Nexus Market Directory

Current Nexus Market onion links and mirrors

This page lists every live nexus market onion link as of the last check, with the role each one plays and when it was verified. Three addresses cover the whole footprint: a primary that handles normal traffic and two backups that pick up the moment the primary wobbles. Keeping this list short is deliberate; more mirrors mean more chances for a stale one to slip in unnoticed.

Before you paste an address into Tor Browser, spend thirty seconds on the anti-phishing code described below. It is the difference between a routine login and explaining to support why your hot wallet is empty.

Full mirror list

The table below is the complete set of nexus market tor mirrors in service. Verify column reflects the most recent manual open in a fresh Tor profile.

AddressStatusLast checked
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onionLive18 Sep 2026
nexusma2iqgauqqvjcgds4ckv5xbf272tkfagq4epojjhsgleqpwxiqd.onionLive18 Sep 2026
nexusabcdrstn74osnr67fsbzbo44kjpxqbbz5ymcwhlxjg6dloyhoyd.onionLive18 Sep 2026

All three resolve to the same marketplace. Only the entry point changes, so your account, orders and deposits carry over unchanged when you switch.

How to verify a mirror

Log in and look for the personal anti-phishing phrase rendered at the top of the dashboard. That phrase is tied to your account, so a fake domain cannot reproduce it. If the phrase is missing, cut off or different from your memory, close the tab and retry from a different nexus market link. Pairing this with PGP-based 2FA means a clone would need both your password and your private key to impersonate a session, which is far less likely than guessing a phrase.

Bookmark the expected phrase somewhere offline, such as a note encrypted with your PGP key, so you are comparing against a reference you control rather than trusting a screen.

When a mirror will not open

A black screen or endless circuit usually points to a DDoS hitting that entry node. Give it a few minutes, then hop to the next mirror in the list. Rotation of a mirror's key also looks like a dead address to anyone holding the old one, so if the "last checked" date here is newer than your copy, refresh the address. Do not assume a non-loading mirror means the market is down; the other two are almost always carrying traffic while one absorbs a wave.

If all three refuse to connect, wait an hour and retry rather than hunting random links found in comments, which is where most phishing traps hide.

Why the addresses change

Entry nodes get probed constantly, so the market rotates them to stay ahead. A rotation can follow a DDoS spike, a suspected compromise of a guard node, or simply a scheduled refresh. The frequency has settled to roughly a handful of changes per year across the set, not daily churn. Each rotation is announced with a fresh verification date on this page, and the anti-phishing phrase stays constant through a rotation, giving you a stable way to confirm you reached the real site after the swap.

Saving the links safely

Store the addresses in a bookmark inside Tor Browser plus a second copy in an encrypted location, such as a GPG-encrypted text file or a password manager field. Keep the offline copy updated whenever a rotation lands, and jot the current anti-phishing phrase next to it. Avoid pasting mirrors into plaintext notes, group chats or screenshots that outlive the conversation, since a single leaked address is not dangerous by itself but a leaked address plus a known phrase weakens your ability to spot a clone quickly.

Frequently asked questions

Which of these links should I use first?

Start with the Primary row. If it loads and the anti-phishing phrase matches, stay there. Move to Backup A only when the primary is slow or unreachable, and to Backup B if both of the others are down.

Are the backup mirrors slower than the primary?

Slightly, because they run smaller capacity. In practice the difference is a few seconds on first load, and it is a worthwhile trade when the primary is under attack.

What is the difference between a rotation and a DDoS?

A DDoS makes a live address slow or unresponsive temporarily, while a rotation retires the address entirely and issues a new one. After a rotation the old string stops resolving, so you need the updated address from this list.

How often are the addresses re-tested?

At least every few days, and immediately after any reported outage or announced rotation. The "last checked" column is stamped each time a mirror passes a clean open in a fresh Tor profile.

Can I trust a mirror I find posted in a forum thread?

Treat it as suspect until you verify it here. Forums age, and an outdated post often still carries a retired address that a phisher has taken over. Cross-check any external link against this table before typing a password.

What do I lose if I switch mid-order?

Nothing. The mirrors front the same backend, so an in-progress order, open escrow and pending deposits survive the switch. Your session continues after you log back in on the new address.