What is a darknet market, and how does one actually work? (2026)

Strip away the setting and a darknet market is an old idea in an unusual place: two strangers want to trade, neither trusts the other, and there is no authority standing behind the deal. On the ordinary web a card network and a bank quietly play referee, ready to claw money back if a sale goes wrong. Here there is no referee, so the market builds one into the middle of every transaction and calls it escrow. Almost everything else about how these places behave follows from that single missing piece of trust.

What a darknet market is

A darknet market is a website reached through an onion address rather than the ordinary web. It lists sellers and their goods, takes payment in cryptocurrency such as Bitcoin or Monero, and holds that payment while a deal plays out. The market is not usually the seller. It is closer to a venue that rents space to many vendors and provides the plumbing, including the escrow, the messaging and the dispute process. That distinction matters, because a market can be reachable and still be full of vendors you should avoid.

How a sale is meant to work

In the intended path, a buyer funds an order and the market holds the coins rather than passing them straight to the vendor. The vendor sees the order is funded and ships. When the buyer confirms they received what they paid for, the market releases the escrow to the vendor. If something goes wrong, a dispute opens instead, and a member of staff weighs both sides before deciding where the money goes. The escrow is the whole reason a stranger will ship to another stranger.

The parts a market is assembled from

A darknet market is easier to reason about once you stop treating it as a single mysterious thing and start seeing the components. Most of them are unremarkable pieces of ordinary web software; what makes the combination unusual is who is running it and what happens when they stop.

An account layer with no recovery path

Registration typically wants nothing but a username and a password — no email, no phone, no identity. That is the point, and it has a consequence people meet the hard way: with no contact address on file, there is usually no password reset. Some services hand out a recovery phrase at signup and expect you to keep it. Others simply have no path back into a locked account at all.

Vendor accounts, usually behind a bond

Selling generally requires a separate kind of account, and it is common for it to cost something up front. That fee is not primarily revenue; it is friction. A bond means an account is not free to create, which raises the cost of spinning up a fresh identity every time an old one accumulates complaints. It works in the sense that it slows churn, and it is not a guarantee of anything, because a bond is a cost of doing business for anyone whose plan is large enough.

Listings, feedback and a reputation system

Listings are pages, and feedback is a database of ratings tied to completed orders. It is worth being clear-eyed about what those numbers are. Every one of them lives inside the market's own system, is calculated by the market's own code, and is visible to you only as the market chooses to display it. There is no external auditor and no way to reconstruct the history from outside. That does not make feedback useless — a long, consistent record is genuinely harder to fake than a short one — but it does mean reputation is a claim by the operator, not an independent fact you have checked.

A wallet system and a ledger

Somewhere behind the interface is a set of cryptocurrency wallets and a ledger tracking what each account is owed. That ledger is a number in a database. It is not, in most designs, coins segregated per user, and the difference between "my balance says four" and "four is set aside for me" is the entire subject of the section below.

A dispute queue staffed by people

When a deal fails, somebody has to decide. That somebody is a staff member of the market, applying whatever policy the market has, with no appeal beyond them. The quality of this function varies enormously and is one of the few things that becomes visible over time, because a market that stops resolving disputes is exposing something about its condition it cannot easily hide.

Mirrors, and why there are so many

Onion services get overwhelmed, whether by traffic or deliberately, so most markets publish several addresses that reach the same system. This is operationally sensible and it is also the single largest source of danger for a visitor, because "here is another address that also works" is exactly the shape of the sentence an attacker needs you to accept. Every mirror is another address that has to be verified, not a convenience that lets you skip verifying.

Escrow, disputes and finalising

Three words come up constantly, and they are worth pinning down. Escrow is money held by the market until a deal is confirmed. A dispute is what you open when it is not, so a third party can decide. Finalising early means telling the market to release the escrow before you have confirmed receipt, usually because a vendor asks. The moment you finalise early, your protection is gone.

Where the money physically sits

The table above describes three arrangements in terms of protection. It is worth going one level down, into where the coins actually are under each one, because that is what determines what happens on the day something goes wrong — and the answer is frequently not what the interface implies.

