. Under the mirror strategy it is a conventional, well-run market: escrow, bonds, moderated disputes, readable profiles. Cross-reference Osiris and TorZon, the directory's other resilience-oriented entries. ## Payment Three coins: Bitcoin, Litecoin and Monero. Monero for privacy, Litecoin for small orders where Bitcoin fees would be silly against the purchase, Bitcoin for the vendors who still want it. The three-coin spread matches the reference entry and is part of why Mars reads as a complete market rather than a single-trick uptime play. Deposit addresses are per order. See also the payments topic for the reasoning behind each coin. ## Security Text captcha, six characters, with decoy input fields whose names rotate every page load. Bots fill the wrong field, trip a honeypot, and never reach the login. The page header prints the onion you should be on, so you can cross-check the address bar against the market's own statement of its address. See also the security topic. The header-print plus the captcha check are two independent verifications, and running both is the directory's standing advice. ## Access and mirrors The mirror list is the entry's defining feature. It is deep and signed, and the point of Mars is that you rotate across it freely. When an address stalls, do not wait, open the signed list and move to the next live onion. Keep the list, not a single bookmark. Verify each address you rotate to against the market key. ## Standing Standing: active, the entry to look up when downtime is the failure you most want to avoid. Deep signed mirror pool, three coins, honest escrow, fast moderators. There is no meaningful sacrifice here, only an added margin of reachability. Cross-reference Osiris, which answers the same question with a slightly stronger tilt toward moderator response. --- # Nexus Market Also known as: Nexus. Established 2023. Languages: English. Coins: BTC, LTC, XMR. The reference entry. The listing every other entry is measured against. Verified onion mirrors: - http://nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion - http://nexusma2iekjhhyenua3u4zlyfsj2ubwxr2nt6gdte5rvwukzze63fyd.onion - http://nexusabcdrstn74osnr67fsbzbo44kjpxqbbz5ymcwhlxjg6dloyhoyd.onion ## Summary Filed as the reference entry, the listing the rest of the directory is measured against. Nexus is an English-language market that opened in 2023 and spent its first year on the unglamorous fundamentals: fast onboarding, a login that does not fight you, signed mirrors, and payment support covering what buyers reach for. The value is the absence of friction rather than any single headline feature. Three coins, layered phishing defences, honest escrow, a deep catalogue filled over time. Cross-reference the first-lookup desk article to learn the directory on this entry. ## Payment Bitcoin, Litecoin and Monero. Monero is the privacy default, the coin for when the reason you are on Tor is keeping the transaction unreadable. Litecoin is the small-order coin, faster and cheaper than Bitcoin for modest purchases. Bitcoin is present for the vendors who still price in it. Deposit addresses are per order and fund the standard multisig escrow. See also the payments topic for the full trade-off between the three. ## Security The market is built around the fact that phishing, not exit scams, is how most people lose money here. The login captcha renders the real onion into the image, so you can hold what you typed against what the server printed. The onion reprints in the page header. The mirror list is signed with a key you can verify. No single defence is complete, and together they make a convincing clone expensive to run. See also the security topic, which generalises this pattern to every entry. ## Access and mirrors Copy an address from the signed list, verify it against the market key, and check it against the captcha before entering a password. Standard directory practice, and Nexus supports every step of it. See also the access topic for why markets rotate mirrors. ## Standing Standing: active, the directory's reference entry and the one to hand a careful first-timer without a page of caveats. Layered phishing defence, honest escrow, broad coin support, an interface that stays out of the way, a deep catalogue. Start here if you want one working address and one market to learn the whole directory against. Cross-reference Anubis for coin breadth and Mars for uptime. --- # Osiris Market Also known as: Osiris. Established 2024. Languages: English. Coins: BTC, XMR. The resilience entry. Deep mirror pool, fast moderators, built for flood season. Verified onion mirrors: - http://osiriseultmx3so5ef6ayasy4kdyekbywr7pyggpmjazeogxoyaodsyd.onion - http://osirisdtn7lmphfz722ay24timiezf4kp6plofxg23dgu5tu2ouy4mid.onion - http://osirislivpetlbabbl3zzqhupurfkxxbzbheu3bkrshkaiwg2hcxbyqd.onion ## Summary Filed under resilience, the entry the directory points at when DDoS season