Dread link after the October 2026 move: the hijacked old addresses, and how to check the new one
The only genuine Dread link since 7 October 2026 is the address HugBunter, Dread's administrator, announced that day in a message signed with his PGP key. Both addresses Dread used before then were taken over between 5 and 7 October, and whoever holds their keys can still run them. A Dread link from before the move, whether a bookmark, a directory entry or a link in an old post, now leads somewhere hostile. A Dread address is worth opening only if it appears in full in that signed announcement.
Current as of : Dread has not changed address again since 7 October.
What Dread is, and who runs it
Dread is a Reddit-style discussion forum on Tor, run since 2018 by its founder and administrator, HugBunter, with a small staff of moderators. It took over the job Reddit's darknet market communities had done until Reddit banned them that year: reviews, scam reports, technical help and, above all, a place where markets talk to their users.
The forum is split into subdreads, communities with their own names and moderators, much like subreddits. Most of the markets on our darknet market list keep an official one, and a market's own subdread is where its staff post signed news. That is why the Dread forum matters even to people who never post on it: a market's new mirror, key change or outage notice usually appears there before anywhere else.
Why Dread changed its address in October 2026
Like many large onion services, Dread sat behind EndGame, an anti-DDoS front end built by darknet operators, and used GoBalance, the EndGame tool that spreads one onion address across several servers. A flaw in GoBalance let outsiders work out the private key behind each address it served, and with that key an attacker can run the address from their own machine, for as long as they like. What a leaked onion key does and does not hand over is set out in our guide to verifying an onion link.
Dread's main address was taken over on 5 October 2026 and its second address on 7 October, and both were pointed at pages the attacker controlled. Dread generated a new key, moved to a new address on 7 October, and HugBunter announced the move in a signed message. The technical analysis of the GoBalance flaw covers the mechanism. The original OnionBalance and Tor itself were not affected.
The attacker got Dread's two addresses, not its servers: accounts, posts and private messages stayed on Dread's side. What the attacker could collect, and still can, is whatever visitors type into the copies running at those addresses.
Are old Dread links safe?
No, and they will not become safe again. A leaked onion key cannot be withdrawn. Dread's staff can keep publishing an old address, but nothing stops anyone else holding the key from publishing it too, so nobody can promise who answers at that address on any given day. Both pre-move addresses are hostile for good.
Some directories and link pages still list an old Dread address as current, months after the move. Delete every Dread bookmark older than 7 October 2026, and treat a Dread onion link from anywhere as unchecked until it matches the signed announcement.
Checking the new Dread address against HugBunter's key
- Get HugBunter's public key from before the move. Either a copy you saved before October 2026, or the key that has signed Dread's announcements for years, with the same fingerprint in several unrelated places. Its creation date should be years old, not weeks.
- Distrust a "new Dread key". A genuine move is announced under the key people already hold. A new address arriving with a brand-new key to vouch for it is how a phishing copy of Dread would present itself.
- Find the 7 October announcement. It has been reposted on markets, other forums and link pages. Where you found it does not matter; the signature is what makes it genuine.
- Verify it in Kleopatra or with
gpg --verify. You want a Good signature from the fingerprint you settled on in step 1, made on or after 7 October 2026. - Search the verified text for the full address you intend to use. Only the lines between the signed-message header and the signature count; anything above or below them could have been added by anyone.
- Save the address, and treat the bookmark as good only until HugBunter's next signed announcement: an address that was right on 7 October is retired the day a newer signed message says so.
When gpg or Kleopatra reports anything other than a Good signature, our guide on how to verify an onion link sorts the harmless warnings from the ones that mean the announcement was altered.
If you logged in through an old Dread address
If you signed in through a pre-move address on or after 5 October, assume whoever ran it has your username and password, and may have watched your session as it passed through. In that order:
- Change your Dread password, from the new address.
- Change it everywhere else you used it, markets first. A captured forum login gets tried on markets before anywhere else.
- Treat anything you sent by private message through the old address as read.
- If your Dread profile carries a PGP key, check its fingerprint is still yours.
- Recheck any market address you picked up from Dread during those days. A hostile copy of Dread can show you any "official" mirror list it likes. For Mars, the check is in our Mars Market link guide.
Why Dread makes you wait in a queue
The queue is the anti-DDoS front end doing its job. Dread is flooded with fake traffic regularly, from rivals and from extortionists, and the queue rations entry so the forum behind it stays up. You wait, solve a captcha and get a session. Refreshing usually sends you to the back, and long waits during an attack are normal.
The queue proves nothing in either direction. A copy can show an identical queue page, and the real Dread can let you straight in on a quiet day. Only the address check above tells you which one you are queueing for.
How markets use Dread for their announcements
Markets use their subdreads for anything that cannot wait for users to log in: new mirrors, planned downtime, key changes, rule changes and answers to complaints. A genuine market announcement is signed with the market's own PGP key. An unsigned post about addresses is just text, however official the account name looks, and accounts with names one character away from a market's real staff are a standing hazard.
Users post there too, which makes a market's subdread the first place stuck withdrawals and unanswered tickets show up, usually well before the market itself admits anything. Those three days in October showed the weak point: on a hijacked Dread, a fake market announcement looks exactly like a real one. A market address posted on Dread is checked against the market's own key, never against the forum it was posted on.