The deposit-wallet model

The most common arrangement asks you to send funds to an address the market gives you, after which a number appears next to your account name. From that moment the coins are in the market's control and your balance is a row in the market's database. Nothing separates your funds from anyone else's, and nothing prevents the operator from moving all of it at once. This is not a hidden flaw; it is how the design works, and it is why the standing advice is never to hold a balance you are not prepared to lose. A displayed balance is a promise, and its value is exactly the value of the promiser.

Direct payment per order

Some services skip the balance entirely and generate a payment address per order, so funds move once, at the moment of purchase. This narrows the window in which money is sitting somewhere you do not control, which is a real improvement over a standing balance. It does not remove the escrow question, because the funds still have to rest somewhere between payment and confirmation, and during that interval the same party is holding them.

Multisignature escrow, and why it is rarer than it should be

The arrangement with the best properties works like this. Three keys are created, one held by the buyer, one by the vendor, one by the market, and the funds are locked into an address that requires any two of the three signatures to move. In the normal case the buyer and vendor agree and sign; the market never touches it. In a dispute the market signs alongside whichever party it decides for. And in the case everyone worries about — the market disappearing — the buyer and vendor still hold two keys between them and can release the funds without it, which is the property that makes multisig structurally different from every other arrangement on this page.

Given that, the obvious question is why it is not universal. The honest answer is friction on all sides. It requires the buyer to handle keys and partially-signed transactions rather than clicking a button, it requires the vendor to participate in signing, and it requires the market to build and support something considerably more complex than a balance column. It also does not work identically across every currency. The result is that multisig is offered patchily, is often optional, and is frequently unused even where it is available, because the easy path is right there next to it.

Withdrawal is where the risk becomes visible

Balances go in easily and come out on the operator's terms. Delays, minimums, maintenance notices and quietly raised fees on withdrawal are the points where a gap between the ledger and the actual reserves would first show, which is why sustained trouble withdrawing is treated by experienced users as a more serious signal than almost anything else a market says about itself. It is not proof of anything on its own — genuine technical problems exist — but it is one of the few indicators that comes from behaviour rather than from claims.

Where the real risk sits

People picture the danger as hacking, and that is rarely the story. Two failures account for most of the loss. The first is the exit scam, where a market that has earned enough trust simply closes and keeps every coin sitting in escrow. The second is quieter and more common: you never reach the real market at all, because you followed a look-alike address into a copy built to take your deposit. The first risk is hard to see coming. The second is entirely preventable, and it is the one worth your attention.

Why exit scams are hard to predict in advance

A market planning to exit scam has every incentive to look normal right up until it happens — support tickets get answered, orders ship, disputes resolve, because appearing healthy maximizes the balance sitting in escrow when the operators disappear. There is no reliable early-warning sign visible from outside; this is exactly why the third safety habit above, never holding more than you can afford to lose, matters more than trying to predict timing.

Law enforcement seizure versus exit scam, from the outside

Both can look identical at first: the market goes offline without warning. A seizure sometimes leaves a banner on the seized infrastructure identifying the agency responsible; an exit scam usually leaves nothing, or a brief message blaming an unrelated technical issue. Neither distinction changes what you should have already done, which is keep verification and escrow discipline tight regardless of which outcome eventually explains an outage.

Why we describe them and do not rank them

You will find sites that rank markets like restaurants, complete with scores. We do not, and the reason is not coyness. A ranking reads as a recommendation, and recommending a place whose owners can vanish with the escrow overnight is a promise no one can honestly keep. What we can do is explain the mechanics, so you can judge a specific situation yourself, and point you at a signed source for the one fact that is checkable, which is the address.

Reaching one, and the one check that matters

If you do go further, the single habit that protects you is confirming the address against a signed source before anything moves. Here is the shape of a real market address, shown as text so you can see how much of it you have to compare:

Then run the full routine before you fund anything. Our torhaven guide on verifying an onion address before you deposit is the step-by-step version of that habit.