arrives. Osiris, English-language and from 2024, keeps several onions warm at once, so when one is hammered the others stay up and traffic rotates over. Where Mars leans on the sheer number of published addresses, Osiris pairs a deep pool with fast moderator response. Cross-reference Mars and TorZon, the directory's neighbouring resilience entries. All three answer the downtime question from slightly different angles. ## Payment Bitcoin and Monero. Monero for anything you want kept private, which is most of what brings people to Tor. Bitcoin for the vendors who have not switched. The two-coin spread is narrower than Mars but covers the cases that matter. Deposit addresses are fresh, funding the standard escrow. See also the payments topic. The interesting engineering on this entry is in staying online, not in the payment layer. ## Security Phishing basics done correctly: the onion embedded in the captcha image, the onion reprinted in the header, and moderators active on Dread who can confirm a mirror is legitimate when asked. Fast forum response is a trait the directory weights heavily, and Osiris scores well on it. The mirror list lives on Dread, signed with the market key. If an address is not on the signed list, do not enter your password. See also the security topic. ## Access and mirrors The deep pool gives you somewhere to rotate when an address is under pressure. Use it. Reachability only helps if you actually move to a live address instead of waiting on a dead one. Check the signed list before logging in if a mirror is behaving strangely. See also the access topic. ## Standing Standing: active, the resilience entry with a tilt toward moderator responsiveness. Deep mirror pool, fast mods, correct phishing basics, honest escrow. It sits beside Mars as the answer to the downtime problem. Look this entry up when your worst case is a market vanishing under a flood at the moment you needed it. Cross-reference Mars and TorZon. --- # TorZon Market Also known as: TorZon. Established 2022. Languages: English. Coins: BTC, XMR. The veteran entry. Oldest English listing, seven onions, a queue and a vault PIN. Verified onion mirrors: - http://torzon4v7bcakvo7qikdfknewj4dlr44hkyv4jyfrkl7ci3zqn76kiid.onion - http://evwigej45n3nywbn3aqdun4o6cgjyfgxf2ts7lm6no3uotxanpeuosad.onion - http://tv4pfwlnoezgtzwrr33fturalfcfvdil6sly33ecx2j7lrxxyrydwdad.onion - http://fr6bvsrcx7ajxou7kyme5otctzdmpllum6iqootcjnwmzepuuams2tad.onion - http://wqg5wuwzdv7vtugrb64jmtwp5gx4ho6ksqzcghvoly6zvvwmyusbx7yd.onion - http://5yymslrttw7xhrgdgv4hrqcccrrfiopeuj2naicccozj63yfqum3apqd.onion - http://3borx37hbxf4qw5oujbhqvnicyvcb7vizb2lcogzbunwgz7cbmd5vkyd.onion ## Summary Filed as the veteran entry. TorZon has been on Tor since 2022, one of the older English-language markets in the directory. Longevity on this terrain is itself a data point. A market that has survived several years of floods, exit-scam seasons and takedown pressure has demonstrated something a six-month-old listing cannot. The interface is plain, the market unglamorous, and after this many years standing that reads as a feature. Two things distinguish the entry, and both are cross-referenced below: the access queue and the withdrawal PIN. ## Payment Bitcoin and Monero, Monero as the default and the right choice if privacy is why you are on Tor. Bitcoin for the vendors who only take it. Deposit addresses are fresh per request and never reused. The entry's distinguishing payment detail is the vault. TorZon enforces a withdrawal PIN separate from the login password. A stolen session cookie alone cannot empty the balance. That is a genuine second lock most markets leave open. Cross-reference the security topic. ## Security Every visit hits a server-side anti-DDoS waiting room before anything else, a static access-queue page that holds you for a few seconds to a minute depending on load. It is flood control: bots that do not respect the queue cannot hammer the login captcha behind it. Mildly annoying the first time, normal by the third. The withdrawal PIN sits alongside escrow as a second account lock, separating the ability to log in from the ability to move money out. See also the security topic for the general account-hygiene note. ## Access and mirrors The mirror set is seven v3 onions running concurrently, the deepest pool in the directory. That is a lot of redundancy, the other half of the resilience story alongside the queue. Keep the signed list and rotate across it freely when an address is slow. The queue changes the rhythm of access but not the rules. Verify the address against the signed list, cross-check the header, and treat any address not on the list as hostile. See also the access topic. ## Standing Standing: active, the veteran of the directory. Oldest English entry, seven live onions, a flood-control queue at the door and a PIN on the vault. Plain interface, proven survival. Look this entry up when you want a market that