Darknet market list and links for November 2026: what is live, what died, and how they differ
Ten darknet markets were up and answering on their own signed addresses on 6 November 2026: Torzon, DrugHub, Mars, Catharsis, Black Ops, WeTheNorth, Flugsvamp 4.0, Omega, Awazon and Vortex. Torzon is the biggest. Five names that sat on every list a year ago are gone: DarkMatter and Nexus exit-scammed this autumn, Prime went offline in October, Abacus collapsed in July 2025, and police seized Archetyp in June 2025.
Statuses as of . Markets change week to week, and a list with no date on it, or one older than a month, is a list to distrust.
Active darknet markets and their links this month
A market is on the live list here when three things hold: it answers on an address that its own signed mirror list carries, it is paying out (withdrawals on a wallet market, escrow releases on a walletless one) with no unexplained freeze, and its staff are still posting on its announcement channel. A market that loads but has stopped paying is not live; it is in the middle of an exit.
| Market | Verified onion address | What sets it apart | What to know before trusting it |
|---|---|---|---|
| Torzon | torzonpippjluhbgekljuw2m5fvva5a3s6qwimcjhk66ppwikkzw5uid.onion | The largest market by listings this autumn | Running since 2022, and the biggest escrow pot on the list, which makes it the biggest target for police and for phishing copies alike |
| DrugHub | drughubfcuiheyswp6hlkggjsigirlzjjk2i7vmcdygceaw2kvzhlfqd.onion | Takes Monero only | No Bitcoin means no public Bitcoin trail leading into the market; it also means a buyer has to hold Monero first |
| Mars | marshpg43lw4nt44jgwqg75mxyzlln2ggitaep4trkm7gehafjmjolid.onion | Drug-focused, walletless escrow, PGP login | Open since January 2025; how its escrow and login work is in our Mars Market overview. Two signing keys circulate as Mars's, so the key question has to be settled first, and our Mars Market link guide covers it |
| WeTheNorth | wtnlinkmehvqtgwnmb3gxadbvuf2njbtonqqyc4zgxtps6fcx6kwfwad.onion | Canada only | A domestic market: it serves Canadian buyers and vendors and is no use to anyone outside Canada |
| Flugsvamp 4.0 | fs44sf444jitfqundbjgfeuqpoxzmh6xpqjkp7v2w7a7b3gnpcvc63id.onion | Sweden, Swedish-language | The fourth market to carry the Flugsvamp name. Each version is a separate market, so an account or reputation from an earlier one carries no weight on this one |
| Omega | omegafbysjaon2aiahn3akawxrkquzaqicatvg6j4quvlaizmo7dcgid.onion | New address since October 2026 | Moved after the onion-key leak that also hit Dread. Its old addresses are now hostile, so any list still showing them is out of date |
| Catharsis | catharodo5qim7ksvwlshm2orygwse6av34xksqcfx4uwk5weiizviid.onion | Live and answering | Less of a public record to judge it on than the markets above. Run the five checks in the section on what decides trust before treating it as established |
| Black Ops | blackopktxvm56krsni7bikxpbsjmboqfte3dxbvqat7va2knxswpsad.onion | Live and answering | Less of a public record to judge it on than the markets above. Run the five checks in the section on what decides trust before treating it as established |
| Awazon | awazonquc4wwxea737nfi2vdsk4uitcmionmhwhftaiw7oadrucnnqyd.onion | Live and answering | Less of a public record to judge it on than the markets above. Run the five checks in the section on what decides trust before treating it as established |
| Vortex | vortexjnkogtqcpwhxzb4l6czzvhz3oyj5udfz2mmsnmgldvvqxyh2id.onion | Live and answering | Less of a public record to judge it on than the markets above. Run the five checks in the section on what decides trust before treating it as established |
The addresses above are the ones each market carried on its own signed mirror list when we checked on 6 November 2026. They are printed as plain text, not as clickable links, for the same reason as on our Mars link page: you copy the address into Tor Browser yourself, so nothing on this page opens anything for you. None of them stays good for ever — Omega's old addresses were genuine until the day they were taken over — so re-check an address against the market's newest signed message before you trust it. And an address of a market in the closed table below is hostile, whatever it used to be.
The order is not a ranking. A list of "top darknet markets" implies someone can tell you which market will still be paying out in three months, and DarkMatter's and Nexus's places on this year's lists show what that is worth. What a list can do is tell you who is up today, what each one's record is, and what to check yourself.
