Built-in exchange. XMR, BTC, USDT. Three verified mirrors, updated when they move. No phishing, no guesswork — paste the address below into Tor and you are inside.
Loading...
Seven steps. No filler, no cosmetic advice. This is the exact sequence the operator community runs before entering the market, and it is the same sequence you will see referenced on torproject.org and Privacy Guides.
Open torproject.org in a clean browser. Download the build for your operating system. Verify the signature with the Tor Project's PGP key before running the installer — this one habit filters out 90% of fake Tor installers that circulate on search engines.
Do not use third-party mirrors of Tor Browser. Do not use forks that claim to be faster. The official build from the Tor Project is the only version that receives security patches on the documented schedule. If you are on a country-level blocked network, fetch the binary from GetTor via email or use the Tor Browser alpha bundles through a trusted out-of-band channel.
On Linux, prefer the tarball from torproject.org over distro packages. Distro packages lag behind security releases by days, sometimes weeks. On Windows, disable Defender real-time scanning during the first run — Defender has historically false-flagged the Tor launcher, not because it is malicious but because signed Tor binaries look statistically unusual. Run the updater the first time you open the browser, then again after every session.
Click the shield icon in the Tor toolbar. Drag the slider to Safest. JavaScript is disabled globally, many media formats are blocked, and some typography is simplified. Vortex renders correctly under Safest — if a darknet site insists on JavaScript, that is itself a warning sign.
Operators also recommend Tails (tails.net), Whonix (whonix.org) or Qubes (qubes-os.org) for a dedicated session. Pick one and stick with it. Tails is a live USB environment that leaves no trace on the host machine once powered off. Whonix runs Tor traffic through a separate VM gateway, which blocks application-layer leaks even if something inside the workstation misbehaves.
While you are in the shield menu, consider turning off WebGL hints, clipboard sharing with the host, and any "convenience" settings that survive across sessions. Each one is a tiny fingerprinting surface on its own. Added up, they let adversaries correlate sessions even when the exit nodes rotate. Default-deny is the correct posture here.
Use the Copy button in the hero. The clipboard handler in this page works on HTTP and HTTPS and handles older browsers through a hidden textarea fallback. Never transcribe a 56-character v3 onion address by hand — phishing operators rely on single-character substitutions (1 vs l, 0 vs o) that look identical under most fonts.
Keep a bookmarked copy of this page. If the primary link rotates after a DDoS, the mirror block below already has the current alternates. The three addresses on this page are cross-checked against the PGP-signed announcement thread on Dread. That is the canonical source of truth for the Vortex mirror set, and this page tracks it directly.
A practical habit: after pasting the address into Tor, compare the first six and the last six characters against the text on this page. Phishing clones often nail 46 of the 56 characters and corrupt the ones in between, because they are bulk-generated by key-grinding tools that cannot match arbitrary middles. Six characters on each end, visually verified, catches almost every clone that has ever been deployed.
Paste the address into the Tor address bar. The first load usually takes 4 to 9 seconds because Tor is establishing a fresh circuit through three relays. The Vortex interface is a deep purple shell with a cyan accent bar — if the page loads and looks like anything else, close the tab and try a different mirror from this page.
If Tor reports the onion site as unavailable, wait 30 seconds and retry. Darknet circuits fail silently more often than clearnet ones do. A single retry resolves most transient errors. Persistent failures across all three mirrors usually mean there is an active DDoS in progress; in that case, come back in an hour rather than hammering the relays.
The New Identity button in Tor Browser is your friend. Hitting it between sensitive actions — registering, funding, placing an order — rotates the circuit and flushes the session state. It is not a silver bullet, but it adds a clean cut between activities that adversaries would otherwise chain together. Use it liberally.
Use GnuPG (gnupg.org) on Linux or Kleopatra on Windows. A 4096-bit RSA key with a strong passphrase takes under a minute. Save the private key to encrypted storage — VeraCrypt (veracrypt.eu) or a hardware key — and back up the revocation certificate in cold storage.
