A Complete Guide to the new AlphaBay Darknet Market

In this guide we explain everything you need to know to get connected to the AlphaBay darknet market.

Second in notoriety only to the original Silk Road, AlphaBay is a darknet market that initially opened for business in 2014. Its founder and head administrator, Alexander Cazes (alpha02), famously took his own life in a jail cell while awaiting extradition to the United States. AlphaBay was hailed by the community as a relatively tight-run operation at the time, and the arrest of Cazes was the result of one slip-up in OpSec committed before the market exploded in popularity.

In early August 2021 – four years to the date AlphaBay went offline, a PGP-signed message was posted on the Dread darknet forum by one of the market’s other administrators, DeSnake. The message announced that AlphaBay was back open for business, featuring the original market design and layout but with some substantial improvements. The market is now Monero-only, has substantial limitations on what can be sold, and does not support users in certain parts of the world.

After almost two months since AlphaBay’s big “re-open,” we can’t help but notice how quiet it still is there. The market has been plagued with some serious connection and downtime issues — no doubt the result of being attacked by competitors or who knows else.

According to the welcome message shown to new accounts, AlphaBay’s admins are committed to providing a top notch darknet market experience, offering the following insights:

“AlphaBay has always been a principle-driven, vision-oriented and community-centered marketplace. The administration is almost the same as in the 2014-2017 period which means you will find again AlphaBay runs with mature management, unparalleled security, 24/7 professional & well-trained Staff and of course unique vision for the future not only for itself but for the darknet market scene too.”

The market’s administration places heavy emphasis on its preparations to resolve any potential problem that may arise, stating that they “have taken many months to build and perfect the system as well as beta test it and we are very proud of our achievement.” A welcome message goes into detail about their advanced protection methods and failsafes. Info in a “Roadmap” tab alludes to plans to create decentralized darknet market. It’s impossible to know how much of this is for real, but AlphaBay feels like a well-honed operation — the result of several years’ experience in the business.

AlphaBay has taken a rather smart stance to its rules by not allowing any fentanyl-containing products, covid-related materials, along with the usual outlawed stuff. Perhaps most important is their ban on sales of anything related to ransomware, as well. Somewhat interestingly, AlphaBay has excluded activity from specific CIS countries, including Russia, Belarus, Kazakhstan, Armenia, and Kyrgyzstan.

One thing that is a bit annoying about the “new” AlphaBay is the DDOS and spammer prevention filters which can make logging in (and staying logged in) a real headache, especially if you are the type who drifts away for two minutes, you will find your session has expired, need to solve another captcha, and begin the process anew. At the very least it appears they are making a genuine effort to keep things up and running, despite admittedly incredible odds against them.

In any case, for those who are patient, AlphaBay could prove themselves to be the real deal. You’ll know this is the case when they have the vendors to show for it. Our final verdict is that it may be a good idea to hold off until you see some recognizable vendor names join the market, and there’s perhaps a bit more chatter about it elsewhere. For now, it appears to be something of a gamble, but then again, most things are.

Quick Facts about AlphaBay

• AlphaBay Market link – alphabay522szl32u4ci5e3iokdsyth56ei7rwngr2wm7i5jo54j2eid.onion
• Founded: 2014
• Number of listings: 330
• Listing categories: Fraud, Hacking & Spam, Malware, Drugs & Chemicals, Services, Security & Hosting, Guides & Tutorials, Software, Digital Items, Websites & Graphic Design, Jewels & Precious Metals, Counterfeit Items, Carded Items, Automotive-related Items, Legitimate Items, Other Listings
• Coins accepted: Monero (XMR)
• Multisignature escrow: No
• Finalize Early (FE) Allowed: Yes
• Vendor bond: 1 XMR

Before Getting Started

There are a few subjects in which you need to have at least a moderate amount of understanding before attempting to use a darknet market like AlphaBay:

• Tor. You will need to download and install the Tor browser to access hidden services sites (websites ending with the ‘.onion’ suffix).
• OpSec. Take a moment to familiarize yourself with the idea of operations security (OpSec). Besides never using your real-life name as a login name, a prime example of darknet OpSec would be never sending cryptocurrency to a market straight from an exchange.
• Cryptocurrency. You will need to know the basics of sending and receiving cryptocurrency, specifically as it applies to Monero (XMR).

Disclaimer: The contents of this guide are meant to be used for research purposes only. The authors of this guide do not condone use of this guide to engage in any behavior which may be considered illegal under your jurisdiction.

Registering an Account

For now, there is only one (1) official AlphaBay market URL. They will undoubtedly have some sort of captcha that must be solved before the login page can be reached, and users are placed in a queue if there is currently high traffic. The captcha is a bit tough and if you fail it three times in a row, you’ll be greeted with a message that reads,

“Captcha failed too many times. Try again in 30 seconds with a new identity.”

