In this guide we explain everything you need to know about MGM Grand, one of the darknet’s fastest rising marketplaces.
WARNING: Multiple reports on an exit scam of MGM Grand market.
MGM Grand is a moderately-sized darknet market that currently hosts close to 16,000 listings and 366 vendors across five main categories. While most listings are in categories for popular drugs like stimulants and cannabis, it does contain a fair selection of listings for counterfeit items and digital items as well. The market sports a user-friendly design which is visually pleasing. The order placement process is a breeze, but some standard security expectations are missing in that it does not support Monero (XMR), does not enforce PGP encryption, and uses static deposit addresses for account wallets.
One of the unique benefits of MGM Grand over almost every other darknet markets is the fact that it has a mobile-friendly layout, meaning it is quite easy to navigate and place orders from while on a mobile device, and all without the use of JavaScript as well. MGM Grand also claims to offer an “indemnity fund” that will compensate buyer who have been scammed by a vendor, providing the following message during the checkout process:
“MGM Grand is the only market that do have an indemnity fund to protect buyers from exit scams but you need to understand that we are not an insurance company. We’ll try to compensate you as much as we can but your due diligence will greatly help in reducing scams.”
It cannot be confirmed whether the market actually compensates scammed buyers or not, but they do seem to go out of their way to monitor for scamming vendors, claiming to have removed over 200 scammers in 2022 alone.
Basic Facts about MGM Grand
- MGM Grand link: duysanjqxo4svh4z2xc5tjf6r3ichxd3m2rwcgabf44ad.onion
- Year founded: 2021
- Cryptocurrencies accepted: Bitcoin (BTC)
- Total Product/Service listings: ~16,000
- Listing Categories: Fraud, Drugs, Digital Goods, Guides & Tutorials, Miscellaneous
- Multi-signature escrow? No
- Finalize Early? Yes
- Cost of vendor bond: $200
Before Getting Started
Before attempting to use MGM Grand or any darknet market, there’s a few subjects of which you should have at least an intermediate level of understanding, which include:
- Cryptocurrency transacting. You must have at least some understanding of how crypto transactions work to use MGM Grand, which includes being able to send and receive Bitcoin (BTC).
- The Tor browser. You must have the most recent version of the Tor browser installed and know how to use it well enough to maximize your own level of privacy while doing so.
- OpSec. Short for “operations security,” OpSec is the practice of putting yourself in the shoes of an adversary to identify ways by which they might use knowledge of your internet activity against you. If you are not sure what this means, take time to acquaint yourself with the idea before continuing.
- PGP. Short for Pretty Good Privacy, PGP is an encryption standard widely employed by darknet markets and their users. You should be knowledgeable of PGP enough to encrypt and decrypt messages. You will also need to know how to sign and verify messages to use MGM Grand.
Disclaimer: This guide is for research purposes only and should not be construed as advice; legal or otherwise. The authors of this guide do not condone activities that are illegal in your jurisdiction or others. Use the contents of this guide and/or MGM Grand at your own risk.
Don’t Get Phished
MGM Grand uses mirrors to direct users to verifiable links to the market. This means that after you visit the market’s URL for the first time, you can import the official PGP key of the market into your PGP utility (like Kleopatra) and use it to verify messages containing mirror links. This is pretty much the only way to know for sure that you are visiting a verified market URL and the real MGM Grand.
Sites that MGM Grand names as “official resources” for obtaining links to their market include Dread, Darknetlive, DarkFail and TorTaxi. Attempting to get non-verified mirrors off social media sites like Reddit will almost assuredly result in getting phished, which means your login credentials are compromised and your account balance can be stolen.
Creating an Account
After confirming you have arrived at the market from a verified mirror, creating an account is a relatively easy process. First, switch the landing page tab from Login to Register.
Next, enter a username, password (2x), 6-digit PIN (2x), and the captcha code. Note that your username must be at least 4 characters and the password at least 8 characters (we recommend choosing a random combination of upper- and lowercase letters, numbers, and special symbols).
Be sure to save your login credentials somewhere secure and where you won’t forget where they are. Make sure to save your PIN as well as you will not be able to place orders or perform withdrawals without it. After doing this, fill out the captcha (it is case-insensitive) and then press the “Register” button at the bottom to proceed. You will then be brought to a screen with a 15-word mnemonic which can be used to recover your account if you should somehow lose access to your password.
Save this mnemonic along with your username and password. Take note of the words of caution posted by the market, found below the mnemonic: “Remember that the login page will never ask for your mnemonic or your PIN. Be careful, If you lose your PIN or 2FA private key and you cannot remember your mnemonic, your account cannot be reset, and this will result in loss of your account including any active orders you may have.” After you have taken all this into consideration, press the “Proceed to Log In Page” to continue.
You will now be redirected to the Login page where you can enter your account credentials to enter the market for the first time.
