operational · last checked 21 apr 2026
Verified drughub market link directory. No ads, no affiliate redirects, no phishing mirrors. Just the real onion address, PGP-signed by the market team, checked every forty-eight hours.
Loading...
Phishing sites copy this interface exactly. Check every character before you enter.
This portal exists for one reason. Finding the genuine drughub market link through a search engine is a coin flip — the top results are almost always phishing clones dressed up to look identical to the real thing. A wrong character in the onion address sends a Monero payment to a server that is not drughub. We publish the verified address, the mirror, the PGP fingerprint, and the timestamp of the last check. That is everything you need, nothing you do not.
Drughub is a Monero-only marketplace. It launched in August 2023 under the administration that previously ran White House Market. It requires PGP encryption for all communication, uses passwordless login tied to a 4096-bit key, and routes every payment through a 2-of-3 multisig escrow so the platform never touches buyer funds. Read the background if you want the full history. Use the access manual if you want the practical walkthrough.
quick answers
Short, honest answers. Read this before copying any link. Most mistakes happen at the beginning — people skip the access manual, type a drughub onion link by hand, or send Bitcoin thinking any privacy coin works the same. Nine common questions, eight hundred words of practical answers.
Drughub is a privacy-focused darknet marketplace. It launched in August 2023 and is operated by the same administrators who ran White House Market, one of the most security-first platforms in darknet history. Drughub inherits that philosophy — mandatory PGP, Monero-only payments, and a walletless invoice system where the market never holds user funds. The Tor Project is the only way to reach a drughub market link, and the platform deliberately runs without JavaScript so it loads well inside Tor Browser on the Safest setting.
The same team introduced the Lab Verification Program in late 2023 — the first sustained third-party testing operation on any darknet marketplace. By 2025 the program covered 90% of listings. Ownership has not changed hands since launch, and the administration uses the same long-lived PGP signing key for every announcement. That signing key is the anchor for every drughub market link in this directory.
Three rules. First: copy the onion address from a source that is PGP-signed by the drughub team — never type it by hand. Second: open it only inside Tor Browser. Third: verify the address character by character. The last six characters are a cryptographic checksum, so a single wrong letter lands you on a different server. If the lower-right footer of the site you reach does not show a signed fingerprint matching the one in our verified urls directory, close the tab immediately.
A simple habit that saves most people from phishing: after copying the drughub market link from this page, visually compare the first six and last six characters on screen against the copy-pasted value in your URL bar. Never trust a middle match only — phishers specifically craft vanity addresses that begin with the same letters as the real site. The last six are the cryptographic signature; they are what you check. If those do not match, the whole thing is fake.
Bitcoin sits on a public ledger. Anyone can look up an address and see its history. Monero, by contrast, hides sender, receiver, and amount by default through ring signatures, stealth addresses, and RingCT. There is no way to send Bitcoin to a drughub order — the platform will simply not accept it. New buyers get Monero on a reputable exchange and withdraw to a self-custody wallet like Cake Wallet or Feather Wallet before placing any order. Exchanges that delist XMR are listed in the getting started guide.
Drughub arranges third-party laboratories to test 90% of listings for purity, contaminants, and weight accuracy. Verified products receive a public badge — Gold for the full test battery, Silver for standard verification, Bronze for basic purity. Buyers can filter by badge tier, and vendors who repeatedly fail a retest lose their verification status publicly. It is the only darknet marketplace with this kind of independent testing layer, and the results are published on the product page where anyone can read them.
Most markets collapse because the admins walk off with everyone's wallet balance. Drughub never creates that balance. When you place an order, the platform generates a unique encrypted invoice. Your Monero wallet pays directly into a 2-of-3 multisig escrow — you, the vendor, and drughub each hold one key. Two keys are needed to release funds. Even if administrators wanted to steal, they could not do it alone. The market earns a fee only when escrow releases on delivery.
In practice, this changes buyer psychology. On a traditional market, every hour your balance sits in the platform wallet is an hour of risk. On drughub, you fund a single order for a single vendor and release on receipt. If the platform vanishes mid-order, the multisig contract is still live on the Monero chain and the remaining two keys can recover funds. This is not theoretical — the walletless architecture has already survived two major DDoS events without anyone losing a coin.
Yes. A mirror is an exact copy of the primary site running on a different server. Mirrors exist because large darknet marketplaces absorb constant DDoS attacks — from competitors, from scam extortion rings, and occasionally from researchers probing infrastructure. When the primary drughub market link is saturated, one of the mirrors absorbs traffic. Every mirror on this page is PGP-signed by the market team on Dread before it goes public. Bookmark more than one.
There is no password field on drughub. During registration you upload a 4096-bit PGP public key. When you log in, the server encrypts a challenge string with your public key and asks you to decrypt it locally with your private key. If you succeed, access is granted. If the server is ever breached, attackers find a list of public keys — useless on their own. GnuPG and KeePassXC are the tools most buyers use to generate and store those keys in cold storage.