In this case, just press the New Identity (broom) button on the Tor browser and re-visit the AlphaBay URL. After you manage to solve the captcha, you’ll be brought to the main Login screen. You’ll notice that right beneath the word “Login” is a message that says “Not registered? Register here.” Click the second half of the message to go to the account registration page.

Note that your “Name” is what other users in the market see you as, whereas “Username” is your login credential, entered alongside your password. We recommend keeping both names separate from your real life or other online identities. Same thing goes with your password: choose something unique, and never re-use market credentials.

After you have entered your password twice, select a 6-digit PIN that will be used for purchases. Finally select “User” as the account type you wish to register, fill the captcha, and press “Register” to create your account. If everything goes as planned, you’ll be transported back to the login screen, where you will need to enter your freshly-created username and password.

After logging in, you’ll be greeted with a unique notice containing your account’s wallet recovery key and recovery phrase. If you ever get locked out of your account or account wallet, you’ll need these to regain access to them.

After saving this info someplace secure, scroll down and take a read through the AlphaBay rules, presented in the introductory welcome screen for your easy reference. There is admittedly a lot to read, and your session may timeout before reading it all. But when you are done reading it, you’ll notice there is a button that says “I agree & understand the rules. I have saved the information above.” Click this button after you have completed its instructions, and you will be brought to the main market page, along with another welcome message.

Tip: Check to make sure you can read the captcha before bothering to enter your credentials when logging in. This can save you a lot of time potentially wasted by having to re-enter your login info.

You can now start browsing the market but will need to assign a PGP key to your account before making any purchases.

Setting a PGP Key

AlphaBay recommends users encrypt all their communications on their own. After all, it is the only way you can be 100% sure that your messages will be read by the intended recipient only. To get started doing this, hover over the “My Cabinet” tab in the top menu bar area, then select “Account Settings”. Next, click the “Public PGP / Enable 2FA” option under Account Settings in the Account panel on the left side of the screen.

Paste your PGP public key in the corresponding text box and re-enter your password under “Current Password”. If you want to use your PGP key as a 2-FA method, check the “Enable PGP Two-Factor Authentication(2FA)” box beneath the PGP key text box. This will require you to decrypt a message sent to you before logging in to your account each time. When filled correctly, the screen should look something like this:

Press the “Edit PGP / 2FA Settings” button once you are ready to continue.

Note: For whatever reason, AlphaBay is especially finnicky about how PGP keys are entered. It may not accept a key that contains comments, as those generated by Kleopatra by default. Deleting the non-key information at the top (the parts prefaced by the word “Comment:”) tends to solve the problem if you have repeated key entry failures.

Once accepted by the system, you’ll be transported back to the key with a new button that says “VERIFY PGP”. Click that to continue. You will be brought to a screen that says “Enter Verification Token”. This token can be found by decrypting the message displayed beneath. Copy the entire contents of the message and decrypt it using your PGP utility. Paste the code portion of the message that follows the text, “Your AlphaBay 2-FA Verification Code:” into the “pgp-verification-token” field below.

After pressing the “Verify Your PGP Key” button, you will be brought back to the PGP page with a new message in green that says “VERIFIED”. Your PGP key has now been successfully attached to your account.

Making a Deposit

You will need to make a deposit of Monero (XMR) before making a purchase. AlphaBay uses in effect the traditional escrow system, although they claim the funds are more securely held than most markets and can still be recovered in the event the market should go down. We haven’t fully tested their claims but recommend only depositing enough XMR for one order at a time.

To find your deposit address, click on the XMR balance under your login name toward the upper-right corner of the screen. Take a moment to read the info displayed about how the market’s deposit and withdrawal system works. After doing so, scroll down until you see the captcha and the orange button which reads “I agree with and understand the instructions. Get Monero Address”.

After solving the captcha and pressing the button, your XMR deposit address will be generated.

Note that each address is good for one deposit only. This means you should never make multiple deposits to the same address. Deposits will be reflected in your account balance after 10 confirmations, which is usually within half an hour. Afterward, your deposit address will be changed to a new one.

Clicking on the bar button below the address will reveal a PGP signed message from AlphaBay which contains the address in it. This is a way for you to verify that the deposit address actually belongs to the market and not a phishing site. To find the market’s PGP public key, affix “/pgp.txt” to the end of the verified AlphaBay URL, after “.onion”. If you are sure you are on the one and only verified URL for this market, this is an unnecessary step, but still its not a bad idea to get the practice of verifying a PGP message.