Setting a PGP Key
First, note that MGM Grand requires RSA encryption which should be set at a minimum 3,072-bit (set by default in Kleopatra). To attach a PGP public key to your account (a must-do for any serious market user), first click on the box with the three white lines in the bottom right-hand corner of the screen. This will bring up the user menu, which looks like this:
Click on the user profile icon (immediately to the right of the word MENU) to bring up the account settings for your profile. Notice that the second option (next to DASHBOARD) is “PGP KEY”. Click on this button to being up the PGP public key entry screen. Open your PGP utility, copy your PGP public key (can be found by double-clicking on the certificate and selecting “Export”), and paste it in the text area underneath the words NEW PGP KEY. It will look something like this when correctly pasted:
Next, press the “Proceed” button to continue. You will now be asked to confirm ownership of the PGP key. To do this, copy the entire contents of the encrypted message in the text box below CONFIRM NEW PGP KEY and decrypt them with your PGP client using the corresponding private key. If you are successful, the decrypted results will read:
“You have successfully decrypted this message.
To confirm this key please enter the security code in the field to proceed”
This will be followed by a 12-digit security code. Copy this code and paste it in the box to the right of the words SECURITY CODE below the encrypted message. It should look something like this when properly entered:
Press “Proceed” to continue. If everything goes right, you will see a banner message that reads “You have successfully changed you PGP key.” Your PGP key will now be attached to your account, and you can use it to enable 2-FA for your account if you wish (requires decryption of a message each time you want to log into the market) and receive encrypted messages from other users.
Making a Deposit
MGM Grand uses the old-fashioned market wallet and escrow system, meaning you must first fund your account with Bitcoin (BTC) before placing an order. You cannot place an order for a product unless you have enough BTC in your account wallet to cover the purchase, and there is no Direct Pay (per order payment) or Multisig options available. The market only supports Bitcoin for now, but it appears they have plans to introduce support for Monero in the future. It is recommended you fund your wallet with just enough BTC to cover one order at a time. This will minimize losses if the market should go down or exit scam.
To fund your MGM Grand wallet, first pull up the user menu by clicking on the icon with the 3 lines in the bottom-right of the screen, then click on the option that says “My Wallet” in the menu area. Scroll down and read the explanation for how deposits work, underneath the words Bitcoin Deposit. Note that unlike other markets, MGM Grand provides users with a “permanent deposit address,” meaning this address will never change. Beneath this text you will find your BTC deposit address, which starts with “bc1q…”
Note that it will take 3 confirmations by the Bitcoin network for your deposit to be credited to your account, and that MGM Grand suggests utilizing a Bitcoin mixer as an intermediate to obfuscate the connection between your BTC and the receiving address. This is a recommended precaution as the static deposit address will make it extra easy for adversaries to potentially connect you to your market deposits. In the footer of any market page under INFORMATION there is a link titled “Buy Bitcoins Without ID” which lists some ways to obtain BTC anonymously recommended by MGM Grand.
You can also make withdrawals from your account if you find that you deposited more BTC than you actually need. Withdrawals incur a fee of 0.00015 BTC to cover transaction fees and will require input of your PIN code.
Browsing MGM Grand
The market is divided into a few different section. At top and most prominent is the search option. Only after a search term is entered and results are displayed do advanced search options appear, allowing the buyer to filter search results by vendor name, vendor level, price, category, product type, and ships from/to. You can also sort search results by price, newest, popularity, and most sold. Beneath the search bar on the main page are a list of categories, which include the following (and are further divided into subcategories):
- Fraud (Bank Drops & Logs, CVV & Cards, Dumps, PayPal, Personal Information, Scans & Documents, Carding Services, Travel & Vacations Fraud, Other Fraud)
- Drugs (Benzos, Cannabis & Hash, Dissociatives, Ecstasy, Opioids, Prescription, Steroids, Stimulants, Other Drugs, Paraphernalia, Psychedelics)
- Digital Goods (Accounts, E-Books, Software & Malware, VPN Socks & RDP, Coupon Codes & E-gifts, Other Digital Goods)
- Guides & Tutorials (Drug Guides, Fraud Related Guides, Hacking Tutorials, Security & Anonymity Guides, Social Engineering, Other Tutorials)
- Miscellaneous (Counterfeit Items, Counterfeit Money, Fake IDs, Services, Self Defense, Other)
The most popular of subcategories in terms of listings is Stimulants, with 3,058 total listings. It is closely followed by Cannabis & Hashish at 2,517 listings. While MGM Grand is primarily a drugs market, it does have a large selection of listings for counterfeit money, accounts, credit cards, and the usual assortment of guides and tutorials found on almost every darknet market. It is recommended to make use of the advanced filters and/or sorting options to narrow down listings to those pertinent to your interest, as the market is somewhat large with close to 16,000 listings at present.
Below the categories on the main page is a section called Featured Products which are pictured listing that appear to be paid advertisements. Below this is a section called “Trending Now” which are pictured listings that have been receiving a significant number of user clicks, though they have not necessarily incurred any sales. Next is a section called “Top Vendors” which are vendors on the market with the most sales. If you are looking for a trustworthy, competent vendor, this may be the best way to find them, although you will have to make sure they sell what you’re looking for and deliver to your area.
