Security & OPSEC Guide
Everything you need to stay anonymous, protected, and scam-free on the dark web in 2026.
Contents
🛡️ Security Layers Overview
Think of security in layers. Each layer you add increases protection multiplicatively. Missing any one layer creates exploitable gaps.
Layer 1 Network Anonymity — Tor Browser
The foundation. Tor routes your traffic through 3 relays, masking your IP from the destination. Always use the official Tor Browser — never third-party Tor apps.
Layer 2 VPN Before Tor
A no-log VPN hides from your ISP that you're using Tor at all. Use Mullvad (accepts XMR cash) or ProtonVPN. Connect VPN → then Tor.
Layer 3 Operating System — Tails or Whonix
Tails OS boots from USB, leaves no trace on the host machine. Whonix routes everything through Tor at the OS level. Either is dramatically safer than Windows/macOS.
Layer 4 PGP Encryption
Encrypt all sensitive communications (addresses, personal info) with PGP. WarpZone Market has built-in PGP tools — no external software needed.
Layer 5 Multisig Escrow
Never let a market hold your funds in a single-sig wallet. WarpZone's multisig escrow requires 2-of-3 signatures — you, the vendor, and the market — making exit scams impossible.
Layer 6 Monero (XMR) Payments
Bitcoin is pseudonymous — blockchain analysis firms can trace BTC. Monero is cryptographically private by default. Use XMR whenever possible.
🧅 Tor Browser Setup
Download Tor Browser only from torproject.org — never from third-party sites. Verify the GPG signature of the download.
Download & Verify
Get Tor Browser from torproject.org. Check the GPG signature file against the Tor Project's signing key to confirm it's genuine.
Security Level → Safest
In Tor Browser, go to Shield icon → Advanced Security Settings → set to Safest. This disables JavaScript on all non-HTTPS sites and limits attack surface.
Never Maximise the Window
Browser window size can fingerprint you. Keep Tor Browser at its default size or use a common resolution.
Never Log Into Personal Accounts
Never sign into Gmail, Facebook, or any clearnet account while using Tor. This immediately deanonymises you.
Use .onion Addresses Directly
Always use verified .onion addresses. Never Google market names and click links. See our verified links page.
🔒 VPN + Tor Configuration
The correct setup is You → VPN → Tor → Dark Web. Never Tor → VPN (this defeats the purpose and can expose your .onion traffic to the VPN provider).
| VPN Service | Price | Accepts XMR | No-Log Audit | Recommendation |
|---|---|---|---|---|
| Mullvad | €5/mo | ✅ | ✅ | Best Choice |
| ProtonVPN | Free–$10/mo | ❌ | ✅ | Good |
| NordVPN | $3–12/mo | ❌ | Partial | Acceptable |
| ExpressVPN | $8–13/mo | ❌ | Partial | Avoid if possible |
🔐 PGP Encryption
PGP (Pretty Good Privacy) encrypts messages so only the intended recipient can read them. Use it for every delivery address you share.
How it Works:
- Every vendor publishes a public key on their profile
- You encrypt your address with their public key
- Only they can decrypt it with their private key
- Even if the market server is seized, your messages are unreadable
On WarpZone Market:
WarpZone has built-in PGP tools directly in the interface. You don't need GPG4Win, Kleopatra, or any external software. Encryption and verification happens in your browser session, over Tor.
🔏 Multisig Escrow Explained
Standard escrow: the market holds your BTC. If the market exit-scams, your money is gone. This has happened to dozens of markets.
Multisig escrow changes this fundamentally:
- Funds go into a 2-of-3 Bitcoin or Monero transaction
- Three parties each hold one key: you, the vendor, and the market
- Any 2 of the 3 must sign to release funds
- If the market disappears: you + vendor can settle directly
- If vendor scams: you + market can refund you
- If you and vendor agree: market has no ability to steal funds
WarpZone Market is the only active market in 2026 offering true multisig escrow. See full features list.
✅ OPSEC Checklist
Before every session, run through this checklist:
- Using Tor Browser (not regular Firefox/Chrome with Tor proxy)
- VPN is connected before opening Tor
- Security level set to Safest in Tor Browser
- Not logged into any clearnet accounts
- Not using personal devices or home WiFi for high-risk activity — use public WiFi + Tails
- Using a separate dedicated darknet email (darknet email guide)
- PGP-encrypting every delivery address
- Verifying vendor PGP key before every order
- Using multisig escrow where available
- Not discussing darknet activity on clearnet platforms
- Not reusing usernames across services
- Using XMR instead of BTC where possible
- Verified .onion address from PGP-signed sources, not Google
💻 Device & OS Hygiene
Best: Tails OS
Boot from a USB drive. Everything runs in RAM. Shuts down cleanly with no trace. Free at tails.boum.org. Tor Browser is pre-installed and pre-configured.
Good: Whonix
A pair of virtual machines where all traffic is routed through Tor at the OS level. Even if malware runs inside the VM, it can't leak your real IP.
Minimum: Hardened Tor Browser on Linux
If you must use a regular OS, use Linux (not Windows). Disable microphone, camera, and Bluetooth. Use full-disk encryption.
Never:
- Do not use iCloud, Google Drive, or OneDrive on a darknet device
- Do not use Tor on a work or school device
- Do not use Windows 11 — extensive telemetry even with hardening
- Do not take screenshots on iOS — they are stored in Apple's cloud
🚫 Common Mistakes That Get People Caught
- Using real name or address — Always use a pseudonym and a pickup point, never home address
- Reusing PGP keys — Generate a fresh keypair per market identity
- Bragging online — Countless arrests from Discord, Reddit, and Telegram posts
- Clicking phishing links — Always verify .onion via our PGP-signed list
- Sending BTC directly from exchange — Exchanges have your KYC. Use a Monero swap first
- Using centralised escrow — Markets can exit-scam. Use multisig only
- Ordering to home — Use a PO box or pickup point. Your home address is in government databases
- Not using HTTPS — .onion sites are end-to-end encrypted, but clearnet mirrors are not
🏪 Vendor-Specific Security
Vendors face a higher threat model than buyers. Additional recommendations:
- Use a separate device exclusively for vending — never mix personal use
- Never ship from home — use drop points or public locations
- Vary your shipping times and locations to avoid pattern analysis
- Enable 2FA on all market accounts (WarpZone supports TOTP 2FA)
- Keep a separate XMR wallet for vendor income — never deposit to an exchange directly
- Rotate PGP keys every 6 months
- Read the vendor guide for full WarpZone vendor setup
🐛 Bug Bounty Programme
WarpZone Market operates an active bug bounty programme. Responsible security researchers are rewarded:
| Severity | Description | Reward |
|---|---|---|
| Critical | RCE, authentication bypass, fund theft | Up to 1 XMR |
| High | XSS with impact, IDOR exposing user data | 0.1–0.5 XMR |
| Medium | Logic flaws, info disclosure | 0.01–0.1 XMR |
| Low | Minor issues, UI bugs | Bounty at discretion |
Report via PGP-encrypted message through market support. Do not publicly disclose before patch.