has already outlasted the things that kill younger ones, and you do not mind a minute in a queue. Cross-reference Mars and Osiris for the other resilience entries. --- # WeTheNorth Also known as: WTN, We The North. Established 2021. Languages: English, French. Coins: BTC, XMR. The Canadian entry. Bilingual, domestic-shipping, the oldest listing here. Verified onion mirrors: - http://hn2paw7zadwkcra3qzv5e4q547i7e5lvxm62cfxqftuqdu7moiu2ceyd.onion - http://hn2paw7zfvndw3dovycegeqmvvnf4pl67b3g2p7pohjlzavloosh73id.onion - http://hn2paw7zrgujyhnt6mgxlt2q6uhgbke4itpqitxhyfbumq3wtnckbuyd.onion ## Summary Filed under Canada, and cross-filed under longevity. WeTheNorth, usually written WTN, is a bilingual Tor market aimed at Canadian buyers. The name is a Raptors slogan. The interface runs in genuine English and French, shipping defaults to Canada-only, and most vendors ship from within Canada. It opened in 2021, making it the oldest listing in this directory. You can reach it from anywhere, but the whole thing is built for one audience. For a Canadian reader it is the obvious first lookup. For everyone else it is the clearest example in the directory of a market that chose a niche and served it completely. ## Payment Bitcoin and Monero, Monero the one to default to. Bitcoin for the vendors who have not switched. Deposit addresses are fresh every time. Confirmations run about one to two blocks on Bitcoin and around ten on Monero, worth knowing so the wait is not a surprise. Because shipping defaults to domestic Canada, the flow for a Canadian buyer is unusually clean: fewer cross-border variables, shorter transit, a vendor base that understands the domestic post. See also the payments topic. ## Security Under the hood it works like any Tor market: escrow, PGP, moderators, signed-evidence disputes. The distinguishing defence is phishing. The login captcha shows the real onion embedded in the image, and the header reprints it on every load. A clone that copies the WTN theme struggles to fake both at once. Because the interface is bilingual, the verification cues appear in both languages. See also the security topic. The two-place address print is the same pattern the strongest entries use. ## Access and mirrors Addresses come from the signed list, verified against the market key. The bilingual interface means a French-speaking reader gets the same verification cues without switching to English to read a warning. See also the access topic. ## Standing Standing: active, the directory's entry for Canada and a lesson in focus. Bilingual in real French and English, domestic shipping by default, a vendor base matured over years, phishing defences matching the strongest entries. The bilingual commitment reaches the dispute screens and policy pages, which is where precise language matters most. Look this entry up first if you are Canadian. Cross-reference the privacy topic for the coin reasoning. --- # Subject index ## Payments *Which coin to use, and why the answer is usually Monero.* The subject of payment sorts by one question: what are you optimising for. The coins in this directory are Monero, Bitcoin, Litecoin and, on one entry, Ethereum, and each answers a different version of that question. ## Monero, the privacy default Monero hides the sender, the receiver and the amount by design. If the reason you are on Tor at all is that you do not want a payment legible afterward, Monero is the answer, and it is the coin to default to unless something forces otherwise. Most entries in the directory now set it as their own default. ## Bitcoin, the legacy coin Bitcoin is the most widely held and leaves the clearest public trail. Its ledger is fully readable. Use it when a vendor takes only Bitcoin. If you do, do not send straight from an identity-checked exchange to a market, because that ties your name to the deposit. Route through a fresh wallet or a swap first. Cross-reference the desk article on choosing a coin. ## Litecoin, the small-order coin Litecoin behaves like Bitcoin but settles faster and cheaper. It is the coin for small orders where Bitcoin's network fee would be out of proportion to the purchase. Two entries accept it: Nexus and Mars. ## Ethereum, the narrow case One entry, Anubis, accepts Ethereum. Its chain is as public as Bitcoin's, so paying in it buys convenience when that is the coin you hold, not privacy. If privacy is the goal, the cross-reference circles back to Monero. --- ## Security *Phishing is the real threat. The defence is three quick checks.