The biggest market, the Monero-only one, and the single-country ones
Which darknet market is the biggest right now
Torzon, by number of listings. Size gives a buyer more vendors to compare and more reviews to read. It does not give safety. The coins sitting in escrow on a large market are what makes an exit worth it to its operators and a seizure worth the police effort, and Archetyp, the market police took in 2025, was one of the largest of its time.
Which markets take only Monero
DrugHub is the Monero-only market on this list. The rest take Bitcoin and Monero, and Mars converts Bitcoin to Monero at checkout. Accepting only Monero closes one leak: a Bitcoin payment is visible on a public ledger from the exchange that sold the coins to the market's address, and a Monero payment is not. What each coin reveals, and to whom, is the subject of our explainer on Monero vs Bitcoin privacy.
Which markets serve a single country or language
WeTheNorth serves Canada and Flugsvamp 4.0 serves Sweden, in Swedish. A national market's whole catalogue, its forum talk and its support are built for one country, so it has a smaller pool of vendors than an international market and nothing to offer anyone outside that country.
Markets that closed or exit-scammed in 2025 and 2026
These are off the live list, and any darknet market links page still carrying them has not been updated since they fell. Their old addresses are now either dead or run by someone else.
| Market | When | How it ended |
|---|---|---|
| Nexus | 8 October 2026 | Exit scam, despite running multisig escrow |
| Prime | October 2026 | Went offline with no stated cause |
| DarkMatter | Late September 2026 | Exit scam: stopped paying withdrawals while it kept taking deposits |
| Abacus | July 2025 | Went dark after a stretch of failed withdrawals |
| Archetyp | 11–13 June 2025 | Seized in a European police operation; the servers were taken and the administrator arrested |
Archetyp was the oldest drug market running when it fell, with more than 600,000 users and at least €250 million in transactions behind it; Europol's announcement of the takedown has the operation in full.
Two of these closures shaped how this list is built. DarkMatter kept loading and kept taking deposits for weeks after it had stopped paying, which is why paying out, and not merely answering, is one of the three tests for a place on the live list. Nexus exited with multisig escrow running, which is why multisig earns a market no extra credit in the trust checks further down. How each of these played out, the warning signs that came first, and why multisig did not save Nexus users are on our page about darknet market exit scams.
How the list changed between 2024 and November 2026
The seizures, exits, launches and address moves that reshaped the list since 2024, in order:
- March 2024: German police seize Nemesis.
- January 2025: Mars opens.
- May 2025: Europol announces 270 arrests of dark web vendors and buyers in a single coordinated operation.
- 11–13 June 2025: Archetyp is seized.
- July 2025: Abacus goes dark.
- Late September 2026: DarkMatter stops paying out.
- 5–7 October 2026: Dread's old addresses are taken over through leaked onion keys, and Dread moves on 7 October. Omega moves the same month.
- 8 October 2026: Nexus exits.
- October 2026: Prime goes offline.
The autumn cluster is why lists disagree so much right now. Three markets fell within a few weeks of each other, in the same month that Dread's and Omega's old addresses stopped being safe, and a list that was accurate in September can be wrong in three places by November. A list's date tells you which of these it can know about: one dated before 5 October still sends readers to Dread's and Omega's old addresses, both hostile now, and one dated before 8 October still carries Nexus as live.
Markets that changed address after the October 2026 key leak
In October 2026 a flaw in GoBalance, a load-balancing tool that busy onion services use, exposed the private keys behind the addresses of large onion services, Dread and Omega among them. An attacker holding one of those keys could serve a copy from the genuine old address, matching every character of the real thing, so each affected service had to move.
- Omega moved to a new address that month and retired the old ones. Anyone with an old Omega bookmark should delete it and take the new address only from a signed Omega message. If you logged in through an old address after the start of October, treat the password as known and work through the steps for a password typed into a phishing page.
- Dread, the forum where most of these markets post their announcements, lost both of its old addresses to takeover between 5 and 7 October and moved on 7 October. Old Dread bookmarks are hostile, and our Dread link page covers the move and the check for the new address.
- Mars addresses newer than the January 2025 set appeared in October 2026, and since then link pages disagree about which Mars list and which key are current.
For anyone keeping a list, the lasting effect is that a saved address matched in full no longer settles anything on its own. What settles it is a signed message from the market's own key confirming or retiring the address, dated after the last one you saw, read the way our guide on how to verify an onion link shows.