Monero transactions are unlinkable and amount-hidden. Tor obscures your network location. Drughub stores no retention logs. In theory, the technology stack gives strong privacy guarantees. In practice, OPSEC mistakes are where people get caught — reusing a shipping address, logging in from clearnet-linked accounts, reusing nicknames from Reddit. For higher-threat use cases, buyers run Tor Browser inside Tails OS or Whonix, never save session data, and treat each identity as single-use.
Privacy is a chain. The weakest link decides. A single mistake — buying Monero on a KYC exchange without a cooling-off window, opening a message on a cleartext connection, uploading a photo with EXIF data intact — breaks the chain. Spend a weekend with Privacy Guides before your first order. It is the single highest-leverage hour you will spend on this whole process.
Every forty-eight hours. A PGP-signed snapshot of the current mirror rotation is pulled from the drughub team's Dread announcements and compared against what this directory publishes. If even one character has changed, the verified urls page updates within two business hours. The last confirmed verification ran on April 21, 2026. Subscribe to the Dread announcement thread if you want an independent source — never trust a link that was not signed by the market team.
community voices
Three quotes pulled from PGP-signed posts on Dread between February and April 2026. Names replaced with handles. Nothing edited beyond light formatting. These are not promotional — one of them is a complaint.
"Joined in October. The onboarding is aggressive — PGP is mandatory, there is no password shortcut, no email reset. For the first hour I thought I had locked myself out. Once the key was set up properly, every login since has been silent and instant. Zero phishing exposure because there is literally nothing to phish."
"Lab verification is the reason I moved my listings here. My competitors can lie about purity; I can't, because the lab report is public. Sales slower in the first month — buyers compared. By month three I was the top vendor in my category because the reports held up. The badge system rewards honesty."
"Not everything is perfect. The January 2025 vulnerability reports were real — the team took weeks to patch, and communication during that window was poor. That said, they did fix it, they did issue a postmortem, and the walletless system meant nobody lost funds. I will keep using drughub, but with my eyes open."
A single glowing review is worth less than eighty consistent ones. Drughub weights ratings by order count, recency, and whether the transaction was lab-verified. A vendor with twelve Gold-tier orders and four stars beats a vendor with four hundred Bronze-tier orders and four-and-a-half. The formula is not secret — it is described in the marketplace wiki, and the inside drughub page walks through how the feedback engine was redesigned in early 2025 after the team's postmortem on rating inflation.
your first access
Full form of this guide lives at the Drughub Getting Started manual. Below is the short version — enough to reach the marketplace for the first time without stepping on a phishing clone, leaking metadata, or paying with a traceable coin. Read all seven before you start.
Download Tor Browser only from torproject.org. Every other "mirror" you find on Google has been a malware carrier at some point in the last decade. On Linux, verify the GPG signature of the tarball before extracting. On Windows and macOS, the signed installer checks itself. Once installed, set the security slider to "Safest" — this disables JavaScript globally. The drughub market link works fine without JavaScript.
If you are unusually cautious, run Tor Browser inside Tails OS from a USB stick, or inside a Whonix workstation. Both isolate Tor traffic from your main system.
Before your first visit, create a PGP key pair that you will use only for drughub. On Linux or macOS, the one-liner below produces a 4096-bit RSA key. Protect the private key with a strong passphrase stored in KeePassXC.
# gnupg — generate 4096-bit RSA key (interactive prompts)
gpg --full-generate-key
# choose: (1) RSA and RSA · 4096 bits · does not expire
# name: any persona you will reuse only on drughub
# email: leave blank or use proton alias
# passphrase: 20+ chars, generated, stored in cold storageThe public key is what you paste into drughub during registration. The private key never leaves your machine. Ever.
You cannot pay for a drughub order from an exchange wallet. The transaction needs to originate from a wallet you control. Install Feather Wallet on desktop or Cake Wallet on mobile. Create a new wallet inside the app, write the 25-word seed phrase on paper, and store that paper somewhere no one else will find it. Never type the seed into a text file, screenshot, or cloud note.
Buy Monero (XMR) on Kraken or a decentralised venue, then withdraw the amount you plan to spend plus fees. Let the transaction confirm before you try to place an order.
From this page — or from the drughub verified urls directory — copy the primary onion address. Do not type it by hand. Do not shorten it. A .onion address is cryptographically derived, so the last six characters are a self-checking signature; one wrong letter silently routes you to a different server, which is exactly how phishing works in 2026.
Open Tor Browser. Paste the onion address into the URL bar. Press enter. Expect a slower page load — Tor is not fast. Once the drughub marketplace front page renders, scroll to the footer. Every legitimate drughub deployment includes a PGP fingerprint in the footer that matches the one published on Dread. If the fingerprint is missing, different, or unreadable, close the tab. This is the single most reliable phishing check.
Click register. Pick a username. Paste your 4096-bit public key block — everything from -----BEGIN PGP PUBLIC KEY BLOCK----- to the matching END line. The server stores only the public key. Solve the captcha (a very light one — drughub uses simple visual challenges since JavaScript is disabled). Log out immediately and log back in once, to confirm your key works. If decryption fails, you will lose the account forever.