* The subject of security on a Tor market reduces, for a buyer, to one threat above all others. Not the market vanishing. A lookalike address that copies the market and harvests the password you type into it. Phishing is how most people are actually robbed here, and the defence is a habit rather than a tool. ## How the attack works An attacker stands up an onion that differs from a real one by a couple of characters in the middle of the string, where the eye does not catch a substitution. They copy the login page exactly. You type your password and it is theirs. Some clones go further and ask for a recovery phrase at login, which no real market does. ## The three checks First, copy addresses from a signed list and never type one from memory. Second, when the login captcha prints the market's own address into the image, hold it against your address bar and confirm they match. Third, cross-check the address the header prints. A clone can copy a theme easily. Faking the correct address in two independent places while sending you somewhere wrong is much harder. ## The habit None of these takes more than a few seconds, and any one catches the ordinary attempt. Run them every session, not just the first, because a months-old bookmark can point at an address that has since rotated out and been picked up by someone hostile. Cross-reference the desk article on verifying a mirror. --- ## Access *Why markets run many mirrors, and how to move between them.* The subject of access is about reaching a market and staying reached. A single onion address is a single point of failure, so serious markets publish several that all resolve to the same place. ## Why more than one address An address can be unreachable for reasons that have nothing to do with the market: a flooded introduction point, a bad Tor guard, an address under takedown pressure. Running several addresses at once means a problem with one does not take the market down. Every mirror leads to the same account, balance and order history. ## Rotating across the list When an address stalls, the correct response is not to wait. Open the market's signed mirror list and move to the next live onion. Some entries in this directory, Mars, Osiris and TorZon, are filed specifically for the depth of their mirror pools. TorZon runs seven addresses at once, the deepest here. ## The queue One entry, TorZon, puts a server-side waiting room in front of the login. It holds every visitor for a short spell so bots cannot hammer the captcha behind it. It is flood control, mildly annoying the first time and normal by the third. ## The rule that does not change Redundancy only helps if every address you rotate to is one the market actually published. Verify each against the signed list. Cross-reference the security topic. --- ## Escrow *Two of three multisig, and the one move that gives up its protection.* The subject of escrow is the mechanism that holds your money between paying and receiving. Across this directory it is a two of three multisig contract, and understanding it is the difference between trusting a market blindly and knowing exactly what protects you. ## Three keys, any two open it Every order generates three keys, held by the buyer, the vendor and the market. Any two together move the coin. In a clean order the buyer and vendor sign after delivery and the market key never moves. The market cannot touch the money alone, because one key of three opens nothing. ## Why three and not two A straight two-key box between buyer and vendor jams forever if either side goes quiet. The third key is the tiebreaker. Because the market holds only one of three, it cannot walk off with deposits, which is the exit scam that has sunk weaker markets. It can only help resolve a dispute. ## Disputes and refunds When something goes wrong, a moderator reads signed evidence from both sides and co-signs with whichever side is owed. A refund co-signs with the buyer to a refund address, and the vendor is not required. Cross-reference the desk article on a first order for how to keep a dispute in your favour. ## The one wrong move Finalising early means signing your release before the package arrives. It empties the box to the vendor and removes the dispute path. On an unproven vendor it undoes every other protection. Do not do it, whatever reason is offered. --- ## Privacy *The coin, the browser, the machine. Three layers, each optional, each additive.* The subject of privacy stacks in three layers, and a reader can stop at any layer that matches what they are protecting against. Each layer is additive, and none requires the one above it. ## The coin layer Monero over Bitcoin. A Bitcoin payment is legible on a public ledger forever. A Monero payment is not. If privacy is any part of the reason you are here, the coin is the cheapest layer to get right, and most entries default to Monero for you. Do not fund a market straight from an identity-checked exchange, because that ties your name to the deposit regardless of coin. ## The browser layer Tor Browser at the Safest security level. That turns scripting off everywhere, which closes the most reliable route anyone has to break anonymity from inside the browser. The markets in this directory are built to work at Safest, so you lose nothing you need. Cross-reference the desk article on a first lookup. ## The machine layer Tails, for the reader whose threat model includes their own hardware being examined later. It is a whole operating system that boots from a USB stick, routes everything through Tor, and forgets everything at shutdown. It is more effort than the other layers and it is the strongest. Most readers do not need it, and the ones who do already know why. --- # Reference desk ## A first lookup *You have never done this. Start here and go in order.