What decides whether a market can be trusted
Every market on a list looks the same from the outside: a logo, a login page, a list of categories. These are the five points that separate them, and none of them needs inside access to check.
| Point | A good sign | A warning sign |
|---|---|---|
| Record | More than a year of operation and at least one rough patch, a DDoS or an outage, that it came back from | A few months old, or a famous dead name "back" under new management |
| Signed mirrors | A mirror list signed with one long-standing key, updated by signed messages | No signed list, a key created recently, or new addresses announced without a signature |
| Where the money sits | Walletless escrow, or a wallet market where withdrawals clear normally | Withdrawals "delayed for maintenance" while deposits still work |
| Login | PGP login available to every account and required for vendors | Password-only login, or a "PGP" option that never actually encrypts a challenge to your key |
| Staff | Signed announcements on Dread and support that answers | Staff silence while users post about stuck funds |
Walletless markets like Mars hold only the coins in open orders, so an exit costs users less than on a wallet market where balances pile up. Multisig escrow, where a payment needs two of three keys to move, is meant to stop the market taking coins alone, but Nexus showed a market can still exit with it; the reasons are on the exit scam page. No escrow model protects anyone from a seizure. What limits the damage then is what you never left readable on the market: messages encrypted to the other side's key before sending, and an account that ties back to nothing else you use.
The terms every market page uses
Market pages, reviews and Dread threads use the same short vocabulary, and the differences between markets above come down to these words.
- Escrow
- The market holds the buyer's payment until the buyer confirms delivery or the order's timer runs out, then releases it to the vendor. It is the buyer's only lever in a dispute.
- Finalize early (FE)
- Releasing escrow before the order arrives. After that, a dispute has nothing to act on.
- Direct pay
- A vendor setting that skips escrow: the payment goes straight to the vendor. Usually reserved for vendors with a long record on that market.
- Wallet market
- Buyers deposit into an account balance first and pay from it. Balances build up on the market's side, which is what an exit takes.
- Walletless
- No account balance: each order is paid to its own address. Mars works this way. Only open orders are exposed if the market exits.
- Multisig
- Escrow where moving the coins takes two of three keys, held by buyer, vendor and market. It stops the market moving coins on its own key; it did not stop Nexus.
- Mirror
- Another address for the same market, with the same accounts behind it.
- Signed mirror list
- A market's addresses in a message signed with its PGP key. The one thing on any list that can be checked rather than believed.
- PGP 2FA
- A login step where the market encrypts a code to your public key and you decrypt it. It defeats a stolen password, not a phishing relay.
- Vendor bond
- A fee a vendor pays to open a shop. It filters out some throwaway scam vendors and none of the established ones who decide to exit.
How to tell a new market from a scam launch
After every big closure, new markets appear to catch the users who were left behind, and some are built to take one round of deposits and vanish. A genuine new market can't prove a record it doesn't have yet, but a scam launch usually gives itself away in its first weeks:
- It asks for a deposit before you can see anything. A minimum deposit to "activate" an account, or to browse listings, is the scam's whole business model in one screen.
- It borrows a dead market's name. "Nexus 2", "DarkMatter returns", a site claiming to be a closed market's new address: a market that exit-scammed does not come back to give money to the people it took it from.
- Its vendors are all new and its listings are huge. Thousands of listings with no reviews, often copied word for word from another market, means the catalogue was scraped, not built.
- Its key is days old and signs nothing else. A real launch has one key from the start and signs everything with it. A scam often has no signed list at all, or a key that appeared the same week as the site.
- It arrives by private message. Launch links pushed through comments, direct messages and search ads, with no announcement channel of its own on Dread, are distribution for a phishing site, not a market.
- Its promises are too good. Zero fees, a deposit bonus, "guaranteed" multisig with no way to see the multisig address: things a market that means to stay has no reason to offer.
None of this makes an honest new market safe; it only filters out the obvious fakes. A market that passes all six is still a few months old, and most exits on record came from markets older than that.
Before you open anything on this list
Every market here has lookalike addresses circulating under its name, and the lookalikes rank for the same searches. A directory that covers every market is only as current as its last edit, and it goes wrong first on the markets that moved or died this autumn: Omega's old addresses, Dread's, and the dead names in the closed table above. A directory entry with no signed message from the market behind it gives you nothing you can check. The address you open should come from the market's own signed mirror list, checked against a key you trust; Tor Browser shows you the address it reached but cannot tell you who runs it, and the Tor Project's guide to onion services explains what the address does and does not prove.
The legal side does not change from market to market. Buying or selling controlled drugs is a crime almost everywhere, and police target buyers as well as markets: Europol's 2025 operation against dark web drug networks ended in 270 arrests across vendors and buyers. A market's record, its escrow and its signed mirrors protect against the market and its imitators. They do nothing about that.