Security Update: Enhanced PGP Verification for All Vendors

Nexus Market's security team has announced a mandatory PGP key re-verification process for all registered vendors, rolling out across March 2026. The move comes in response to a broader trend of key compromise attacks and identity impersonation incidents observed across the darknet marketplace ecosystem.

Why This Is Happening

Over the past 6 months, multiple darknet marketplaces have reported a pattern of sophisticated attacks in which threat actors compromise a legitimate vendor's account credentials and then change or replace the associated PGP public key. This allows the attacker to impersonate the vendor, receive orders, and collect payments without ever fulfilling them — while the original vendor's reputation remains untarnished in the system.

By requiring all vendors to cryptographically prove control of their original private key through a time-stamped signed challenge, Nexus Market can identify accounts where the associated key may have changed without legitimate authorization.

The Verification Process

The re-verification process works as follows:

• Each vendor receives a unique verification challenge string generated by the platform
• The vendor must sign this string with the same private key associated with their registered PGP public key
• The signed message must be submitted through the vendor dashboard within a 72-hour window
• Vendors who fail to verify within the window have their listings temporarily suspended pending review

Guidance for Buyers

This update provides an additional layer of assurance that verified vendors are who they claim to be. However, buyers should continue practicing standard verification: always check the vendor's PGP public key fingerprint matches what's posted in their profile, and encrypt all sensitive communications using the vendor's verified key. A passing platform re-verification does not substitute for individual message-level encryption.

For a complete guide to PGP verification, see our OPSEC Guide and the PGP tab on our Access Page.