The market, profiled without the hype
DrugHub is the long-runner that inherited the ruins. It merged with SuperMarket in the early 2020s and, following the collapse wave that took Archetyp, Abacus, Incognito, Bohemia and Versus, became the default landing site for migrating vendors and buyers. Six years of uptime is the marketing claim; the interesting part is how the design choices below make that claim survivable.
Design decisions, read charitably and uncharitably
Passwordless PGP login
Your key pair is the credential — no username, no password, enforced signature-based 2FA. Uncharitably: lose the key, lose the account, and support cannot help you, because support cannot prove you are you. Charitably: there is nothing to phish, spray or breach at scale; the sign-in message turns every login into a mutual-auth handshake. Browsing needs no login at all, which also removes the excuse to hand over a credential on a clone.
Invoice-based XMR, zero deposit
Money moves per-order through Monero invoices; the market runs no hot wallet on web-facing servers and keeps its own wallet for refunds only. Withdrawals clear from offline batches, averaging ~18 hours. You cannot lose a balance that was never custodied — the failure mode the industry kept re-litigating.
Enforced E2EE everywhere
All non-system messages are end-to-end encrypted; staff keys enter only in disputes. Since 2026-09-11 addresses and tracking numbers must be PGP-encrypted in both directions. On seizure, encrypted content is simply unrecoverable — the whole point of the policy, and the reason the official encryption helpers (v1.4, Go/Python, source-distributed and PGP-signed) exist.
Unique private mirrors, PoW public ones
Public endpoints are DDoS bait and take the hits behind proof-of-work; every account that qualifies gets its own unpublished session-bound onion, vendors get two. The architecture concedes that shared links are attackable, and removes the target for anyone who earns a private one. Details and eligibility: the onion page; the incident record: the wire.
Deliberate forgetting
Accounts idle six months are deleted quarterly. Retention is risk, and the purge schedule says the operators know it. Buyers who go quiet lose everything with no recovery path — annoying by design.
What it is not
Not pretty: the UI is functional, the onboarding is self-service, and the voice is blunt — “we will not hold your hand”. It is explicitly absent from external platforms (no staff on Dread/Telegram/Session — see FAQ). It bans RF/CIS users outright. And since the 2026-10-03 change, orders above 0.8 XMR carry an optional 12-hour review window — a hint the operators know escrow-free ordering still frightens first-timers. Read the money model and vendor rules before deciding anything.