Phishing is the primary attack vector against darknet market users. Thousands of users lose funds every year to sophisticated clone sites that mimic legitimate markets. This guide gives you the knowledge to identify and avoid them every time.
Darknet market phishing operates differently from clearnet phishing. Attackers cannot redirect via DNS hijacking (Tor handles DNS internally), so instead they rely on near-identical clone sites hosted on look-alike onion addresses. A phishing site differs from the legitimate market by as little as one character in the 56-character v3 onion address.
Once you enter your credentials on a phishing site, the attacker has immediate access to your account, your wallet balance, and your pending orders. Because cryptocurrency transactions are irreversible, there is no recourse once funds are stolen. The phishing site may also harvest your PGP private key if you use the market's built-in message decryption feature.
The most common distribution vectors for phishing links: Reddit threads claiming "official" links, Telegram groups advertising market access, forum posts with fake "updated" mirror lists, Google search results (the real market cannot appear here), and private messages from unknown users claiming to be market staff.