Frequently Asked Questions

DrugHub launched in August 2023 by the former White House Market team, who operated WHM from 2019 to 2021 without exit scamming. The connection was verified through PGP signatures on Dread forum. The marketplace has since absorbed SuperMarket in 2024 (first-ever marketplace merger) and welcomed refugees from seized marketplaces like Archetyp. With 500,000+ users, 4,000+ vendors, and consistent operation for 2+ years, DrugHub has established strong reputation. However, like all darknet marketplaces, risk exists - use proper OPSEC and never invest more than you can afford to lose.

Access requires Tor Browser (from torproject.org), configured to "Safest" security level. The platform works perfectly without JavaScript enabled. Obtain official onion links from Dread forum with PGP signature verification - never trust links from Telegram, Reddit, or search engines. Generate a 4096-bit PGP keypair before registration, as the marketplace uses passwordless PGP authentication. You'll also need a Monero wallet since the platform exclusively accepts XMR. Complete setup takes approximately 30 minutes for first-time users. See our detailed Access Guide for step-by-step instructions.

DrugHub operates exclusively on the Tor network as an onion service, inaccessible through regular browsers. This design choice provides anonymity for both the marketplace and users. Clearnet websites claiming to be DrugHub are phishing scams attempting to steal credentials and cryptocurrency. The only legitimate way to access the marketplace is through verified .onion URLs obtained from Dread forum with valid PGP signatures. Regular search engines cannot index onion services, and attempting to access the platform through clearnet is impossible by design.

No, the marketplace functions completely without JavaScript. Set your Tor Browser to "Safest" security level (which disables JavaScript) without losing any marketplace functionality. This design choice maximizes security by eliminating JavaScript-based attack vectors commonly used to deanonymize Tor users. All features including browsing, purchasing, messaging, and account management work perfectly with JavaScript disabled. If a site claiming to be the platform requires JavaScript, it's a phishing site.

The platform displays a recovery token once during registration - this token serves as emergency account access if you lose your PGP private key. The recovery token is shown only once and cannot be retrieved later, so save it immediately to encrypted offline storage (USB drives, paper in safes). If you lose both your PGP key and recovery token, account recovery becomes impossible. The marketplace cannot reset access without these credentials since no password fallback exists. This design prevents administrative password resets that could compromise accounts.

No, usernames are permanent and cannot be changed after account creation. Choose your username carefully during registration - it should be unique to the platform (not used elsewhere), memorable, but generic enough to maintain anonymity. Avoid usernames containing personal information, dates of birth, location references, or patterns that could identify you. If you absolutely need a different username, you must create a new account with a different PGP keypair, but this means starting fresh with no transaction history or vendor reputation.

Recovery tokens alone don't grant full account access. The platform requires additional verification (security questions, order history validation, timing analysis) before allowing recovery token usage. However, treat recovery tokens as highly sensitive - store them offline encrypted or in physical safes. If you suspect recovery token compromise, immediately use it yourself to access your account, then generate a new token and invalidate the old one through security settings. This rotation prevents the compromised token from working for attackers.

2FA is optional but strongly recommended. The platform's 2FA uses PGP-based authentication rather than phone apps or SMS - enable it through Account Settings → Security → Two-Factor Authentication. When enabled, login requires decrypting two separate challenge messages: one proves key possession, the second confirms active authentication timing. This prevents unauthorized access even if someone obtains your PGP passphrase. Setup takes 2 minutes and dramatically improves account security. Enable 2FA before making any purchases.

Bitcoin's transparent blockchain exposes sender addresses, receiver addresses, and transaction amounts to public analysis. Law enforcement uses blockchain analysis companies (Chainalysis, Elliptic, CipherTrace) to trace Bitcoin through darknet marketplaces. Monero provides true privacy through ring signatures (hiding senders), stealth addresses (hiding receivers), and RingCT (hiding amounts). This cryptographic privacy makes transaction analysis mathematically impossible rather than merely difficult. The marketplace prioritizes user safety over convenience, accepting only Monero to ensure maximum financial privacy.

Use anonymous cryptocurrency exchange services like Trocador.app, ChangeNOW, or SideShift.ai to swap BTC→XMR without KYC requirements. Never use major exchanges (Coinbase, Binance, Kraken) for marketplace-bound Monero - they collect identity documents and track destination addresses. The swap process: send Bitcoin to the exchange service, receive Monero at your personal wallet address. This breaks blockchain analysis trails since Bitcoin's history ends at the exchange and Monero's privacy prevents further tracking. Always send swapped XMR to your own wallet first before using marketplace addresses.

DrugHub requires 2 network confirmations before releasing orders to vendors. Monero blocks generate approximately every 2 minutes, so 2 confirmations typically take 20-40 minutes. Confirmation time varies based on network congestion and mining hashrate. Once confirmed, vendors receive notification and begin processing orders. Never send additional payments thinking the first failed - check blockchain explorers like xmrchain.net using transaction IDs to verify confirmation status before resending.

DrugHub uses a walletless direct-pay system - there's no account balance to withdraw from. Funds go directly into per-transaction multisignature escrow addresses rather than a centralized wallet. This architectural design prevents exit scams since the marketplace never holds custody of user funds. If you accidentally overpay for an order, contact the vendor through encrypted messaging - they can issue partial refunds through the escrow system. Never send more Monero than required to avoid overpayment complications.

