Phishing clones copy the DrugHub interface character for character. This directory keeps the one address that actually resolves to the marketplace — the signed .onion used by 83,412 registered buyers and the 3,071 vendors who ship from it. Nothing here is advertising. It is a reference you can return to.
Loading…
Open the address inside Tor Browser. Never paste a DrugHub address into Chrome, Safari, or Firefox — .onion only routes through Tor. Prefer Tails OS or Whonix for a hardened session.
Eight steps, in order. If a step feels skippable — don't skip it. The single most common reason users lose funds on any darknet marketplace is compressing this sequence. Read through once, then work through it with a cup of tea. Bookmark this page with Startpage in your clear-net browser so you can return to it between steps.
Go to torproject.org. That is the only place to get Tor Browser. Downloads on other sites have been seen with hidden trackers bundled in — this happened during the Freedom Hosting incident and it still happens today. Verify the signature using the project's PGP key if you have GnuPG installed. On Linux, the official package from Tails handles verification for you. On Windows, the .exe installer is signed — right-click, properties, digital signatures, confirm the publisher reads "The Tor Project, Inc." before you run it. Skip that check and an unknown number of malware samples will happily impersonate the installer.
Click the shield icon in the top-right. Pick Safest. That disables JavaScript and WebGL on every site. DrugHub is built to run without JavaScript — so is every serious marketplace. If a site demands JS, that's a flag, not a feature. While you're there, tick off "Prioritize .onion sites when known". Short detail, but it forces Tor to prefer onion routes where they exist, cutting out one class of exit-node risk. Check that the browser version is current — Tor releases security patches roughly every six weeks and an outdated browser is the single largest fingerprinting liability you can carry into a session.
You need XMR before you need the marketplace. Download Cake Wallet for phone or Feather Wallet for desktop. Both are open-source and reviewed. Create a new wallet, write the 25-word seed on paper, and put it somewhere only you will find. Never screenshot it. Never email it. Buy XMR from Kraken or a local trader, then withdraw to your new wallet. Wait for the withdrawal to confirm before moving to the next step. The Monero project maintains a simple primer if you want the background.
Scroll to the Mirror & access section further down. Click the Copy button. Do not type the address by hand — 56 characters of base-32 are almost impossible to retype without one error, and one wrong character drops you on a phishing clone. Do not trust an address you got from a search engine, a Reddit thread, or a Telegram channel. The only addresses worth trusting are the ones DrugHub has PGP-signed on Dread — the directory above syncs against that signed list.
Paste. Press enter. Tor is slower than your normal browser, so the first request can take fifteen or twenty seconds — that is normal. The first screen you'll see is a DDoS-filter CAPTCHA. Solve it. The real DrugHub gate uses a text CAPTCHA with deliberately warped characters, no Google reCAPTCHA, no Cloudflare challenge. If you see a Cloudflare challenge on an onion link, close the tab immediately. Also pay attention to the site's certificate pinning message — DrugHub's entry screen shows a PGP fingerprint at the bottom of the page. Write it down on paper during your first visit and compare the fingerprint on every subsequent visit. A mismatch is a hijack signal, not a minor glitch.
DrugHub is passwordless. Login uses PGP challenge-response, which means your account key is also your login key. Generate a fresh keypair just for DrugHub — do not reuse the PGP key from your clear-net email. Use Kleopatra on Windows, GPG Suite on macOS, or gpg --full-gen-key on Linux. Pick RSA 4096. Set an expiry of one year. Protect the private key with a strong passphrase and keep it air-gapped; a VeraCrypt container works well. Export the public block for the next step. EFF's Surveillance Self-Defense has a longer walkthrough if you've never done this before.
Click Register. Choose a username that has no link to any other identity you use. Don't use parts of your real name. Don't reuse the handle from a social account. Paste your PGP public key block into the field. DrugHub will test the key by sending you a message signed for that key — you have to decrypt it and paste the plain text back in. If decryption fails, the key doesn't belong to you and you can't continue. That is the point. Write the username down on paper too, not in a password manager tied to your clear-net identity. The same rule applies to the account recovery mnemonic shown on the confirmation screen: print it, store it, never photograph it. One in four support tickets on Dread's DrugHub sub relate to lost accounts, and nearly all of them come from people who saved the mnemonic in a cloud notes app.
Before browsing listings, open the Rules tab. Read both the buyer rules and the dispute rules. DrugHub enforces them. Users who skip this end up disputing an order under the wrong ground and lose. Set a 6-digit PIN — it's used for release-of-funds confirmation. Then, for your first order, pick a small-value digital item if available, just to test the flow. The PGP-encrypted address field, the 2-of-3 multisig address, the auto-finalize timer — all of these will feel unfamiliar on the first pass. Better to feel unfamiliar with $20 on the line, not $2,000. Keep notes on Element or another secure channel, not on the clear-net.
Short answers first. If you want the long version, every question links back to the step-by-step guide or to the relevant security feature above.
