BlackOps Market Audit OSINT audit desk
No affiliation
BlackOps Market · Edition 12.4 · Updated 21 October 2026

BlackOps Market: trust score, current status and clone risk

BlackOps Market is a Tor-only marketplace that opened in July 2025, absorbed a large share of the users displaced by the Archetyp seizure and the Abacus exit scam, and now carries the strongest payment-privacy design in the ecosystem — and the worst brand hygiene. We audit it on eight weighted criteria, publish the evidence, and refuse to publish a single onion link.

Status Active Launch July 2025 (evidenced) Trust score 66.6 / 100 Band B — Conditional Confidence Medium · 58.6–74.6 Claims verified 2 of 12
Read the full BlackOps review Compare with Nexus and Torzon Security guide
Facts first

BlackOps Market at a glance

Every figure below is sourced and dated. Where a number comes from the platform itself rather than from an independent source, it says so. Where we could not verify it, it is marked unverified rather than repeated.

What BlackOps Market is

BlackOps Market is a general-purpose Tor marketplace that launched in July 2025. It operates exclusively through v3 onion addresses, requires an account and a PGP key before a session begins, and is described as settling exclusively in Monero with a 2-of-3 multisignature escrow. It sells the conventional category set — physical shipments, digital goods, financial instruments and services — and it is one of three English-language marketplaces that Europol's 2026 threat assessment names as the largest by listing count at the end of 2025.

Its customer base is not organic. It is the residue of two collapses: the coordinated seizure of Archetyp in June 2025 and the exit scam of Abacus in July 2025. Vendors with multi-year reputations arrived with the traffic, which is the strongest argument for the platform and also the reason it is now large enough to matter to everyone who used to watch Archetyp and Abacus.

Verified record

  • Launch dateJuly 2025 — Europol IOCTA 2026
  • NetworkTor, v3 onion addresses only
  • SettlementMonero only (Bitcoin reported rejected)
  • Escrow2-of-3 multisig, third-party arbiter key
  • MessagingMandatory PGP, 4096-bit
  • Second factorPGP challenge-response (unverified)
  • Front endNo-JavaScript (unverified)
  • Vendor bondReported, no primary source
  • Trust score66.6 / 100 — band B, conditional
  • ConfidenceMedium — interval 58.6 to 74.6
  • Operating historyAbout 15 months
  • Onion linksNot published, by policy
Trust score

66.6 out of 100, and why that is not a recommendation

The score is a weighted mean across eight dimensions, published in full and reproducible from the model. Because our confidence in the platform's own claims is medium, we report an interval rather than a point. Two points either side of 66.6 is the honest width of that answer.

The direct question

Is BlackOps Market safe?

No. Not in the way the word is used in the directory pages, and not in any sense that would let a reader make a decision from one sentence. Here is the question answered in full, because the search that brings people to this page is usually this question, and a refusal to answer it would be its own kind of dishonesty.

What is genuinely strong

Three things, and they are real. First, settlement in Monero only, which removes the transaction graph before a chain-analytics firm can cluster it. Second, mandatory PGP with a challenge-response second factor, which is materially stronger than a one-time code, because a phishing clone can collect a pasted code but cannot produce a valid session without a private key it does not hold. Third, a 2-of-3 multisignature escrow with a third-party arbiter, which raises the cost of an exit scam from one compromised machine to two. Add a reported no-JavaScript front end and the platform's attack surface on the client side is genuinely smaller than the norm.

What is genuinely weak

Three other things, and they are equally real. The platform has roughly fifteen months of operating history, which is not a track record; it is a launch date. Almost every quantitative claim about it is self-reported — the user count, the vendor count, the uptime figure, the bond size — and we could verify only two of twelve claims to a primary source. And its brand name is the single most dangerous asset in the ecosystem: a search for the market returns dozens of clearnet sites calling themselves the official gateway, most of them advertising, several of them credential-harvesting clones, and all of them publishing mutually incompatible origin dates.

The uncomfortable part

Even a perfect score would not make this platform safe, and the reason is structural rather than a criticism of BlackOps specifically. A marketplace holds other people's money, the operator's incentives eventually diverge from the users', and a large escrow balance is the exit condition. Every catastrophic loss in this ecosystem since 2014 has been an escrow event. The honest framing is that BlackOps has the best current design for a thing that is inherently unsafe, and a design is not a guarantee — especially when the party describing the design is also the party who benefits from your confidence in it.

◈ What we are not saying

We are not saying that BlackOps Market is a honeypot, a law-enforcement trap, or a scam. We are not saying it is safe either. We are saying that the published evidence supports a conditional assessment, that the assessment has a stated interval, and that the two claims most of the directory layer makes on the platform's behalf are unverified. That is the whole of what we know, and it is stated as what it is.

How it works

The BlackOps Market architecture, and which parts we believe

Four components carry the platform's risk profile. Three of them are credible designs that we can explain and defend; the fourth is the reason its users keep losing money to pages that are not the market at all.