Your first purchase should be small. Pick a vendor with a Gold or Silver lab badge and recent positive feedback. Add to cart. Copy the Monero invoice. Pay from your self-custody wallet. Wait for ten confirmations on the Monero chain — roughly twenty minutes. When your order arrives and matches what you paid for, release escrow. That act triggers the vendor's payout and adds one data point to both their rating and yours. Do this once before you place a larger order.
If something goes wrong — package lost, wrong item, purity below advertised — do not release escrow. Open a dispute inside the platform and attach the lab result or photographic evidence. Drughub moderators read both sides and use their multisig key to settle. The process usually completes within seventy-two hours. The full access manual covers dispute flow in detail.
The whole sequence takes most people under ninety minutes on a first run. Roughly forty minutes of that is Tor Browser installation and PGP key generation — one-time setup you will never repeat for the same persona. Actual browsing is fast. Monero confirmations are the slow part, and that is outside the platform's control.
what makes it different
Most darknet markets look alike from the outside. Drughub made six architectural decisions early that diverged from the rest of the industry. The inside drughub page covers the history; here are the design choices that show up in daily use.
An independent laboratory tests purity, contaminants, and weight accuracy on nine out of ten products. Verified listings carry a Gold, Silver, or Bronze badge, and the full lab PDF is publicly linked on the product page. No other major drughub market competitor runs third-party testing at this scale.
Payments flow directly from buyer to a 2-of-3 multisig address. Drughub never holds a balance on behalf of users. Even if the entire admin team disappeared overnight, funds locked in active orders would remain recoverable with the remaining two signatures. Platform fund misappropriation becomes mathematically impossible.
Ring signatures, stealth addresses, RingCT — together they mean sender, receiver, and amount are hidden by default. Monero is the only widely supported coin where this is true out of the box. Drughub refused to accept Bitcoin from day one and never added it back.
No username-and-password combo exists on the platform. Login authenticates through a PGP challenge-response. A stolen server database would yield nothing but public keys, which are useless without the corresponding private keys you keep in cold storage with GnuPG and KeePassXC.
No logs. No IP records. No message history stored beyond forty-eight hours. All buyer-vendor communication is PGP-encrypted end to end, so even the server cannot read it. Aligned with the practices recommended by the Electronic Frontier Foundation for high-threat communication.
The entire drughub marketplace renders without JavaScript. Tor Browser on the Safest setting shows every function — browsing, ordering, messaging, escrow release. This cuts attack surface dramatically and means the site loads reliably even on slow Tor circuits. Privacy tooling like Privacy Guides recommends this exact posture.
| Decision | Drughub | Industry default |
|---|---|---|
| Payment currency | Monero only | Bitcoin + optional XMR |
| Escrow model | 2-of-3 multisig, walletless | Internal hot wallet |
| Login method | Passwordless PGP | Username + password + 2FA |
| Product testing | Third-party lab, 90% coverage | No independent testing |
| Message retention | Forty-eight hour rolling purge | Stored indefinitely |
| JavaScript required | No | Yes |
"Walletless and Monero-only sound like marketing until you lose funds to a platform collapse. Once you have, nothing else looks acceptable."
— @opsec_first, buyer, 104 orders
Architecture is one thing, operational security is another. The six choices above reduce the platform's own attack surface to near zero. They do not protect you from mistakes you make yourself — a shipping address tied to your real name, a login from your home IP without Tor, a Monero wallet funded directly from an exchange that has your passport. Good tools are necessary. Good habits are the other half. Tools like Tails OS, Qubes OS, and Mullvad VPN are the easy part — discipline is the hard part.
verified access
Exactly two addresses right now — one primary, one mirror. Both PGP-signed by the drughub team and verified on April 21, 2026. Every address below routes to the same underlying marketplace; the mirror exists to absorb DDoS pressure. If any address on this page stops resolving, check the verified urls directory for the rotation.
Loading...
Loading...
| Address | Role | Uptime | Verified |
|---|---|---|---|
drughub75…ad.onion | primary | 99.1% | 21 apr 2026 |
rughubrwg…id.onion | mirror 01 | 97.4% | 21 apr 2026 |
— reserved — | mirror 02 | on standby | awaiting rotation |
— reserved — | mirror 03 | on standby | awaiting rotation |
Phishing sites copy this interface exactly. Check every character of the .onion address before you enter. The wrong link costs more than the time to verify.
Every address on this page is checked against three independent sources before it is published. First: the PGP-signed announcement on Dread where the drughub team rotates mirrors. Second: a direct connection test through Tor, looking for the matching fingerprint in the footer of the loaded page. Third: a signature comparison against the team's long-lived release key. Only when all three match does an address go live on this directory. A reserved slot means we have a candidate mirror under review but not yet cleared.
The Tor network is noisy — an onion address can appear unreachable for five minutes and return. Wait ten minutes and retry before assuming it has rotated. If it stays down, open the other link on this page. If both fail, the platform is likely absorbing a coordinated DDoS event. Check the verified urls page for the latest mirror rotation. New addresses usually appear within two hours of publication on Dread. Never search for "drughub market link" on the clearnet to look for alternatives — those results are where phishing operators live.
— one more thing —
Last verified April 21, 2026 · PGP signature matched · Monero wallet ready? Copy and paste into Tor.
Loading...