* This is the desk article for a reader who has never reached a Tor market before. Read it in order and it takes you from nothing to a verified address you can trust. ## Get onto Tor Download Tor Browser from its official project site and nowhere else. Verify the signature on the download the first time, which the download page walks you through. Open the shield beside the address bar and set the security level to Safest. That is the whole setup, and it closes most of the ways a first crossing goes wrong. ## Pick an entry For a first lookup, the directory points you at Awazon, which reads like an ordinary online shop, or Nexus, the reference entry. Both are filed as beginner-friendly for different reasons. Open the entry and copy an address from the verified block at the top. ## Verify before you trust Never type a fifty-six character onion from memory. Copy it. When the login page loads, read the address the captcha prints into its image and hold it against your address bar. If they match, proceed. If they do not, close the tab. Cross-reference the security topic. ## Make the account carefully Pick a username you have never used anywhere else. Generate a long unique password and store it in an encrypted local manager. Write the recovery phrase the market issues on paper, in your own hand, and keep it somewhere only you reach. Cross-reference the desk article on a first order for what comes next. --- ## A first order *Small, cheap, standard escrow. You are buying information about the vendor.* The desk article for a first order. The order is calibration, not commerce. You are buying information about the vendor, and the product is a happy side effect. ## Read the vendor first Every vendor profile states a deal count and a dispute ratio. Read both. It takes about a minute and it is the most useful minute you will spend. A low dispute ratio and a solid deal count on recent orders is what you are looking for. ## Keep it small Smallest quantity, cheapest product that tells you what you need, standard shipping, standard escrow. A first order exists to test whether the vendor's advertised behaviour matches their actual behaviour, so the product is the least important variable. The right size is an amount you could lose without it mattering. ## Encrypt the address Encrypt your shipping details to the vendor's PGP key before pasting them into the order. On entries where PGP is on by default, this is handled for you. Elsewhere it is a two-minute habit that closes a permanent risk. ## Let escrow do its job Do not confirm receipt until the package is physically in your hands, whatever a vendor tells you about their reliability. Confirming early empties escrow to the vendor and removes the dispute path. Cross-reference the escrow topic. --- ## Verifying a mirror *The signature check that proves an address came from the market.* The desk article on verification. Every serious entry in this directory signs its mirror list with a PGP key, and checking that signature is how you know a published address came from the market and not from an impersonator. ## What a signature proves A PGP signature over a message proves two things at once. That the message was signed by the holder of a specific private key, and that not one byte has changed since. For a mirror list, the addresses inside provably came from whoever holds the market key, and nobody edited them in transit. ## The trust anchor The check is only as good as the key you check against. Fetch the market's public key once, from at least two independent places, cross-check the fingerprint, and import it. After that, every future list verifies against the same key. Do not re-fetch the key each time, because that is another chance to be handed the wrong one. ## Running the check Save the signed list to a file and run the verify with GnuPG. Look for the line that says the signature is good and names the market key. That line is the whole result. A warning that you have not certified the key is normal. A bad-signature line means the list was altered, and you trust none of the addresses in it. ## Then compare Once the signature checks out, compare the addresses in the list against the one in your bar. The signature and the address check are two different defences. Running both closes more than either alone. Cross-reference the security topic. --- ## Choosing a coin *A short decision for a question people overthink.