Frequently Asked Questions

The "Captcha Loop" is a common issue caused by Tor network latency or incorrect browser settings. Drughub uses a custom DDoS protection gate that requires precise session handling.

Troubleshooting Steps:

• Ensure your "Security Level" in Tor Browser is set to "Safest". While this disables JS, our captcha is CSS-based and works best without scripts.
• Check your system clock. If your time is off by more than 30 seconds, the cryptographic handshake will fail.
• Click "New Tor Circuit for this Site" in the browser menu (Hamburger icon).
• If the issue persists, the specific mirror might be under heavy load. Visit our Mirrors Page to try a different entry node.

Determining the difference between a network outage and a phishing attack is critical for asset protection.

If you see a "Connection Timed Out" error, the site is likely under DDoS attack. However, if the site loads but your login credentials "fail" repeatedly, you are likely on a Phishing Site. These clones record your password and then simulate a login failure.

ALWAYS verify the PGP signature of the landing page before entering credentials. If you logged into a phishing link, assume your account is compromised immediately.

Technically, yes. Practically, it is not recommended for high-value operations.

Android: The official Tor Browser for Android is relatively safe, but mobile keyboards often have "predictive text" features that log your keystrokes. This creates a data trail on your device.

iOS: Apple's restrictions force "Onion Browser" to use the WebKit engine, which leaks more data than the Gecko engine used on desktop. For browsing, mobile is acceptable. For ordering, always use Tails OS on a laptop.

Monero deposits on Drughub are not instant; they require 10 confirmations on the blockchain to prevent "double-spend" attacks. This typically takes 20-30 minutes, but can take longer during network congestion.

If it has been over 2 hours:

1. Check a block explorer (like XMRChain) to see if your transaction has actually been confirmed.
2. Verify you are on the correct onion URL. Phishing sites will generate a deposit address that belongs to the attacker, not your account. If you deposited to a phishing link, the funds are lost forever.
3. If the URL is correct and confirmations exist, the market daemon might be stuck scanning blocks. Open a support ticket titled "Missing Deposit" and include the Transaction ID (TXID) and the internal address you sent to.

Drughub phased out Bitcoin support in 2023. Bitcoin is a transparent ledger. Companies like Chainalysis and Elliptic have developed sophisticated heuristics to trace BTC from darknet markets back to KYC exchanges (like Coinbase or Binance).

Using Bitcoin endangers both the vendor and the buyer. Monero (XMR) is the only currency that offers mathematical privacy via Ring Signatures and Stealth Addresses. We will not compromise user security for convenience.

When you withdraw funds from the market to your personal wallet, a dynamic network fee is deducted + a flat market fee.

The current market fee is approximately 0.005 XMR. This fee covers the cost of "churning" (mixing) the coins one last time before they leave our hot wallet, ensuring that the withdrawal cannot be easily linked to other market activities.

FE (Finalize Early) means you release the funds to the vendor before you receive the product. This bypasses the Escrow protection.

WARNING: Only FE for vendors you trust implicitly or those with "Verified FE" status. If you FE and the vendor scams you (exit scam), the market staff CANNOT recover your funds.

This is standard practice for unregistered mail (Snail Mail). Tracking numbers are a security risk; they are recorded in cleartext databases by postal services and can be used to correlate drop locations.

Most darknet orders are sent without tracking to maintain "plausible deniability." If a package is intercepted, there is no digital link proving you tracked it. Be patient. Domestic mail can take 3-10 days; international can take 14-30 days.

Disputes are judged by moderators based on facts, not emotions. To maximize your chances:

• Communication: Always message the vendor first before disputing. Moderators check chat logs.
• Auto-Finalize Timer: Extend the timer if shipping is slow. Do not let it auto-finalize.
• Evidence: Since you likely don't have tracking, your reputation (buyer stats) vs. the vendor's reputation is key. If a vendor has 500 sales and 0 disputes, and you are a new account claiming "nothing arrived," the odds are against you.
• Politeness: Abusive language towards mods or vendors usually results in the dispute being closed against you.

No. This is by design. If admins could reset PGP keys, then admins could be coerced by law enforcement to hijack accounts.

Your PGP key is the only proof of ownership. If you lose access to it, your account is dead. Any funds in the wallet are burned. You must create a new account. We strongly recommend backing up your private key to an encrypted USB drive (not cloud storage).

To verify that a message (like a deposit address) truly came from Drughub:

1. Import the Drughub Public Key into your keyring (Kleopatra/GPG).
2. Copy the entire text block including -----BEGIN PGP SIGNED MESSAGE----- and the signature.
3. Use the "Decrypt/Verify" function in your software.
4. Look for the green bar or "Good Signature" status. If it says "Bad Signature," the text has been tampered with.