Why this portal exists.
Every week, somebody types "drughub market link" into a search engine and clicks the first result. That result is almost always a clone. The real drughub market address lives on Dread, PGP-signed, buried in a thread that requires a community account to access. This portal bridges that gap — not to make privacy network markets easier to find, but to make the real drughub market address findable without a week of forum archaeology.
Phishing sites copy the drughub market interface exactly. Same logo, same login screen, same fonts. The only difference is one wrong character in the .onion address — and your Monero goes to a stranger.
This directory does one thing well. It takes the PGP-signed announcement posted by DrugHub's administrators on Dread, verifies the cryptographic signature, cross-checks the .onion address character by character, and publishes it here with a Copy button that functions reliably inside Tor Browser.
That's it. No affiliate links. No promoted listings. No referral commissions from the marketplace. Just the address, with a methodology you can audit and a timestamp that tells you when it was last checked.
And that matters. Because the drughub market rotates its primary address. When it does, a link that was correct yesterday becomes a phishing risk today — if whoever published it didn't update. This portal updates same-day as the PGP announcement.
Independent. Not affiliated.
This portal is not run by the drughub market team. It is not affiliated with the marketplace, its vendors, or its administrators. It's maintained by a small group of privacy researchers who started tracking drughub market links in August 2023 when the platform launched — and who got tired of watching people fall for phishing clones.
Independence is the point. If this portal were run by the marketplace, you'd have no way to know whether the link was posted to direct traffic or to verify it. The whole value of a link directory depends on the person publishing it having nothing to gain from sending you to the wrong address.
What "verified" means here
The word "verified" gets thrown around constantly in this space. Here's what it means on this site, specifically:
- The drughub market administrators post a PGP-signed message on Dread when the primary address changes or a new mirror is published.
- We download that announcement, import the DrugHub admin PGP key, and run signature verification using GnuPG. A valid signature means the message came from someone holding the private key.
- We extract the .onion address from the signed text and compare it character by character to what appears in this directory. We don't copy-paste. We type it manually and diff it.
- We update the timestamp. The link goes live.
The whole process takes about twelve minutes. It's done the same day the announcement appears. And it only happens when there's a PGP-signed source to verify against — we don't publish guesses, community-sourced tips, or links from forums that don't have a signed backing.
What we don't do
We don't verify that the drughub market itself is safe to use. We don't vouch for vendors. We don't review the product quality, the dispute process, or the team's operational security. The Lab Verification Program is a drughub market feature — not something we administer.
What we verify is the authenticity of the link you're about to click. That's a narrow claim. But it's an important one. Read more about the actual drughub market features on the homepage, or visit the how-to guide for setup instructions.
Portal history.
Every significant moment in the drughub market's lifespan, and how this directory responded. The record matters — if you're going to trust a link, knowing the track record of who published it helps.
DrugHub launches. Portal starts tracking.
The White House Market team launched drughub market in August 2023. Within the first week, clone sites appeared on clearnet using drughub branding. This portal was registered the same month to provide a single, PGP-sourced reference point. First verified address published August 19, 2023.
The drughub market launched with Monero-only policy and passwordless PGP login from day one. No legacy Bitcoin support, no password database to steal. That security baseline is what made us confident the platform was worth tracking long-term.
Mirror rotation tracking added.
The drughub market began publishing additional mirror addresses in early 2024, rotating them on an irregular schedule to defeat DDoS targeting. This portal added same-day mirror tracking — every new Dread announcement with a PGP-signed mirror list gets published here within hours.
At this point the drughub market had grown past 12,000 active listings and crossed 200,000 registered users. The mirror rotation policy was a direct response to the scale of DDoS attacks the platform was absorbing from competitors.
SuperMarket acquisition. First privacy network M&A.
DrugHub acquired SuperMarket — the first documented merger-and-acquisition in privacy network marketplace history. The drughub market absorbed SuperMarket's vendor base and listings, growing its catalog significantly. This portal tracked the migration: old SuperMarket links went dead, drughub market addresses remained stable.
The acquisition raised legitimate questions about centralization risk. A platform that grows through acquisition consolidates both the vendor network and the attack surface. We documented the timeline for community reference.
Security disclosures by "Evil Rabbit".
Researcher "Evil Rabbit" published findings in January 2025 documenting infrastructure vulnerabilities in the drughub market's clearnet-adjacent services. The disclosures included evidence of EXIF metadata in images, exposed management panels, and an open XMPP port. The drughub market's core onion infrastructure was not breached, but the disclosures raised questions about operational security discipline.
This portal suspended mirror publication for four days pending confirmation that the primary .onion remained unaffected. It did. We resumed after the admin team posted a PGP-signed statement on Dread addressing the findings. The core link remained the same throughout.
