Blog

This guide will teach you all you need to know about connecting to the AlphaBay darknet market.

AlphaBay is a darknet market that first opened for business in 2014. It is only second in popularity to the original Silk Road. Alexander Cazes (alpha02), its founder and head administrator, famously committed suicide in a prison cell while awaiting extradition to the United States. The community praised AlphaBay at the time for being a pretty tight-knit operation, and Cazes’ arrest was the consequence of a single slip-up in OpSec before the market surged in popularity.

DeSnake, one of the market’s other admins, posted a PGP-signed message on the Dread darknet forum in early August 2021, four years to the day AlphaBay went offline. The message announced that AlphaBay was back in operation, using the original market design and layout but with significant upgrades. The market is now Monero-only, with significant restrictions on what may be offered and no support for users in certain parts of the world.

We can’t help but note how quiet AlphaBay remains almost two months after its grandiose “re-opening.” The market has experienced some major connectivity and downtime troubles, no doubt as a result of being assaulted by competitors or who knows what else.

According to the welcome message displayed to new accounts, AlphaBay’s administrators are dedicated to providing a first-rate darknet market experience, giving the following insights:

“AlphaBay has always been a marketplace based on principles, vision, and community. The administration is nearly identical to that of the 2014-2017 period, which means that AlphaBay will once again run with mature management, unparalleled security, 24/7 professional and well-trained staff, and, of course, a unique vision for the future not only for itself but also for the darknet market scene.”

The market’s administration emphasizes its preparations to address any potential problems, stating that they “have taken many months to build and perfect the system as well as beta test it and we are very proud of our achievement.” A welcome message details their advanced protection methods and failsafes. A “Roadmap” tab contains information about efforts to develop a decentralized darknet market. It’s impossible to know how much of this is true, but AlphaBay appears to be a well-oiled machine — the consequence of several years in the industry.

AlphaBay has taken a wise position on its restrictions, not permitting any fentanyl-containing drugs, covid-related things, or the regular prohibited items. Perhaps most importantly, they have prohibited the sale of anything related to ransomware. AlphaBay has excluded activities from some CIS nations, including Russia, Belarus, Kazakhstan, Armenia, and Kyrgyzstan.

One annoyance with the “new” AlphaBay is the DDOS and spammer prevention filters, which can make logging in (and staying logged in) a real pain, especially if you are the type who drifts away for two minutes, only to discover your session has expired, requiring you to solve another captcha and restart the process. At the very least, it looks like they are making a serious attempt to keep things operating, despite the obviously overwhelming odds against them.

In any case, for those willing to wait, AlphaBay may show to be the real deal. You’ll know this is the case when they show you the merchants. Our ultimate opinion is that you should wait until you see some familiar vendor names join the market and there’s a little more buzz about it elsewhere. For the time being, it appears to be a gamble, but then again, most things are.

AlphaBay in a Nutshell

• AlphaBay Market link – alphabay522szl32u4ci5e3iokdtyth56ei7rwngr2wm7i5jo54j2eid
• Founded: 2014
• Number of listings: 330
• Listing categories: Fraud, Hacking & Spam, Malware, Drugs & Chemicals, Services, Security & Hosting, Guides & Tutorials, Software, Digital Items, Websites & Graphic Design, Jewels & Precious Metals, Counterfeit Items, Carded Items, Automotive-related Items, Legitimate Items, Other Listings
• Coins accepted: Monero (XMR)
• Multisignature escrow: No
• Finalize Early (FE) Allowed: Yes
• Vendor bond: 1 XMR

Prior to Beginning

Before attempting to use a darknet market like AlphaBay, you should have at least a basic awareness of the following topics:

• Tor. You will need to download and install the Tor browser to access hidden services sites (websites ending with the ‘.onion’ suffix).
• OpSec. Take a moment to familiarize yourself with the idea of operations security (OpSec). Besides never using your real-life name as a login name, a prime example of darknet OpSec would be never sending cryptocurrency to a market straight from an exchange.
• Cryptocurrency. You will need to know the basics of sending and receiving cryptocurrency, specifically as it applies to Monero (XMR).

Disclaimer: This guide’s contents are intended solely for research purposes. The authors of this book do not condone the use of this guidance to engage in any criminal activities in your jurisdiction.

Creating an Account

There is now only one (1) official AlphaBay market URL. They will very certainly have some type of captcha that must be overcome before reaching the login page, and users will be placed in a queue if there is currently considerable traffic. The captcha is a bit difficult, and if you fail it three times in a row, you’ll be presented with the message,

“Captcha failed far too frequently. Retry in 30 seconds with a different identification.”