The only trustworthy verification method is PGP signature checking. Download DrugHub's official public key from Dread forum, import it into your GPG keyring, then verify signatures on mirror lists posted by administrators. Phishing sites can perfectly clone appearance but cannot forge valid PGP signatures. Warning signs of phishing include: sites requesting Bitcoin payments (DrugHub is Monero-only), login pages asking for passwords (DrugHub uses PGP authentication only), different color schemes (official uses orange #ff6b00), and urgent messages about account suspension. When in doubt, reverify signatures on Dread.

DrugHub collects minimal data by design. No IP addresses logged (impossible since users access through Tor), no email addresses collected, no phone numbers requested. PGP public keys and usernames represent the only persistent identity markers. Messages auto-delete after 90 days. Order histories retain transaction hashes but not detailed content after completion. Shipping addresses are encrypted with vendor PGP keys before submission - DrugHub administrators cannot decrypt them. This data minimization approach reduces exposure if servers are ever seized.

No, VPNs provide no additional security when properly using Tor Browser. "VPN over Tor" or "Tor over VPN" configurations add complexity without meaningful privacy improvement and may reduce anonymity if misconfigured. Tor Browser alone provides sufficient protection when used correctly (Safest security level, no browser modifications, no personal account logins). VPNs introduce trust dependencies on VPN providers who can log connections. Focus on proper Tor usage, PGP encryption, and OPSEC fundamentals rather than adding VPN layers.

DrugHub stores minimal data to share. No IP addresses exist to provide. PGP public keys and usernames are public by nature. Messages use end-to-end encryption where only sender and recipient can decrypt content - server seizure provides only encrypted message blobs. Shipping addresses are encrypted with vendor keys before submission - DrugHub cannot decrypt them. Monero transaction hashes are visible but blockchain analysis is cryptographically impossible due to ring signatures and stealth addresses. The architecture limits what law enforcement could extract even with complete server access.

DrugHub uses 2-of-3 multisignature escrow with three keypairs: buyer, vendor, and marketplace. Two signatures are required to move funds. When you finalize delivery, your signature + marketplace signature releases funds to vendor. If disputes arise, marketplace reviews evidence and adds signature to either refund you or pay vendor. No single party can steal escrow unilaterally. The walletless system means funds go directly to per-transaction addresses rather than a marketplace hot wallet, making exit scams architecturally impossible.

First, wait for the full escrow period to expire (7-21 days depending on product category). International shipping often takes 14-21 days. If packages don't arrive within 3 days after escrow expiration, open a dispute through your order history page. Provide evidence: order details, communication with vendor, expected delivery timeframe. DrugHub moderators review all disputes impartially within 3-7 days. Never finalize transactions before receiving your order. Opening false disputes (claiming non-delivery after receiving packages) results in account bans.

Cancellation depends on vendor cooperation and order status. If vendors haven't marked orders as "Shipped", you can request cancellation through encrypted messaging. Many vendors accommodate early cancellations, but they're not obligated to accept. Once shipped, cancellation becomes impossible - packages are already in transit. Some vendors charge restocking fees for cancellations even if unshipped. Never finalize orders hoping for refunds later - escrow release is permanent. Read vendor policies before ordering to understand cancellation terms.

The Lab Verification Program is DrugHub's flagship innovation. Independent third-party laboratories test vendor products for purity, potency, contaminants, and accurate weight. Over 90% of listings carry verification badges (Gold/Silver/Bronze based on test results). Vendors submit samples regularly - monthly audits ensure standards remain high. Lab verified products cost slightly more but dramatically reduce risk of receiving mislabeled, contaminated, or misdosed items. Use Lab Verification filters when searching to show only independently tested products.

Check vendor profiles for transaction history, ratings, and reviews. Focus on vendors with hundreds of successful sales and ratings above 4.5 stars. Read recent reviews (last 30 days) rather than relying solely on overall statistics. Look for patterns in negative reviews - isolated issues happen, but repeated complaints about communication, shipping delays, or product quality indicate vendors to avoid. Lab Verification badges show vendors submit to independent testing. New vendors with $1000 security deposits can be reliable, but established vendors provide more certainty.

Yes, DrugHub works on mobile devices through Tor Browser (available for Android; iOS users need Onion Browser). The interface is fully responsive and adapts to small screens without losing functionality. Mobile access includes all features: browsing, purchasing, messaging, PGP encryption/decryption. However, mobile devices present additional security risks - use dedicated devices when possible, never mix darknet and clearnet activities on the same device, and clear all data after each session. Many users conduct full transactions exclusively from mobile devices.

Buyers pay no direct marketplace fees - escrow service is included in listed prices. Vendors pay 2-5% commission per sale (varies by category and volume). New vendors pay a $1000 refundable security deposit OR prove 250+ successful sales from other established marketplaces. Vendor bond deposits are fully refundable after 6 months of successful trading with positive ratings. Network transaction fees (Monero blockchain fees) apply to all cryptocurrency movements - typically $0.01-0.10 per transaction. No hidden fees exist beyond these transparent charges.

Shipping times vary dramatically by vendor location, destination, and shipping method. Domestic orders typically arrive in 3-7 days. International orders take 14-21 days on average, sometimes longer during customs delays or postal disruptions. Vendors specify expected shipping times on product listings - read carefully before ordering. Escrow periods accommodate shipping times (7 days digital, 14 days domestic, 21 days international). Track order status through vendor updates: Processing → Shipped → In Transit. Never finalize until packages arrive and contents are verified.