Frequently Asked Questions

This platform is the official, cryptographically verified clearnet informational gateway and secure verification directory for Drughub Market Onion. Our primary operational objective is to maintain a continuous, highly secure repository of active .onion mirrors, detailed configuration tutorials, and trusted PGP signatures. By utilizing this gateway, users can bypass malicious redirects, lookup valid system states, and cross-examine key files before initiating any darknet-routing sequence.

Browse to the verified address and navigate to the registration terminal. Select an entirely isolated username and password combination that shares zero correlation with your clearnet identity or offline accounts. To unlock full security privileges, you must import your PGP Public Key during registration. A unique recovery mnemonic phrase will be generated upon account creation; store this phrase in an encrypted local storage layout, as it is the only cryptographic vector capable of restoring access to lost profiles.

Every valid domain mapping is cryptographically signed using our official public master key. To execute link verification, copy the GnuPG signed cleartext block published on this directory, save it locally as a sign file, and run gpg --verify. If the output returns a Good Signature from our known fingerprint, you can proceed with absolute certainty. Never trust raw links published on unverified index aggregators or forums.

Unlike standard domain name systems (DNS) that route queries through public and third-party servers, onion links function through mathematical keypair resolution. A .onion address is derived directly from the system’s public cryptographic key. When requested inside Tor, the browser uses a multi-layered distributed hash table (DHT) to establish localized circuit steps. Traffic remains end-to-end encrypted, hiding both the market server location and client IP structure.

We offer extensive operational security configurations. Most notably, users can enable PGP-based Two-Factor Authentication (2FA). When 2FA is active, our server generates a random token during login, encrypts it with your verified public key, and requires the decrypted feedback code to complete the handshake. We also enforce automated session terminations, custom pin codes for balance payouts, and strict login attempt limits to mitigate automated brute-force attacks.

The platform infrastructure is audited to exceed industry security standards. However, your individual safety depends entirely on personal habits and procedural hygiene. Ensure your operating system does not store persistent logs, always run a dedicated, non-compromised Tor environment, encrypt all package shipping details using your vendor’s PGP key yourself (rather than relying on in-browser auto-encryption options), and execute currency exchanges via privacy-centric protocols.

We fully support and encourage the use of Monero (XMR) due to its ring signatures, stealth addresses, and confidential transactions that mask transaction amounts, sender addresses, and receiver details at the blockchain protocol level. For legacy purposes, Bitcoin (BTC) is also supported; however, BTC transactions should be treated as entirely transparent, requiring external obfuscation cycles beforehand to secure your financial trail.

Our multi-sig and standard escrow systems operate by isolating deposit funds in a protected physical holding vault during order fulfillment. When a buyer initiates an order, the transaction sum is temporarily frozen. Funds are only transferred to the vendor’s working balance once the buyer issues a cryptographically authenticated delivery acknowledgment. In the event of a logistical failure, funds remain locked inside the vault, protected from one-sided withdrawals until resolved.

Our system does not enforce arbitrary limits on commercial volume or account balances. However, to maintain network health and prevent blockchain spam, transaction values beneath the standard dust limit (calculated automatically based on active mempool fees) are ignored. Payout processes execute immediately after receiving the required blockchain confirmations (typically 10 confirmations for XMR).

To publish listings, prospective merchants must complete our strict onboarding lifecycle. This includes purchasing a vendor bond to establish financial accountability and deter exit schemes. Existing vendors with verifiable, long-standing positive feedback profiles on recognized peer networks may apply for a direct bond waiver. All vendor profiles are monitored via temporary probation stages to verify fulfillment speeds and quality consistency.

If an order does not land within the designated delivery timeline, the buyer can trigger the formal dispute process to freeze the associated escrow funds. A support mediator will then audit the dispute panel, requesting objective evidence from both entities (such as PGP-signed tracking details, postal drop receipts, and historic performance logs). The arbiter will construct a fair settlement distribution based on verifiable proof.

To protect our operational environment and adhere to core system ethics, we enforce zero-tolerance bans on specific classifications. Prohibited listings include child exploitation materials, human trafficking services, biological and chemical agents, non-consensual weapons, doxxing databases, and lethal poisons (such as fentanyl compounds). Vendors found hosting these items face immediate account termination and asset liquidation.

In the event of network timeouts or active DDoS mitigation cycles, the local routing system may fail to establish a clean circuit. Begin by executing a circuit refresh inside your Tor Browser (using the New Identity control block) to obtain a new IP pathway. If connection attempts persist in failing, navigate directly back to this gateway and check the active status list for a validated mirror mapping.

All customer or vendor assistance operations run through our decentralized system ticketing utility within the Tor dashboard. We do not maintain support communication tunnels on external networks (such as Reddit, Telegram, or Discord), as these networks fail to support proper cryptographic authentication structures. Make sure you encrypt your tickets locally with our support PGP key.