01 · Monero-only settlement

Bitcoin's ledger is public and permanent, and the heuristics that turn it into a map of a person are commercially available products. Chainalysis recorded darknet markets and fraud shops receiving just over two billion dollars in Bitcoin on-chain during 2024, which is the volume at which clustering becomes reliable. Monero removes the graph before it is created: ring signatures prevent a transaction being linked to its inputs, stealth addresses prevent a receiver being linked to an account, and RingCT hides the amount.

Assessment: the strongest single design decision in the audited set. Corroborated by the primary reporting, so it is one of the two claims we mark verified.

02 · 2-of-3 multisignature escrow

Escrow has been the primary vector for exit scams in this ecosystem: Wall Street Market in 2021, Incognito in 2024, Abacus in 2025, Nexus in 2026. Multisignature escrow replaces the single custodial key with three, so no one party can move funds alone. It genuinely raises the cost of a scam, and it is why the architecture is defensible.

It does not make the platform safe. It does not help if a key is seized and used alongside a coerced counterparty, it does not help against a platform that simply stops existing, and — critically — no user can verify the key distribution from outside. That is the lesson the Nexus post-mortem teaches, and it applies here unchanged.

Assessment: plausible and consistently reported, but unverifiable from outside. Marked partial, not verified.

03 · PGP with a challenge-response second factor

Mandatory 4096-bit PGP is the ecosystem's norm and it is worth something: a peer-analysis study of marketplace advice published in 2022 found that users consistently converged on PGP as the control they trusted most. A challenge-response second factor is worth considerably more than the norm, because a one-time code pasted into a cloned login page is worthless as a defence — the clone receives the code. A challenge that must be decrypted by a private key the clone does not hold cannot be replayed.

Assessment: the best authentication design we have audited, and unverified. We do not test it, by policy.

04 · The brand, which is the real problem

Every other component reduces risk. The name increases it. A high-volume brand query in a Tor search engine is a commercial asset, and the pages that monetise it are, in the main, advertising — with a minority that exist to capture credentials and seed phrases. Clones reproduce branding and layout reliably and routinely strip the PGP verification block, because that is the part a careful user checks.

At least two dozen distinct clearnet sites present themselves as the official BlackOps gateway, and the launch year they give is variously 2021, July 2022, September 2022, the first quarter of 2024, mid-2025 or July 2025. Only one of those is evidenced. This is why brand integrity scores 2 out of 10 and carries a 12% weight — the harm lands on individual users and does not care about escrow design.

The most searched query on this page

There is no "working BlackOps link" on this site, and there will not be

Search results for a marketplace name are dominated by clearnet pages calling themselves the official link repository, the official gateway or the official support desk. Almost none of them are operated by the market. Their business model is search traffic monetised against brand queries, which is why the content is written to answer your question rather than to be accurate.

For a market with this visibility, the traffic is worth more harvested than served. A clone that survives a week has usually already collected credentials and moved. Directory maintainers have documented the pattern repeatedly: cloned portals reusing BlackOps branding while stripping the PGP block, unsigned "all clear" screenshots circulating with key fingerprints that do not match, typosquatted addresses seeded into clearnet aggregators, and a separate clone kit distributed from a public paste site.

What to do instead

  • Do not resolve a market from a search result. A Tor search engine indexes the same pages that harvest credentials, and it cannot rank them out of existence.
  • Use a curated, independently maintained, cryptographically verifiable address book, and check it against the operator's published signing key — not against the page that gave you the key.
  • Bookmark once, from a verified session. A deliberate bookmark is worth more than a link you re-read every week, because the link will be replaced by a clone and you will not notice the substitution.
  • Check the verification block, not the logo. Clones reproduce branding; they strip signatures.
  • Treat "the address changed" as suspicious. Address rotation is normal and it is also the perfect cover for a clone. Verify through a channel you already trust.
  • Assume any direct message is an attack. Fake support, fake moderators and fake vendors message first, from fresh accounts, at the moment you are trying to resolve something.

The full version of this material, written as a threat model with a five-actor analysis and an incident-response playbook, is in the BlackOps security guide.

Current status

What we know, what we infer, and what we cannot tell you

Evidenced

Established by primary sources

  • Launch in July 2025 — Europol IOCTA 2026.
  • One of the three largest English-language marketplaces by listing count at end-2025 — Europol IOCTA 2026.
  • Monero-only settlement — corroborated across independent descriptions.
  • Absorbed a large share of the users displaced by Archetyp and Abacus — Europol IOCTA 2026 and contemporaneous reporting.
Inferred

Plausible, consistently reported, not reproducible

  • 2-of-3 multisignature escrow with a third-party arbiter key.
  • Mandatory 4096-bit PGP for all messaging.
  • Vendor bonding and a probationary listing period.
  • Distributed mirror network and a no-JavaScript front end.

We do not test platforms, so every item in this column stays at or below partial. That is the price of the editorial line, and we pay it knowingly.

Unverified

Marketing copy we could not corroborate

  • The user and vendor counts.
  • The uptime percentage over any window.
  • The vendor bond size.
  • The "zero security incidents" claim.
  • The launch dates printed on the directory pages.

