BlackOps Market Security Guide
Tor Settings
Use the Safest setting to disable JavaScript entirely. Do not stack a VPN on top of Tor unless you understand the tradeoffs. A misconfigured VPN can leak your real IP to the provider even if your Tor exit is hidden. If your ISP throttles Tor, enable an obfs4 or Snowflake bridge inside the connection settings rather than running a separate app.
Wallet Hygiene
Keep a dedicated wallet just for market purchases. Never reuse an exchange wallet for deposits. Generate a fresh XMR address for every single deposit to break linkage. If you hold significant Monero, park the bulk in a cold wallet and move only what you plan to spend. The internal market wallet is convenient but offers less protection than your own hardware device.
PGP Setup
Generate a keypair using the built-in market tool or GPG on your machine. Upload your public key to your profile so vendors can encrypt messages. Store your private key in a password manager or on an encrypted USB stick. Never paste that private key into a chat window under any circumstances.
Common Mistakes
Reusing a password from another site is the most fatal error. Buying from a vendor with three reviews and two days of history invites trouble. Finalizing payment too early on a first order removes your dispute leverage. Clicking a new mirror link from a Reddit comment without verifying the PGP signature leads to clones. Using your phone for market ops exposes you through screen notifications, unlocked displays, and missing encryption at rest.
When to Worry
If the market goes silent for more than 48 hours with no Dread announcement, assume a DDoS attack rather than a full takedown. A maintenance banner with a countdown timer is almost always a clone trying to harvest keys. Real maintenance is always announced via PGP-signed posts, not temporary website banners.