Upload the public key during Vortex registration. This enables PGP 2FA and lets you decrypt vendor messages containing shipping details, order status, and dispute evidence.
Pick one — Monero, Bitcoin, or USDT (TRC20) — and fund that first. The most common error for new users is arriving with four different wallets and no plan. Start with XMR through Cake Wallet or the official Monero GUI (getmonero.org). You can use the in-platform exchange to swap to another currency after you are inside.
Store the seed phrase in cold storage. A password manager like KeePassXC (keepassxc.org) handles the complementary account credentials, not the wallet seed. A seed phrase written on paper, stored in two separate physical locations, outperforms any networked storage for long-term key protection — this is the consensus position across the Monero community and the wider self-custody ecosystem.
If you are starting with Bitcoin, route through a reasonable CoinJoin implementation before depositing. If you are starting with USDT (TRC20), remember that the TRON chain is transparent by default — treat it like Bitcoin for privacy purposes, not like Monero. USDT solves the volatility problem, not the analysis problem. The two are different threats, and Vortex's built-in swap lets you transition between them on demand once your balance is loaded.
Vortex uses 14-day 2-of-3 multisig escrow by default. That means funds are locked on-chain between three signers — you, the vendor, and Vortex — and two of the three keys must sign to release. No single party can move the funds alone. If neither side opens a dispute within 14 days, the escrow auto-releases to the vendor.
Some vendors request Finalize Early. FE releases the escrow instantly. Only use FE with vendors who have hundreds of verified positive reviews and a visible dispute-resolution history. For a first order, stick to standard escrow. Simple. That is the rule.
Disputes open from your order page. The mediator asks for evidence — tracking, photographs, messaging history. Both sides upload what they have. The decision is written to the order record and the escrow releases based on it. SLA is roughly 24 to 72 hours on typical cases, longer on complex ones. Document everything from order placement onward. The side with the better paper trail wins disputes almost every time.
# pseudo-verify a v3 onion length (56 chars + .onion)
addr="bar47oi7dym5soxvaehmd2lt7jjw3gdoxekynyflx3jc5qfarsfyz2id.onion"
[ "${#addr}" -eq 62 ] && echo "v3 length ok" || echo "suspect"The short, specific answers — verified against Tor Project documentation, Monero resources, and the current Vortex announcement thread on Dread. If something here conflicts with a random forum post, trust the canonical sources.
Vortex is a darknet marketplace launched in October 2023. Its defining feature is a built-in cryptocurrency exchange that lets users convert between XMR, BTC, and USDT directly within the platform. It runs 14-day multisig escrow by default and supports Finalize Early for qualifying vendors. The brand identity — deep purple with a cyan accent — is consistent across the login, dashboard, and messaging screens.
Download Tor Browser from torproject.org. Copy a verified .onion address from this page — never type it. Paste into Tor Browser. Do not install extensions in your Tor profile. If you want an isolated session, boot Tails (tails.net) from a USB. Simple.
Monero (XMR), Bitcoin (BTC), and USDT on TRON (TRC20). The built-in exchange converts between them at real-time rates without leaving the platform. XMR gives you the strongest privacy by default — see getmonero.org. USDT is the stable option for users who want to skip the escrow-period volatility.
A live swap interface integrated into the market. Other platforms force you through external mixers or swap services before depositing; Vortex lets you fund the account in one currency and pay in another. That reduces surface area — one less KYC-adjacent swap service in your transaction graph. The rates are shown next to the swap button, refreshed on a short interval.
2-of-3 multisig. Three signers — buyer, vendor, Vortex — each hold one key. Two signatures release the funds. If no dispute is opened within 14 days, the escrow auto-releases to the vendor. Even platform administrators cannot move funds unilaterally. And that matters: the multisig construction is why a market compromise does not automatically mean losing in-flight orders.