Each of these would raise the score if it could be evidenced. None of them raises it while it is only asserted.

What would raise the score

  • An independent party reproduces the escrow timeout and the dispute behaviour and publishes the result.
  • The vendor bond is documented in a way that is externally checkable, or the absence of a bond is confirmed.
  • The platform survives its first significant enforcement attempt with a signed statement and intact escrow.
  • Independent measurement of mirror reachability is published with a stated method, replacing the asserted uptime figure.
  • The settlement mix is published, showing that the traceable-asset share has stayed at zero.

What would lower it

  • The launch date is revised away from July 2025, which would mean the primary anchor is wrong.
  • Bitcoin settlement is quietly enabled, removing the strongest privacy property in the design.
  • Mirror rotation accelerates, which is the best public proxy for operational stress short of a shutdown.
  • A clone operation using the brand persists for more than a week, indicating the watch-tower response is behind.
  • Withdrawal or dispute resolution times deteriorate against the reported medians.

Published in advance so that no one can claim we moved the goalposts. Full model on the methodology page.

Live desk

BlackOps incidents and the ecosystem around it

Every entry is dated and attributed. Where we have one unconfirmed source, the entry carries a low-confidence tag rather than being quietly upgraded to fact. This is the section other directories will not publish, because it contains their business model.

Scope: Severity:
    Questions

    Frequently asked questions about BlackOps Market

    What is BlackOps Market?

    BlackOps Market is a Tor-only darknet marketplace that launched in July 2025, in the gap left by the seizure of Archetyp and the exit scam of Abacus. It is reported to settle exclusively in Monero, protect funds with a 2-of-3 multisignature escrow, require PGP for all messaging, enforce a PGP challenge-response second factor and run a no-JavaScript front end. It is one of three English-language marketplaces that Europol's 2026 threat assessment names as the largest by listing count at the end of 2025.

    Is BlackOps Market safe?

    No marketplace can be described as safe, and we score BlackOps 66.6 out of 100 — band B, conditional, with a confidence interval of 58.6 to 74.6. The architecture is the strongest we have audited, but the platform has roughly fifteen months of operating history, most quantitative claims about it are self-reported, and its brand name carries the highest clone and phishing exposure in the ecosystem.

    When was BlackOps Market launched?

    July 2025. Europol's Internet Organised Crime Threat Assessment 2026 records that a new marketplace called BlackOps was launched in July 2025 and, together with TorZon and Nexus, quickly became one of the marketplaces with the largest number of listings by the end of 2025. Directory pages claiming 2021, July 2022, September 2022 or the first quarter of 2024 are not supported by any primary source, and several of them are advertising rather than reporting.

    What currency does BlackOps Market use?

    Monero only, according to the platform description and independent reporting; Bitcoin and other transparent ledgers are reported to be rejected. Monero's ring signatures, stealth addresses and RingCT remove the transaction graph before it can be clustered by chain analytics, which is the reason the platform made the decision and the reason it is the strongest payment-privacy design we have audited.

    Does BlackOps Market use escrow?

    Yes — a 2-of-3 multisignature escrow with a third-party arbiter key, so that no single party can move funds alone. The claim is architecturally plausible and consistently reported, but it is not independently verifiable from outside, which is the central limitation of any escrow claim in this ecosystem and the reason the 2026 Nexus post-mortem matters to every live platform.

    Why does this site not publish BlackOps onion links or mirrors?

    Because a link is a route, and a route is exactly what a phishing clone needs in order to look legitimate. Most clearnet pages that call themselves the official BlackOps gateway are advertising, and several run credential-harvesting clones. We publish no onion addresses, mirror lists or working links for any market, and we publish the verification rules instead — in the security guide.

    How is the BlackOps Market trust score calculated?

    Eight weighted dimensions, each scored 0 to 10: longevity and survival 12 percent, escrow custody model 18 percent, authentication and messaging 14 percent, infrastructure resilience 12 percent, payment privacy 13 percent, vendor onboarding control 10 percent, dispute resolution 9 percent and brand integrity 12 percent. The score is the weighted mean scaled to 0 to 100, published together with the weights, the evidence hierarchy, the confidence rule and a public changelog on the methodology page.

    Is BlackOps Market better than Torzon or Nexus?

    On architecture, yes: better payment privacy and better authentication. On track record, no: Torzon has been operating since 2022 and survived two collapses, while BlackOps has fifteen months. We score the two as statistically indistinguishable — 66.6 and 67.2, with overlapping intervals — and the full criteria matrix and a re-weightable model are on the comparison page. Nexus is defunct: it performed an exit scam on 3 to 6 October 2026 and its score is zero.

    Deeper reading

    The full BlackOps Market review

    The complete assessment: architecture, a claim-by-claim verification table, a risk register, the chronology, and the reasoning behind every dimension value. Plus the defensive threat model for anyone exposed to the market's clone ecosystem.

    Full review Security guide Scoring method