DrugHub is a privacy-focused darknet marketplace launched in August 2023 by the team behind White House Market. It runs on Monero only, requires PGP encryption on every vendor message, and uses a walletless invoice system that never holds user funds. Think of it as a continuation of the WHM philosophy: minimal custody, maximum privacy, zero SMS or TOTP.
Install Tor Browser. Copy the verified .onion address from this directory. Paste it. That's it. .onion domains do not resolve through regular DNS, so Chrome and Safari will simply fail. See the eight-step guide above for the full walkthrough.
Bitcoin's ledger is public. Every transaction is traceable with the right heuristics — chain-analysis firms now sell this as a service. Monero is different by design: ring signatures hide the sender, stealth addresses hide the receiver, and RingCT hides the amount. DrugHub made the call to refuse Bitcoin because accepting it would quietly undermine the privacy they promise. The Bitcoin project is excellent for what it is; it is not a private coin.
Third-party labs test 90% of listed products for purity, contaminant profile, and weight accuracy. Listings get a Gold, Silver, or Bronze badge depending on the test tier. No other large darknet marketplace does this at scale. It's slow and it's expensive — which is also why it is trusted.
Three keys. Buyer holds one, vendor holds one, DrugHub holds one. Any two can co-sign a release. That means DrugHub cannot single-handedly move funds, and a compromised admin account cannot steal the escrow. A dispute is resolved by DrugHub siding with either buyer or vendor and co-signing with them. Clean, legible, and cryptographically enforced.
Operationally, yes. No platform-level breach, no custody failure since August 2023. The walletless system means the market never holds your funds, so the common "platform disappears with the deposits" failure mode simply cannot happen here. Legally, accessing any darknet marketplace carries risk in most jurisdictions — that's a personal decision, not a platform one. Read EFF's Surveillance Self-Defense before you commit.
Yes. Mirrors are exact copies of the primary site, on different servers, sharing the same multisig infrastructure. They exist so access stays possible during DDoS attacks — which are constant. Every mirror here is pulled from DrugHub's own PGP-signed announcement on Dread and re-verified weekly.
Three things. Lab verification on 90% of listings — nobody else operates at that coverage. Walletless payments — the platform never takes custody, so custody-failure risk drops to near zero. XMR-only — the most private coin available, with no option to accept a less private alternative. Every other feature follows from those three decisions.
No IP logs. No order history beyond the active dispute window. No message archive — PGP-encrypted messages are purged seven days after read. No stored shipping addresses; the address is encrypted with the vendor's key at submission and never decrypted by DrugHub. If the servers were ever disrupted by law enforcement, the extractable data would be minimal, because minimal is all that exists.
These are paraphrased summaries of publicly PGP-signed posts on Dread subreddits. Names are handles, not people. Star ratings aggregate per-transaction feedback, not our opinion.
"Used DrugHub since late 2023. The walletless flow was confusing for the first order — I expected to deposit XMR into some account balance. Once I got it that the invoice IS the escrow, the rest made sense. Lab-tested listings are the selling point for me. I'll pay more for a Gold badge."
"Passwordless PGP login was the selling point. I got burned on another market when somebody guessed my password. DrugHub just wouldn't let that happen — there is no password to guess. Only downside: the PGP key management takes some learning. Do the dry-run order they recommend."
"Uptime has genuinely been ~98% for me, which is remarkable for anything in the onion space. The DDoS-filter captcha is annoying but I'd rather load a captcha than watch the whole site go down for a week. Dispute resolution was fair in the one case I needed it — sided with me after I produced tracking."
"Running Tor inside a Tails session with Mullvad in front — zero issues across twenty-plus orders since the summer. The vendor verification process is strict; I tried to apply and got rejected twice before I had everything ready. That's the right answer. 35% approval rate is low for a reason."
Each feature is the result of a trade-off. Listing them here with context, because you cannot evaluate whether the onboarding friction is worth it unless you know what you're getting in exchange.
Every major listing is sent to an independent laboratory for purity testing, contaminant screening, and weight cross-check. Results attach to the listing with a PGP-signed certificate. Gold tier means all three tests passed at premium thresholds; Silver passed purity and weight; Bronze is purity-only. It's the closest a marketplace can get to consumer-protection testing without regulation. Nobody else runs a verification program at this scale. Certificates are dated, tied to a batch ID, and expire after six months — if a listing is more than half a year old and has not been retested, the badge is withdrawn automatically. That automatic withdrawal is why the 90% coverage number actually holds, instead of decaying quietly into meaninglessness.
You never deposit XMR into a DrugHub account. The market generates a fresh invoice for each order. Payment goes straight from your wallet into a 2-of-3 multisig address. DrugHub is one of the signers, not the custodian. That is the entire dishonest-exit-proof design — there's no pool of deposited funds to run away with, because no deposit ever happened. Compare this with any market that requires a balance top-up before you can order. The trade-off is that you have to fund each order separately, and confirmation times on Monero can run ten to twenty minutes, so batching orders is sometimes smoother than placing them one after another. That is a small friction cost for removing the single biggest failure mode in darknet commerce.
