WeTheNorth onion links
both mirrors

WeTheNorth mirrors are separate .onion addresses that connect to the same backend marketplace. Both carry identical user accounts, vendor listings, messages, active orders, and escrow balances. Running two mirrors means the market stays reachable when one node faces DDoS pressure or temporary network disruption.

Both addresses are authenticated via PGP-signed announcements from the WTN admin key published on Dread. This authentication is what separates a real mirror from a phishing clone — the signature cannot be forged without the private key. See the verification guide above for the full process.

Redundancy. Darknet markets face regular denial-of-service attacks from competitors, researchers, and occasionally law enforcement probing infrastructure. A single-mirror market goes completely dark under that pressure. Two mirrors on independent infrastructure mean one node absorbing an attack does not block access — buyers and vendors switch to the second address and continue without interruption.

WTN adopted the two-mirror architecture in mid-2022 after a sustained DDoS event caused several days of downtime on the original single-node setup. The Dread community documented the outage in real time. The admin posted the rationale for adding a second mirror in the thread that followed. Both addresses have been stable since then, maintained under the same PGP-signed announcement protocol. More on this is documented on Archive.org from Dread thread snapshots.

Three methods. Most reliable: compare character by character against the PGP-signed announcement from the WTN admin key on Dread's /d/WeTheNorth subdread. The signature covers the full .onion address string. Any modification — even one character — breaks the signature and shows an error in GnuPG.

Second-most reliable: use the links on this page, cross-referenced against that same signed announcement. We check addresses against the Dread thread each time we update this page. Third: look at the Dread thread history for any admin-posted updates or corrections. Never trust an address posted in a comment, a DM, or a search engine result you did not intentionally seek out from a known source.

Switch to the second mirror. Backend state — your account, active orders, escrow balances, messages with vendors — is synced server-side across both mirrors. Nothing is lost. The switch takes under a minute: copy the alternate address from this page, paste into Tor Browser, log in with your usual credentials.

If both mirrors are unreachable simultaneously, the most common cause is a large-scale DDoS event or planned maintenance. Check the Dread /d/WeTheNorth board for admin status updates — these events typically resolve within a few hours. Do not attempt to find alternative addresses through search engines during an outage. This is exactly when phishing sites spike in search visibility, because high-urgency users are less cautious. Wait for an official update.

Rarely. The two current mirror addresses have been stable for over two years without change. Address rotations happen when an operator migrates to new hardware, following a security event, or proactively as a precautionary measure after extended operation.

When addresses do change, the WTN admin posts a PGP-signed announcement on Dread before the old addresses go dark — typically 48 to 72 hours in advance. This gives users time to update any saved references. Bookmark this page and check before each session during any period when you've heard the market is rotating infrastructure. The page updates within hours of any official announcement.

Saving a .onion address as a Tor Browser bookmark is safer than retyping 56 characters each session. But it carries two risks. First: anyone with physical or forensic access to the device can see the bookmark in the Tor Browser profile directory. Second: the bookmark goes stale if the .onion address rotates while you are away.

The better operational habit: bookmark this clearnet directory (wtnmarket.top/urls/) in your normal browser, then copy a fresh .onion address each session before opening Tor Browser. That approach keeps no Tor-identifiable bookmarks on the device and always pulls a current, verified address. Tails OS and Whonix both handle bookmark persistence in a way that reduces this exposure for users with higher threat models.

The uptime percentage is the share of time a mirror was reachable during the previous 12 rolling months, based on periodic connectivity checks against the .onion address. A reading of 96.4% means roughly 13 days of cumulative downtime across the year — almost all attributable to DDoS events rather than infrastructure failure.

For a darknet market, anything above 95% sustained over 12 months is considered stable. Markets that fall below 90% typically face questions from the Dread community about operational reliability. Both WTN mirrors have stayed above 95% since the two-mirror architecture was adopted in 2022, confirming that the redundancy design achieved its intended effect on availability. Compare this to the single-node period before 2022, when downtime peaked at several days per incident.

A .onion v3 address is a 56-character base32 encoding derived from the hidden service's Ed25519 public key. There is no DNS lookup involved, no domain registrar, and no certificate authority. The address is the cryptographic identity of the service. Tor Browser verifies this identity automatically on connection — no SSL warning, no certificate to inspect.

This design means the address cannot be subject to law enforcement action by targeting a registrar or a DNS record. It also means phishing operators generate convincing near-matches by brute-forcing strings with matching first and last character blocks. The middle 46 characters get substituted. To the eye at normal reading speed, the address looks correct. Always verify the full 56 characters systematically, not just the beginning and end.

Three compounding factors. WeTheNorth is the only significant Canadian-focused darknet market — the buyer base is geographically concentrated and uses predictable search patterns, making targeting more cost-effective than targeting the dispersed users of a global market. Canadian buyers share a narrow set of search terms in Bing and DuckDuckGo, making search-engine-optimized phishing pages straightforward to deploy.

Second, the WTN deposit flow creates a compact, high-value exploitation window. A buyer who deposits BTC or XMR to a phishing clone's wallet loses the full deposit amount before realizing the address was wrong — typically within an hour of landing. The attacker collects and the phishing site rotates to a new address before reports reach any moderation channel.

Third, first-time buyers account for a disproportionate share of phishing victims. Experienced users have verified addresses and established copy habits. Newcomers searching for an onion link for the first time are at highest risk. The EFF's privacy guide and Access Now both document the targeting patterns used against concentrated digital communities. The copy-button approach on this page defeats character-substitution attacks outright — no user intervention required beyond a single click.