Current state — one verified primary address.
As of April 2026, the drughub market has 54,155 registered users, 2,789 approved vendors, and 19,913 active listings. Uptime sits at 96.7%. The platform runs on Monero exclusively with the same core security model it launched with: walletless escrow, PGP-mandatory login, zero data retention.
This portal publishes one primary .onion address, sourced from the most recent PGP-signed announcement. It's updated the day of any rotation. If you bookmark this page, you have one reliable place to check before every session. That's the design. Nothing more complicated than that.
How we verify every link.
Three steps. Twelve minutes. Done when there's a PGP-signed source to check against — never before. This is the methodology, in full, so you can decide whether it's worth trusting.
Dread announcement monitoring
The drughub market team posts all official address updates on Dread — the primary privacy network community forum. We maintain active Dread accounts and check the official drughub market thread daily. When a new announcement appears with a .onion address, the verification process starts.
We do not source links from Telegram channels, Reddit posts, clearnet forums, or "link aggregator" sites that don't publish their sourcing methodology. Those vectors are where most phishing links originate. Dread + PGP is the only chain of custody we trust.
If there's no Dread announcement, there's no update. Simple.
PGP signature verification
Every legitimate drughub market announcement is signed with the admin team's PGP key. We import that key from the first verified announcement (August 2023) and run gpg --verify against each new message. A valid signature confirms the message came from whoever holds that private key — the same entity that has signed every previous announcement.
GnuPG is the tool. No plugins, no third-party services. If you want to verify yourself, the process is documented in detail on the getting started guide. You don't need to trust us — you can run the same check. The public key is in the signed announcements themselves.
Signature validation failure means we do not publish. No exceptions.
Character-by-character comparison
After PGP verification, we extract the .onion address from the signed text. We then type it manually — not copy-paste — into a comparison document alongside the address from the previous announcement. We run a character diff.
Onion addresses are 56 characters of Base32 encoding. One substituted character creates a completely different server, potentially owned by someone who registered it specifically to catch people who almost-but-not-quite copied it correctly. The drughub market's address has changed twice since launch. Each time, we found the announcement, verified it, diffed it, and published the new address within the same day.
The address on the homepage is the result of that process. Copy it. Don't type it manually.
What the community says.
"Used three different link directories before finding this one. The others had outdated addresses or didn't list when links were last verified. This portal shows the timestamp right there. That's the signal I was looking for."
"The verification methodology section actually convinced me. Most sites just say 'verified' with no explanation. Seeing the step-by-step — Dread source, PGP check, manual character diff — that's transparency. The drughub market link I copied worked first time."
"Had a friend send me a link that looked exactly like the drughub market but was off by two characters. This portal's copy button saved me. The address here is always current — I check it before every session now."
Privacy tools worth knowing.
These organizations and projects are independent of this portal and unaffiliated with the drughub market. They are genuinely useful if you care about operational security and digital privacy.
Tor Project
The foundation that maintains Tor Browser. Required for accessing any .onion address. Download only from the official site.
EFF
Electronic Frontier Foundation. Legal defense, digital rights policy, and clear surveillance documentation. The Surveillance Self-Defense guide is essential reading.
Privacy Guides
Open-source, community-reviewed tool recommendations. Everything from VPNs to messaging apps — with honest assessments, not affiliate rankings.
GnuPG
The tool we use for PGP signature verification. Free, open-source, available on all major platforms. If you want to verify drughub market announcements yourself, this is how.
Tails OS
A live operating system that routes all traffic through Tor and leaves no trace on the host machine. Recommended by the EFF for high-risk threat models.
Proton Mail
End-to-end encrypted email from a Swiss provider with a zero-knowledge architecture. Useful if you need to communicate about drughub market access issues without cleartext exposure.
Monero
The official Monero project site. Download the GUI or CLI wallet. Documentation on ring signatures, stealth addresses, and RingCT if you want to understand why the drughub market chose XMR-only.
KeePassXC
A local, open-source password and secrets manager. Useful for storing your PGP key passphrase securely without relying on a cloud service.
Mullvad VPN
A no-logs VPN that accepts anonymous payment including Monero. Add a VPN layer before Tor if your threat model requires hiding Tor usage from your ISP.
Copy the verified drughub market link.
You've read the methodology. You know where the address comes from and how it's checked. Now copy it. Open Tor Browser. Paste. Done.
If you're new to Tor, the how-to guide walks through setup from scratch — browser installation, PGP key generation, and first login. Step by step, no shortcuts.
Loading verified address…
Paste only into Tor Browser. Compare every character against the PGP-signed announcement before logging in. Phishing sites look identical — the address is the only difference.