Browsing the Market

If you were familiar with AlphaBay the first time it was around, you’ll notice the market layout is almost identical, except for a few minor changes. For example, one thing a bit different is their complete lack of featured vendors and featured listings in categories. While this makes the main pages look somewhat lonely, the market does this to ensure all vendors have an equal start. To see listings, you need to first click on a category and then subcategory where appropriate. The market has few listings (less than 400 at the time of writing this guide) spread out across dozens of subcategories. The most popular categories (and subcategories) are currently:

• Fraud (Accounts & Bank Drops, CVV & Cards, Personal Info)
• Hacking & Spam (Exploits, Hacking Tools & Scripts)
• Drugs & Chemicals (Benzos, Cannabis & Hashish, Dissociatives, Ecstasy, Opioids, Prescription, Stimulants, Psychedelics)
• Guides & Tutorials (Fraud Guides, Security & Anonymity Guides)

There is a Quick Search feature located in the middle of the main market page. In the lower left panel there is a diverse array of filters, but there are so few listings that sorting through them is far from a problem at this point.

Here is an example of a subcategory page (notice the ship to/from info isn’t readily available):

Clicking on the listing reveals the following information:

Here we can see more advanced information about the product, including quantity sold, product pictures, ship to/from info, payment types accepted, shipping options, and purchase price. Scrolling down a bit we see tabs for the product description, feedback left by buyers, and the vendor’s refund policy. Be sure to give these tabs a thorough readthrough because it will prepare you in terms of what to expect and what they expect, as well.

Placing an Order

When you are ready to make a purchase, first set the shipping option you want and quantity. Note the price you will pay in XMR. If this is fine with you, press “Buy Now” to continue. If this is your first time placing an order on AlphaBay, we recommend reading their rules instead of just scrolling through them as they contain many of the finer nuances of the order process not described here.

Down beneath AlphaBay’s rules is the vendor’s PGP key. Import this key into your PGP application as you will use it to encrypt shipping information for your order. Next, review the order total and keep in mind you will need enough XMR in your account balance to cover the amount displayed.

Beneath this is the vendor’s refund policy, followed by a text box into which you will paste your encrypted shipping information. When filled correctly, the text box will look something like this:

Theoretically it doesn’t matter if you check or uncheck the “Encrypt messages/notes with Sellers PGP Key” box because you have done so already. Forcing them to decrypt the contents twice would be unnecessary. Never send unencrypted shipping information (its probably fine for general questions). After you are ready, press the “Confirm Purchase” button to proceed. The order total will be deducted from account balance, and the vendor will begin preparing your order for shipping.

AlphaBay provides buyers with the following caveat when placing an order:

“The process is different from other marketplaces as we have built upon certain elements from what we have previously learned running a successful marketplace, making it more streamlined and easier for all parties involved to conduct business faster and more securely.”

All purchases are conducted through AlphaBay escrow, which means the market will hold your funds until you have marked the order as finalized and released payment to the vendor. Be sure to finalize the order after you have received it and determined it to be of your expectations, as this is considered proper buyer etiquette.

The buyer has 7 days from the time or purchase to mark the order as received before it is auto-finalized. If you have not received the order within this time, the auto-finalize time can be extended, and the market recommends never finalizing an order before you have received it (unless you are using a FE-enabled vendor; in which case payment should be finalized after the vendor has market it as shipped – as of now no vendors have this option enabled).

A novel element added by AlphaBay is their Automatic Dispute Resolution system, which makes it easier for buyers and sellers to work out a deal with each other before getting a moderator involved. According to the market, the new system is “basically a proposition system between buyer and seller involving extending escrow time, full refund, percentage refund or replacement options.”

Disputes require the seller to respond within 3 days. If the seller does not respond, the buyer’s payment will be refunded back to their account. Of course, its better to never have to get to that point in the first place. We recommend sticking only with higher-rated vendors with a number of sales under their belt. At the moment, this excludes every vendor on AlphaBay (make of this advice what you will, but it might be a good idea to wait until the market becomes a bit more established instead of becoming a guinea pig in a relatively new experiment).

Conclusion

AlphaBay is still very new in its second incarnation (DeSnake insists it’s the same market, not a “2.0”) and as such it hasn’t had a lot of time to accumulate vendors. We didn’t see a single sale under any of the vendors of featured products, or elsewhere. The market admins seem to have put a great deal of thought into incorporating improvements, some of which haven’t been seen or described elsewhere.

In conclusion, what can we say, other than to re-iterate what was stated at the end of the section above: it may be wise to let somebody else do the pioneering at the “revived” AlphaBay and wait for vendors to rack up a few sales under their belt before deciding to take part. At present, there are vendors trying to give product away – literally selling pills for pennies as introductory offers – and they have no takers. Not that this is a warning sign necessarily, but the market is entering territory shared only by Silk Road at this point by attempting to revive a darknet brand name, and so far they’ve been off to a slow start.