Clicking on a listing bring you to the product listing page, which displays pertinent information about the item for sale, such as the item’s vendor name, vendor level, product rating (1-5 stars), quantity pricing, product type, escrow vs. FE payment type, ships from/to, description, reviews, and policies specified by the vendor. Here you can also find the quantity of product in stock and the number of times its been purchased by other users of the market.
Note there are also buttons that allow you to contact the vendor (highly encouraged by MGM Grand before placing any order for a physical product with any vendor) and view the vendor’s store. It is recommended that you also read reviews left for the listing before placing an order, and reviewing the vendor’s options for shipping as well.
Clicking on a vendor’s name brings you to their page on the market, which contains important stats and information about that vendor. Next to their name is the total number of page views the vendor has accumulated, their vendor level (1-9, with 9 being the most experienced) how many orders they have completed, how many ratings have been left after purchase, and a breakdown of their disputes by wins and losses. You can also see when the vendor became a member of the market and when they were last online.
Beneath this information box is a custom welcome message from the vendor, followed by their open listings. Beneath the listings is a breakdown of their feedback for three areas: Quality, Communication, and Shipping. Next to this is a count of positive, neutral, and negative reviews. Beneath this is the vendor’s shipping & refund policy, followed by their PGP key. It is recommended that you read through all this information before placing an order with a vendor for their first time. This will help prepare you to meet their expectations when placing an order, and also prepare you to know what to expect.
Placing an Order
After you’ve found a product you wish to purchase and have funded your account with the necessary amount of BTC to cover its cost (plus shipping), select the quantity you wish to purchase from the listing’s page and then press “Add to cart”. You will see a banner message that says “You have added/changed an item!” toward the top of the screen. Click on the cart icon in the upper-right corner of the screen to view the contents of your cart. For a single listing it will look something like this:
If everything about the price and order contents looks good to you (and you’ve confirmed that the vendor will ship to your region), press the “Proceed to checkout” button to continue.
Note before making a purchase: MGM Grand is a bit different from other darknet markets in that they encourage buyers to always initiate contact with the vendor before placing an order. This is so the buyer can be assured that the vendor is not only online and available but actually has the product in the listing on hand. It also serves to cut down on cancelled orders and the chance of miscommunication between buyer and vendor. The market also reminds buyers to never finalize an order placed using standard escrow until after they have received it and confirmed its contents.
After pressing “Proceed to checkout”, you will be brought to an order confirmation screen where you will input your shipping information (for physical goods) or other notes to the seller. Even though MGM Grand says that they will auto-encrypt this message on your behalf, it is recommended that you encrypt the information yourself using the vendor’s PGP key, which can be found on the page of the vendor. This means you will need to import the signature into your PGP utility as a certificate and encrypt the contents of your message there. This is a must-do for any darknet market purchase, no matter how big or small. The Special Requests field for your shipping info should look something like this:
Next, scroll down and review the order info one more time to make sure it is as expected. Also take note if the order being made is using Escrow (standard) or Finalize Early (FE). If it is FE, you will need to finalize the other immediately after it has been accepted or marked as shipped by the vendor. All other orders will require finalization after the item has been received.
If you are satisfied with the price to be paid, scroll down to find the Grand Total in BTC amount. Take note of this number as it is the amount of BTC that will be deducted from your account wallet. Enter your 6-digit PIN code to the left of the Grand Total, then press “Confirm Purchase” to submit the order. If you have enough funds in your wallet to cover the purchase, the order will be marked as received and sent to the seller who will begin preparing it for delivery. You can keep track of the status of your order in the ORDERS menu tab toward the top of most screens. Note that orders have four statuses: Paid, Shipped, Delivered, and Disputed.
After receiving an Escrow order and making sure you are satisfied with it, don’t forget to finalize it so funds can be released to the vendor. If you are not satisfied with the order or it did not arrive within the specified delivery time, you can open a dispute for it in the ORDERS menu tab. This will stop auto-finalization of the order and allow you to send your complaint to market moderators. They will review the complaint and give the vendor a chance to respond. If the dispute resolves in your favor, your funds will be returned to your address. If not, the funds in escrow will be released to the vendor.
MGM Grand URL: duysanjqxo4svh35yqkxxz2xc5tjf6r3ichxd3m2rwcgabf44ad.onion
Conclusion
Approaching its second birthday as of the writing of this guide, MGM Grand seems to be enjoying more popularity than ever, thanks to the recent downtime or closure of some of its biggest competitors. The market has gathered a favorable opinion from its users who find it to be a relatively competent and trustworthy operation, although it seems to leave a fair deal of security risk to its users (no XMR support, using static BTC addresses, not enforcing PGP encryption or 2-FA). Despite this, it has operated in a stable fashion, without any hiccups or downtime, managing to attract a sizable userbase.
Per usual, potential problems caused by an exit scam or other unforeseen closure can be mitigated by never leaving more BTC in your account wallet than is necessary, limiting order placement to smaller-sized purchases, and only placing one order at a time. Even though MGM Grand has a user-friendly appearance and is easy to navigate via mobile device, this is not a market for beginners and users are reminded to remain vigilant in terms of OpSec when placing any sort of order on the market.