Darknet market safety

The wallet split

Run two wallets. A cold wallet holds the bulk of the coins. A market wallet holds only what you mean to spend in the next session. That is the whole trick, and it works because it limits the loss. If the market wallet is drained, the cold wallet never saw the coins in the first place.

Set a ceiling and keep it under. The ceiling is the amount you can lose if the market closes tomorrow and the coins are gone. Nothing more sits in the market wallet than that number. Top it up from the cold wallet, spend, and move the remainder back. A market wallet that always carries a year of spending is a cold wallet wearing a hat.

Move coins on a schedule, not every day. Every transfer is a visible operation. Someone watching the chain sees the wallet receive, sees it send, and the pattern says where the money lives. Move on a set rhythm, say once a week, and keep the rhythm. The coins move when the schedule says, not when the market feels busy.

Passwords and accounts

Give each market its own email. Not the main inbox, not the work one, not the one tied to your name. A market account should be reachable from an address that proves nothing about you if it leaks. Make it disposable in the sense that losing it costs you nothing you cannot replace.

Use a password that lives nowhere else. One password, one market. If it ever leaks, it leaks into one account, not into the forum, the wallet, and the email at the same time. The failure that costs people the most is reusing a password between a clearnet forum and a market. One compromised account then pulls the second one down with it, because the attacker only needed to break the lock once and the same key fits both doors.

Keep the market password in a password manager on a machine that is separate from the one you use for the market. The manager and the browser should not share a desktop. That way a stolen login does not hand over the vault that holds it.

PGP before you buy

Contact the vendor before you pay, not after. Send an encrypted message that asks the question you actually need answered, whether the item ships to your region, what the delivery window looks like, what the return rule is. The encrypted message is the proof. If the deal goes bad later, the message is the record, and a record in the clear is a record the other side can deny or say was edited.

Take the vendor's public key from the vendor's own page, or from the product page where the vendor is listed. Do not take a key from an email, a forum reply, or a message that arrived from an address you have not checked. A key sent from an unverified address is not the vendor's key. It is someone else's key wearing the vendor's name, and encrypting to it hands the message to the wrong reader.

Escrow, explained by what goes wrong

Escrow is where the coins sit while the deal happens. You send the coins to the market, not to the vendor. The market holds them. When you confirm delivery, or when a release timer runs out, the market hands the coins to the vendor. Until that moment the coins belong to the deal, not to either side.

The release period is the window between your confirmation and the coins actually reaching the vendor. Read it before you buy. It is the time the vendor has to be reachable, and the time you have to notice something is wrong. A short release period means less room to react, and a long one means the coins sit in limbo longer. Know the number before the purchase, not after.

When a dispute opens, the market decides it from the messages. That is why the PGP thread and the screenshots exist. The market reads the exchange and rules on what the two sides actually said. No record, no case. The screenshots and the encrypted messages are the whole argument, and a dispute fought with only your word is a dispute already lost.

If a vendor disappears, open the dispute the moment you notice. Do not wait for the timer. Waiting hands the market a record that says the buyer said nothing while the coins sat, and that record reads as the buyer being fine. The dispute opened early is the dispute with the best chance, because the coins are still held and the story is still short.

Reading a vendor

Look at the rating and the count together, not the rating alone. A high score on two reviews says less than a solid score on two hundred. The count is the sample, and the sample is what the rating is built on. A vendor with a long history and a steady count is a different animal from one with a high score and a thin one.

A new vendor with five hundred five star reviews is a vendor with bought reviews. The number is not the history, it is the price of the reviews. The vendor is new, the reviews are not, and the gap between the two is the tell. Check the age of the vendor and the age of the reviews, and if the reviews are older than the vendor, stop.

Start with a cheap item. The first order is a test of the vendor, the delivery, and the escrow, not a test of the item. Pay the small amount, run the whole path, and see how the vendor behaves on a deal that costs little. If the cheap order lands clean, the expensive one has a reference point. If it does not, the expensive one never happened.

Check the delivery options and the tracking before you pay. A vendor who offers a trackable option is a vendor who can be pinned to a delivery. Look at the photos in the reviews, the actual item, the actual packaging, and treat a vendor who never posts a photo as a vendor who never has to show the work.

Opsec habits

Use Tor Browser for the market. Not a normal browser, not a gateway, not a proxy that reads the traffic. The market runs on the onion, and the onion runs on Tor. Everything else is a detour that hands a copy of the traffic to someone in the middle.

Do not bounce the circuit in and out of a login. Log in, work, and stay. Rebuilding the circuit on every action is slower and gives more chances for a page to land on a different path than the one you expect. Let the session hold while it is in use.

Do not pay through a clearnet proxy. A payment is not a glance. The proxy that shows you the storefront also reads the payment, and a payment read by a third party is a payment that is no longer private. Pay from Tor Browser, on the circuit, to the market's own address.

Run a separate profile, or a separate machine, for the market. The market should not share a browser profile with the rest of the web, because the rest of the web carries the cookies and the history that a market account does not need. For a higher level of separation, a live environment like Tails runs the whole session on a machine that holds nothing after it shuts down.

Tell the people in the circle about the purchase, and no one else. A purchase mentioned to a stranger is a purchase with a witness, and a witness is a detail that can come back. The circle is the people who would not trade the detail for anything. Everyone else is an open window.

The routine is the defense. Two wallets, one password per market, PGP before the purchase, a dispute opened early, and a session that does not talk to the rest of the web. Do those and the market stays a market, and the coins stay where they were put.