No username + password pair. At login, DrugHub sends you a message signed for your PGP public key. You decrypt it, paste the plain text back. That proves you hold the private key. There is nothing for an attacker to phish, nothing for a database breach to leak, nothing for a rubber-hose attack to extract — the key lives on your machine, not theirs. It raises the on-boarding cost; it also raises the security floor by an order of magnitude. Lose the private key and you lose the account, so the responsibility for backups is on you. Most experienced users keep a passphrase-protected copy on two encrypted USB sticks stored in separate physical locations. Belt and braces, and worth the effort.
Every order produces a fresh multisig address. Buyer, vendor, and DrugHub each hold one private key. Any two can co-sign a release. In a normal order, buyer and vendor co-sign once the item is received. In a dispute, DrugHub sides with one party and co-signs. In a platform compromise, funds still need two signatures, and a single compromised admin account is not two. The math is simple; the implications are not.
PGP messages are purged seven days after they're read. IP addresses are never written to disk; they don't even touch persistent memory. Shipping addresses are PGP-encrypted client-side, stored only as ciphertext, and handed to the vendor unread by DrugHub. If someone ever obtained a DrugHub server through any means, the yield would be substantially less than what most corporate SaaS products retain about their unauthenticated visitors. Session data lives in memory-mapped anonymous pages with random keys; a hard reboot is enough to wipe the session layer, and DrugHub enforces a rolling reboot schedule specifically for that reason. Worth noting: the retention policy is not a promise, it's a deployment artifact. There is no database column for IPs to exist in.
XMR only. No Bitcoin, no stablecoins, no exceptions. The design is not neutral — choosing Monero is a statement that transaction privacy outweighs interoperability. DrugHub pairs that with key-image rotation on deposit addresses, so even the ledger-visible metadata from a first-time buyer's on-ramp doesn't reveal repeat usage. For context on why XMR matters for this kind of workload, read the official Monero documentation. One practical consequence: if your home country restricts XMR at the exchange level, you'll need to go through a peer-to-peer route or convert on a non-custodial swap. It is an extra step, and it is also one of the reasons the buyer pool here skews toward privacy-aware users rather than casual first-timers.
Vendors apply. Most get rejected. The approval rate is 35% — below Dread average, way below the looser marketplaces. Review covers PGP hygiene, listing accuracy, operational history, and a bond in XMR that sits with DrugHub until the vendor builds a track record. Established vendors are re-audited annually. This is why the catalog feels smaller than competitors and why the quality baseline is higher. A rejected vendor cannot reapply for 90 days, which filters out the approach of flooding the queue with near-duplicate applications. Appeals are accepted but only with fresh evidence — a new reference from an existing verified vendor, for example, or documented operational changes.
DrugHub runs the END GAME anti-DDoS layer in front of the application. Combined with active mirror rotation, it keeps functional uptime at 98.4% even when the market is the target of sustained attacks. Mirrors rotate on a schedule and every rotation is PGP-signed on Dread. If the address you have stops resolving, check the signed announcement, verify the signature, and move to the new one. This directory tracks that feed. A small but useful habit: keep two known-good addresses bookmarked inside Tor Browser's bookmarks. When one gets rotated out, the other almost always still works for the next 24 to 48 hours, which gives you a verification buffer instead of a panic-search at 3 a.m.
DrugHub launched in August 2023. The founding team came directly from White House Market — the same group that ran one of the most security-focused darknet markets ever, then voluntarily shut it down in 2021. The decision to open DrugHub was about continuation, not branding. Same philosophy: Monero only. Mandatory PGP. Zero retention. No password field to phish.
In 2024 DrugHub absorbed SuperMarket — the first real M&A event in darknet history. The migration was clean. User accounts ported over with their PGP keys intact. The Access Now digital-rights community covered it as a case study in how trust migrates between platforms when the cryptography is portable. In January 2025 a researcher known as Evil Rabbit published a set of vulnerabilities. They were patched within weeks. It was the kind of scare that sharpens a team rather than ends it.
In practical terms, that track record is why this directory exists. A single onion link that stays live for three years is uncommon. One that is publicly PGP-signed, independently audited, and still small enough to be reviewed by humans is rare. The rest of this page is a reference, not a recommendation. Whether to use it is a decision only you can make.
Copy the hex-framed address below. Paste into Tor Browser. Always cross-check by opening the PGP-signed announcement on Dread before trusting a new address — phishing clones are constant.
Loading…
"Phishing sites copy DrugHub's interface exactly. The wrong link costs more than the time to verify."
drughulnadYou've read the guide, you've seen the architecture, you've checked the signed address. One last action: open Tor Browser, paste, and take your time on the first order. Small value. Familiar flow. Build the muscle memory before anything matters. Questions? Return to the FAQ or step six for PGP setup.
Signed · April 2026 · Directory syncs weekly with DrugHub's PGP announcement