* The desk article for a decision people overthink. In most cases the answer is Monero, and the exceptions are specific. ## Default to Monero If privacy is any part of why you are here, use Monero. It keeps the payment off a readable public ledger, and most entries default to it anyway. This is the answer unless a specific reason overrides it. ## Use Bitcoin when forced Some vendors take only Bitcoin. When that is the case, use Bitcoin, but do not send straight from an identity-checked exchange to the market. Route through a fresh wallet you control first, or swap Bitcoin to Monero inside a wallet like Cake before depositing. That breaks the trail between your name and the market address. ## Use Litecoin for small orders When the purchase is small and Bitcoin's network fee would be out of proportion, Litecoin settles faster and cheaper. Two entries accept it. ## Use Ethereum only when you hold it One entry takes Ethereum. It buys convenience when that is the coin in your wallet, not privacy, because its chain is public. If privacy is the goal, the decision circles back to Monero. Cross-reference the payments topic. --- ## Staying reachable *What to do when a market goes dark, and which entries resist it.* The desk article on downtime. Markets get flooded and addresses go dark. A reader who knows what to do loses nothing. A reader who does not assumes the market is gone. ## Rotate, do not wait When an address stalls, open the market's signed mirror list and move to the next live onion. Every mirror resolves to the same account and balance, so switching costs you nothing but a fresh Tor circuit. Do not sit on a dead address hoping it recovers. ## Which entries resist downtime Three entries are filed specifically for resilience. Mars publishes more live onions at once than any other. TorZon runs seven concurrently and puts a queue at the door. Osiris pairs a deep pool with fast moderators. Cross-reference each entry, and the access topic for the general note. ## When everything stalls If every address on the signed list is unreachable across different Tor circuits for more than a few minutes, the problem may be wider than one market. Wait an hour and retry. If a market is genuinely rotating its whole set, a fresh signed list usually follows within a day. Never take an unverified address from a stranger in the gap. --- # Glossary **Anti-DDoS queue**, A waiting-room page in front of the login that holds every visitor for a short spell, so bots cannot hammer the captcha behind it. TorZon is the entry filed for it. **Bond**, A refundable deposit a new vendor posts before listing. Forfeit if the account is suspended in probation, which makes a smash-and-grab vendor account cost real money up front. **Captcha address check**, Reading the onion address a market prints into its login captcha and holding it against the address bar. A fast, per-session catch for lookalike sites. **Dispute**, A formal disagreement over an order. A moderator reads signed evidence from both sides and co-signs the escrow release toward whichever side the evidence favours. **Escrow**, The arrangement that holds a payment in a multisig contract until buyer and vendor agree the order is done, or a moderator settles a dispute. **Finalise-early (FE)**, Signing your escrow release before the package arrives. It empties the contract to the vendor and removes the dispute path. The one move the directory warns against on every entry. **Hidden service**, A server reachable only through Tor at a .onion address. Every market in this directory is one. A normal browser cannot open it. **Mirror**, A distinct onion address that resolves to the same market, with the same account, balance and orders. Markets run several so a flood on one does not take the market down. **Multisig (2 of 3)**, An escrow contract with three keys held by buyer, vendor and market, where any two release the coin. The market alone cannot move it because one key opens nothing. **Onion address**, A fifty-six character v3 Tor address ending in .onion. Copy it, never type it, and verify it against a signed list before entering a password. **PGP signature**, A cryptographic signature proving who signed a message and that nothing has changed since. Markets sign their mirror lists so you can confirm an address is genuine. **Probation**, The escrow-only window a new vendor runs before earning finalise-early. Their standing shows on the profile, so you can read it before ordering. **Safest**, The top Tor Browser security level, which turns scripting off everywhere. The correct setting for every entry in this directory. **Signed mirror list**, A market address list published with a PGP signature. Verifying it against the market key is how you know an address was published by the market and not an impersonator. **Withdrawal PIN**, A second secret, separate from the login password, required to move a balance off the market. TorZon enforces one, so a stolen session cookie alone cannot empty the account.