ShadowX Market FAQ

The two active addresses are on the main page. They rotate when the admin decides to, usually after a DDOS or a security concern. The last rotation was in September 2026.

Three checks: PGP signature from the admin key, address structure (shadowx + 52 base32 chars), and confirmation from at least two independent directories. Full walkthrough on the verify page.

ShadowX runs two mirrors simultaneously. If one drops, the other stays up. The market team posts an update on the forum within a few hours. Your account, escrow, and order history are unaffected.

Yes. The Tor Browser is available on both iOS and Android. The ShadowX interface is responsive and works fine on a phone screen. The only limitation is that PGP key management is slightly more awkward on mobile. Most people do their first registration on a desktop and then use the phone for browsing and checking order status.

Bitcoin (BTC) and Monero (XMR). BTC is the default. XMR is available for users who prefer not to have their transaction visible on a public blockchain. Both go through the same multisig escrow system.

When you place an order, your coins go into a multisig wallet controlled by you, the vendor, and the market. The market releases the coins to the vendor only after you confirm delivery or after the dispute period expires. If you open a dispute, the market mediates. In practice, about 94% of disputes are resolved in the buyer's favor when the vendor has fewer than 200 feedback entries.

ShadowX takes a 3% fee on each transaction, deducted from the vendor side. There is no separate listing fee, no withdrawal fee, and no "verification fee." If a vendor asks you to pay a fee directly to them outside the escrow system, that is a red flag.

Yes. Registration requires a PGP public key. Generate one with GnuPG, Kleopatra, or an online tool. The key should be at least 2048 bits. 4096 is recommended for long-term use. Your private key stays on your machine; only the public half goes to ShadowX.

You lose access to your ShadowX account. The market cannot reset it because the whole point of PGP is that only you hold the private half. You can register a new account with a new key, but your old feedback, order history, and any escrow balance tied to the old key are gone. Store the private key in a password manager or an encrypted file on an offline drive.

Yes. ShadowX supports TOTP-based two-factor authentication as an optional layer on top of PGP. It is not required, but it is recommended if you are storing more than a few hundred dollars in your account balance. Enable it in your account settings after registration.

Depends on your region and the vendor. Europe: 5 to 12 days. North America: 7 to 15 days. Latin America: 10 to 20 days. Asia: 12 to 25 days. These are typical ranges from vendor feedback. Individual orders can be faster or slower. The vendor's feedback page shows their average shipping time, which is a better predictor than any general estimate.

Wait for the vendor's stated shipping window to expire, then open a dispute in your account. Attach any tracking info the vendor gave you. The market mediates. If the vendor has fewer than 200 feedback entries and no tracking was provided, the buyer usually wins. If the vendor has 500+ entries and provided valid tracking, the market may rule in the vendor's favor.

Technically no, but practically yes. Most vendors sell to 18+ because of liability. If you are buying from a vendor who ships to a region with strict customs, declare the item as "personal effects" or "sample" to avoid a customs seizure. This is a vendor-specific detail, not a market-wide rule.

Phishing clones. A fake .onion address that looks almost identical to the real one, usually with one character changed. The fake site has the same design, the same product listings, but when you "log in" with your PGP key, it is sent to the scammer. The PGP signature check on the verify page is the only reliable defense.

A newer scam pattern. The page looks like a ShadowX login but asks you to enter your 12 or 24 word wallet recovery phrase instead of your PGP key. Once you type it in, the scammer has your entire wallet. ShadowX does not ask for a seed phrase at any point. If a form asks for one, it is a clone.

Not necessary for most people. Tor already anonymizes your traffic. A VPN adds a layer that can actually make things slower without much security gain. The one exception: if you are on a public Wi-Fi network and your ISP is known to block Tor, a VPN can help get you connected. For home use, Tor alone is fine.