In this scenario, simply use the Tor browser’s New Identity (broom) button to re-visit the AlphaBay URL, and once you’ve solved the captcha, you’ll be taken to the main Login screen. You’ll notice a message beneath the term “Login” that says “Not registered? “Register here.” To access the account registration page, click the second part of the message.

It is important to note that your “Name” is what other users in the market see you as, whereas your “Username” is your login credential, which you submit alongside your password. We advocate keeping your personal name and any online identities separate. The same is true for your password: pick something unique and never reuse market credentials.

After you’ve typed your password twice, choose a 6-digit PIN for future purchases. Finally, choose “User” as the account type you want to create, fill out the captcha, and click “Register” to get started. If everything goes as intended, you will be returned to the login screen, where you must enter your newly established username and password.

After logging in, you’ll get a special message with your account’s wallet recovery key and recovery phrase. If you ever lose access to your account or account wallet, you’ll need these to get back in.

After saving this information somewhere safe, scroll down and read over the AlphaBay guidelines, which are displayed in the introductory welcome page for your convenience. There is a lot to read, and your session may end before you finish it all. However, once you’ve finished reading it, you’ll discover a button that says “I accept & understand the rules.” I have saved the information above.” After you have completed its instructions, click this button to be taken to the main market page, along with another welcome message.

Check to see if you can read the captcha before entering your credentials while checking in. This can save you a lot of time that would otherwise be lost by having to re-enter your login information.

You can now begin browsing the market, but before making any purchases, you must first assign a PGP key to your account.

Making a PGP Key

AlphaBay suggests that all communications be encrypted on their own. After all, it is the only method to ensure that your messages are only read by the designated recipient. To begin, mouse over the “My Cabinet” button in the upper menu bar area and click “Account Settings.” Then, in the Account panel on the left side of the screen, click the “Public PGP / Enable 2FA” option under Account Settings.

Paste your PGP public key into the appropriate text box and enter your password again under “Current Password.” Check the “Enable PGP Two-Factor Authentication(2FA)” box beneath the PGP key text box if you want to utilize your PGP key as a 2-FA method. Each time you log in to your account, you will be required to decrypt a message delivered to you. When completed correctly, the screen should appear like this:

When you’re ready to proceed, click the “Edit PGP / 2FA Settings” button.

Please keep in mind that, for whatever reason, AlphaBay is quite picky about how PGP keys are entered. It may refuse to accept a key including comments, such as those created by Kleopatra by default. If you encounter recurrent key enter errors, delete the non-key information at the top (the sections preceded by the word “Comment:”).

Once accepted by the system, you’ll be returned to the key and given a new button that says “VERIFY PGP.” To proceed, click that. You will be taken to a page that says “Enter Verification Token.” Decrypting the message revealed beneath will yield this token. Copy the message’s whole contents and decode it with your PGP software. Paste the “Your AlphaBay 2-FA Verification Code:” code portion of the message into the “pgp-verification-token” space below.

After clicking the “Verify Your PGP Key” button, you will be returned to the PGP website with a fresh green message that says “VERIFIED.” Your PGP key has been successfully associated with your account.

Making a Down Payment

Before making a purchase, you must first deposit Monero (XMR). AlphaBay employs a typical escrow mechanism, albeit they claim the monies are more securely held than in most marketplaces and can still be recovered if the market falls. We haven’t thoroughly investigated their claims, however we recommend only depositing enough XMR for one order at a time.

Click on the XMR balance under your login name in the upper-right corner of the screen to find your deposit address. Take a few moments to read the information given regarding the market’s deposit and withdrawal system. Scroll down until you see the captcha and an orange button that says “I agree with and understand the instructions.” “Obtain a Monero Address.”

Your XMR deposit address will be generated after you solve the captcha and push the button.

Please keep in mind that each address is only valid for one deposit. This means that you should never deposit multiple times to the same address. Deposits are normally shown in your account balance after 10 confirmations, which takes about half an hour. Your deposit address will then be changed to a new one.

Clicking on the bar button beneath the address reveals a PGP-signed message from AlphaBay that includes the address. This allows you to confirm that the deposit address belongs to the market and not a phishing site. Add “/pgp.txt” at the end of the verified AlphaBay URL, after “.onion,” to get the market’s PGP public key. If you are confident that you are on the only confirmed URL for this market, this step is unnecessary; still, it is not a terrible idea to practice confirming a PGP message.

