How to verify a WeTheNorth link
Every WeTheNorth phishing story follows the same plot: a link that looked right, a login that seemed to work, a balance that vanished. The check below takes about a minute and removes almost all of the risk.
The 60-second checklist ✅
- Match the domain exactly. The market's clearnet presence is exactly three domains: wtnmarket.net, wtnmarket.ru, wtnmarket.store — plus the forum at wtnforum.net / wtnforum.ru and the onion address. Hyphens, different endings, doubled letters or "portal" prefixes mean phishing.
- Count the onion characters. The genuine onion address is exactly 56 characters before
.onion:
- Cross-check two sources. This directory and the official forum should agree on the link. If a "new mirror" appears in a Reddit post but not on the forum, distrust it.
- Let your account talk. After login, your balance, order history and messages are present on the real market. A clone shows you an empty, fresh account.
- Deposit small on first use. Even when everything checks out, a $20 test before a $400 order is cheap insurance.
Where phishing links come from
- Reddit threads and comments — "official WTN link here!" under any darknet post
- Telegram and Discord groups — invite links from strangers, usually right after a market outage
- Search engine ads and clones — look-alike domains one letter off, ranked next to the real thing
- Marketplace DMs — a "vendor" moving you off-platform to a "new market link" (also against WTN rules)
None of these are malicious technologies — they are just places where people are in a hurry. The fix is procedural: arrive only through your own bookmarks, made once from a verified list like our links page.
If you already logged into a suspicious page ⚠️
- Change your passphrase immediately — on the real market, reached only via a verified link.
- Check 2FA is still enabled and revoke unknown sessions if the market offers it.
- Withdraw your balance to your own wallet if you can do so before the phisher does.
- Report the domain on the WeTheNorth forum so other Canadians don't repeat the mistake.
The one-link rule
If you remember nothing else: WeTheNorth's link surface is small on purpose. One onion address, three mirrors, two forum domains. Every genuine address is on our directory homepage — anything else calling itself WeTheNorth is a copy, and copies of a darknet market exist for exactly one reason.