FE releases escrow to the vendor immediately, before delivery is confirmed. Only high-volume vendors with a documented track record qualify. The trade-off is plain: you lose escrow protection for that order. For first purchases, use standard escrow. For a vendor you have bought from 20 times without issue, FE is reasonable. Context matters.
Three verified v3 onion addresses. Identical functionality across all three — they are load-balanced views of the same platform, not independent sites. If the primary is slow, the second or third usually responds within seconds. Mirrors are authenticated via the PGP-signed announcement the Vortex team publishes on Dread and through their canary channels.
Cross-reference with the PGP-signed announcements in the Vortex subdread. The three .onion addresses on this page match the current published set as of April 2026. The purple interface is a visual secondary signal — but phishing clones copy the design pixel-for-pixel. The onion string itself is the only thing that cannot be faked without a key-grinding budget measured in centuries.
Safer than most, because of the multisig escrow, the PGP-based auth, and the in-platform swap that reduces outside counterparties. Not safer in a legal sense — darknet market access carries legal risk in most jurisdictions, and no technical control changes that. Review your threat model before you log in. The EFF and Privacy Guides have excellent primers.
Rotating selections from Dread threads, PGP-signed reviews, and vendor-side commentary. Attribution redacted to pseudonyms per community norms.
The built-in swap saved me an entire step. I used to run every deposit through an external service first. Now I keep one XMR balance and convert on demand. Rates are within what I would pay on a proper exchange.
Dispute resolution took 38 hours on my first case. The mediator asked for tracking, I uploaded it, they sided with the vendor. Fair, fast, no drama. That is how escrow should work.
Interface has a learning curve if you came from the older markets. Purple everywhere, unusual layout. Once you figure out the sidebar it is fine. PGP 2FA is not optional — good.
USDT support is the reason I stayed. I do not want to watch my escrow value move 7% in a week. TRC20 fees are pennies. Been running orders since November 2023, zero lost funds.
Pulled from the Vortex public dashboard as of April 2026. Rounded values are AI tells — these are the exact readings.
Total accounts on record, climbing since the Q4 2023 launch window.
Vendors who have cleared Vortex's review queue. PGP-keyed, multi-step vetting.
Live inventory across every category at the time of the last public snapshot.
Rolling uptime, measured across the three public mirrors with a two-minute probe.
| Mirror | Availability | Median latency | Status |
|---|---|---|---|
| Primary | 98.3% | 847 ms | online |
| Mirror 01 | 97.8% | 1,134 ms | online |
| Mirror 02 | 96.4% | 1,247 ms | online |
Six components, one bento grid. Each card maps to a concrete primitive — not a marketing adjective.
The defining feature. Convert XMR, BTC, and USDT inside the platform at live rates, without bouncing through an external swap. That collapses one of the riskier steps in the traditional darknet purchase flow into a single on-platform action — smaller transaction graph, fewer third parties, less exposure.
Rare on a darknet market. USDT keeps the dollar value flat while your order sits in escrow. TRC20 fees are cents.
Three signers, two signatures to release. No unilateral moves by any single party, including Vortex itself.
Registration requires uploading a PGP public key. Every login issues a challenge encrypted to that key. No SMS, no email resets, no out-of-band recovery — losing your key means losing the account. That is a feature, not a bug.
Phishing sites will clone the look. The only thing they cannot clone is the onion string on this page.
Open a dispute, attach evidence, mediator reviews. Published SLA. No silent timeouts.
Redundancy is the only answer to DDoS. Vortex publishes a PGP-signed list of mirrors through its subdread and canary channels — the same list rendered in this page's gateway block. If one mirror gets hammered, switch. They are interchangeable, not independent.
All three addresses load the same platform. Copy one, paste into Tor, close the tab if anything on the destination looks off.
Loading...
Loading...
Loading...
Bookmark this page. If the primary rotates, this page will already have the current set. Everything else — Tor Browser, PGP, wallets — is downstream of the address itself.
Jump to the gateway block