Shopping at the Market

If you were familiar with AlphaBay when it originally appeared, you’ll note the market layout is nearly same, with a few small differences. One notable difference is the complete absence of prominent sellers and featured listings in categories. While this makes the main pages appear a little lonely, the market does this to ensure that all vendors have an equal starting point. To view listings, first select a category and then a subcategory if necessary. The market features a small number of listings (less than 400 at the time of writing this guide), which are distributed throughout dozens of subcategories. Currently, the most popular categories (and subcategories) are:

• Fraud (Accounts & Bank Drops, CVV & Cards, Personal Info)
• Hacking & Spam (Exploits, Hacking Tools & Scripts)
• Drugs & Chemicals (Benzos, Cannabis & Hashish, Dissociatives, Ecstasy, Opioids, Prescription, Stimulants, Psychedelics)
• Guides & Tutorials (Fraud Guides, Security & Anonymity Guides)

The Quick Search option is positioned in the center of the main market page. There are a variety of filters in the lower left panel, but there are so few entries that navigating through them isn’t a difficulty at this point.

Here’s an example of a subcategory page (note the lack of ship to/from information):

When you click on the listing, you’ll see the following information:

More advanced information about the product is available here, including the quantity sold, product images, ship to/from information, payment kinds accepted, shipping choices, and purchase price. Scrolling down, we notice tabs for the product description, consumer reviews, and the vendor’s refund policy. Give these tabs a good readthrough because it will prepare you for what to expect as well as what they expect.

Making a Purchase

When you’re ready to buy, choose your shipping method and quantity first. Take note of the pricing in XMR. If this is OK to you, click “Buy Now” to proceed. If this is your first time ordering from AlphaBay, we recommend reading their guidelines rather than just skimming through them because they contain many of the finer aspects of the order procedure that are not covered here.

The vendor’s PGP key is hidden beneath AlphaBay’s rules. Import this key into your PGP application so that you can encrypt shipping details for your order. Next, go over the order total, keeping in mind that you’ll need enough XMR in your account balance to cover the sum shown.

This is followed by the vendor’s refund policy and a text box into which you will paste your encrypted shipping details. When appropriately filled, the text box will look like this:

In theory, it makes no difference whether you select or uncheck the “Encrypt messages/notes using Sellers PGP Key” option because you have already done so. It would be pointless to make them decrypt the contents again. Never send shipping information that is not encrypted (its probably fine for general questions). When you’re ready, click the “Confirm Purchase” button to continue. The order total will be debited from your account balance, and the seller will begin packing and shipping your purchase.

When placing an order on AlphaBay, purchasers should keep the following in mind:

“The procedure differs from other marketplaces in that we have expanded on some features from what we have previously learned about running a successful marketplace, making it more streamlined and easier for all parties involved to conduct business more quickly and safely.”

All purchases are made through AlphaBay escrow, which means that the market will hold your funds until you have marked the order as finalized and paid the vendor. It is regarded customary buyer etiquette to finalize the order when you have received it and concluded that it meets your expectations.

Before the order is auto-finalized, the customer has 7 days from the time of purchase to designate it as received. If you have not received the order within this period, the auto-finish time might be extended, and the market suggests that you never finalize an order before receiving it (unless you are using a FE-enabled vendor; in which case payment should be finalized after the vendor has market it as shipped – as of now no vendors have this option enabled).

AlphaBay’s Automatic Dispute Resolution mechanism, which makes it easier for buyers and sellers to hash out a deal before involving a moderator, is a fascinating addition. The new approach, according to the market, is “essentially a proposition system between buyer and seller involving escrow time extension, full refund, percentage refund, or replacement choices.”

Disputes necessitate a response from the seller within three days. If the seller does not react, the buyer’s money will be returned to their bank account. Of course, it’s preferable to avoid getting to that stage in the first place. We advocate only dealing with higher-rated providers who have a track record of success. At the moment, this excludes every vendor on AlphaBay (take it or leave it, but it might be a good idea to wait until the market becomes more established before becoming a guinea pig in a relatively new experiment).

Summary

AlphaBay’s second incarnation is still relatively new (DeSnake claims it’s the same market, not a “2.0”), and as such it hasn’t had much time to acquire sellers. We didn’t observe a single sale from any of the promoted product merchants or anywhere else. The market administrators appear to have put a lot of consideration into implementing changes, some of which haven’t been seen or discussed anywhere else.

In conclusion, we can only repeat what was stated at the end of the previous section: it may be prudent to let someone else do the pioneering at the “revived” AlphaBay and wait for vendors to build up a few sales before deciding to participate. At the moment, dealers are attempting to give free stuff – literally offering pills for pennies as introductory deals – but there are no takers. Not that this is inherently a danger sign, but the market is now entering territory only shared by Silk Road by seeking to resuscitate a darknet brand name, and they’ve had a poor start so far.