The account security you actually control

Almost everything discussed so far is outside your hands: whether the operator is honest, whether the escrow is real, whether the dispute queue gets staffed. The account layer is the part that is genuinely yours, and it is also the part most often handled carelessly because it feels like ordinary web signup.

1. Use a username that exists nowhere else. Handles are the cheapest way to link accounts across services, forums and old clearnet history, and the linking is done by anyone who cares to search, not by anything sophisticated. A username you have used before brings its whole history with it.
2. Use a password that exists nowhere else, generated rather than invented. Credential reuse is the mechanism behind a large share of account compromise everywhere on the internet, and here there is no support desk to help afterwards. A password manager solves this properly; a memorised pattern with a site name in it does not.
3. Write down the recovery phrase at the moment it is offered. If a service shows you a mnemonic at registration, that is very likely the only time you will ever see it, and it may be the only route back into the account. Treating that screen as a formality to click past is a decision you cannot revisit.
4. Turn on PGP two-factor authentication if it is available. It removes the case where a leaked or guessed password alone is enough. Understand what it does not do: a page sitting between you and the real service can relay a genuine login challenge to you and use your answer, so this protects the password, not the address. Verifying the address is still the thing that covers that.
5. Keep the login separate from everything else you do. Log in inside Tor Browser only, never through a clearnet convenience page offering the same thing, and do not carry a session across into other browsing.
6. Assume messages are readable unless you encrypted them. Built-in messaging runs on the operator's server. Where a conversation contains anything you would not want retained, encrypt it to the recipient's key yourself rather than relying on a claim that messages are deleted after some interval.

The uniting idea is that these are the controls that keep working regardless of what the operator turns out to be. Every other protection on this page depends on someone else behaving as advertised. A unique credential, a saved recovery phrase and an encrypted message do not.

How darknet markets end

Understanding how markets typically stop existing explains why the habits on this torhaven page — escrow, address verification, never over-committing to one platform — matter as much as they do.

Seizure

Law enforcement sometimes operates a seized market covertly for a period, quietly logging activity, before publicly replacing its pages with a takedown banner. A market that suddenly displays unfamiliar branding or an official-looking notice where the usual login sat is the visible endpoint of this process, though by the time it is visible the exposure may have already happened.

Exit scam

An exit scam is the operators freezing withdrawals and disappearing with escrow funds, no banner and no explanation — support simply stops responding. This is the single biggest argument for never treating a market as a place to store value; move funds through it for a transaction, not as a wallet.

Orderly shutdown or migration

Less dramatically, a market sometimes announces its own closure or a move to new infrastructure through its usual signed channel, giving users a window to withdraw. This is the one ending pattern that a verification habit actually helps you benefit from — a genuine, signed announcement is distinguishable from an opportunistic impostor claiming the same thing.

Signals worth more weight than they usually get

Why this torhaven guide comes right before the Torzon profile

torhaven put this torhaven page immediately before its Torzon profile for a specific reason: escrow, finalising and exit scams are abstract until you have a real name to test them against, and a torhaven profile that assumed you already understood escrow would have to re-explain half of itself. Read in order, this torhaven guide does the explaining once, and the profile that follows only has to apply it.

What this torhaven guide deliberately does not do

Notice that nothing above ranks a market or tells you which one to trust — that omission is not an oversight, it is torhaven's editorial policy in practice. torhaven describes mechanisms, not verdicts, because a mechanism (how escrow works, why finalising early is risky) stays true regardless of which market you eventually use, while a verdict about a specific market ages the moment its operators change behaviour.

How the earlier torhaven guides feed into this one

By the time you reach this torhaven page, you have ideally already read torhaven's guides on onion addresses and verifying one before you deposit — both assumed here rather than repeated, since this torhaven guide is about what happens after the address checks out, not the address check itself.

More torhaven guides

• Verify an onion address before you deposit
  The routine that stops the most preventable loss, the wrong address.
• What an onion address really is
  Why the address is the identity, and why a copy cannot fake it.
• Is Torzon legit? An honest read
  The same thinking applied to one name people search for.