WeTheNorth onion links — verified mirrors 2026

Understanding WTN's mirror system

WeTheNorth runs two .onion addresses. That's not accidental — it's a deliberate infrastructure decision built around one specific problem: DDoS attacks. Canadian darknet markets face periodic disruption from automated traffic floods targeting .onion introduction points. A single-address setup means downtime every time an attack lands. Two mirrors mean one stays reachable while the other absorbs the pressure.

Why WeTheNorth uses multiple addresses

The Tor network routes traffic through three relay nodes before reaching the destination server. Each hop introduces latency. During an attack, a targeted .onion address can become sluggish or intermittently unreachable — even when the underlying server itself is running fine. The address becomes the bottleneck, not the hardware.

WTN's mirror system sidesteps this. Both addresses point to the same backend, but traffic distributes across different Tor introduction points. When an attacker floods mirror 01, mirror 02 stays functional through a different set of relays. In practice, one mirror stays accessible 98.4% of the time. Switching between them takes ten seconds. That's the tradeoff — two addresses to memorize, near-zero downtime.

Since July 2021, WTN has maintained this two-mirror setup without a significant gap in service. It survived the wave of seizures affecting other platforms in 2024 without switching addresses. Four years of consistent operation suggests the approach works.

Primary vs mirror links: is there a difference?

"Primary" and "mirror" are labels this portal uses to indicate which address WTN treats as canonical in official announcements. Functionally, there is no difference. Both deliver identical access to the same accounts, the same vendor listings, the same escrow system. Your session data, order history, and wallet balance are the same regardless of which address you used.

The practical implication: if mirror 01 is slow today, switch to mirror 02. Your account is intact. Nothing is address-specific. The same order history is visible from both. One note of caution — don't maintain two concurrent logged-in sessions using different addresses simultaneously. Tor circuits are distinct for each connection, and concurrent logins from two different entry points can trigger WTN's anomaly detection. One session at a time.

How this portal keeps links current

WeTheNorth's admin team publishes link updates exclusively via PGP-signed announcements on the Dread forum (accessible over Tor). This portal monitors WTN's official Dread thread weekly. When a new address is announced and the PGP signature matches WTN's published public key, we update this page within 24 hours of verification.

Links here are not sourced from Reddit, Telegram, clearnet forums, or user-submitted tips. Only PGP-verified Dread announcements from the WTN team count. If you've found a WTN address elsewhere, verify it against what's shown on this page before using it. The current addresses were last verified on April 21, 2026. Both passed signature checks.

For the verification process in full detail, see the next section. It covers PGP verification step by step, Dread cross-referencing, and the 56-character method for spotting one-character phishing variants.

Anti-phishing guide for WTN users

Phishing attacks targeting WeTheNorth users are specifically built for Canadian buyers. They're designed to intercept people searching for WTN access on clearnet search engines. The sites look right. The logos match. The login form accepts input. Then they steal funds or credentials. Here's what to look for before you get that far.

What phishing WTN looks like

A typical WTN phishing site copies the real interface accurately. You'll see correct branding, a login form asking for username and password, sometimes a 2FA code prompt, and a convincing balance display after "login." The address bar shows a .onion string that looks nearly identical to a real WTN mirror — until you count characters.

What the phishing site doesn't have: a working marketplace. You can "browse" listings, but attempting to purchase or deposit funds is where the scam lands. Funds sent to a phishing site's wallet address go to the attacker. There's no recovery mechanism, no dispute resolution. Gone. In February 2026, at least three Canadian users reported losses to a WTN clone operating on a one-character variant address. That's what one character costs.

Red flags before you log in

Check these before entering credentials on any WTN login page:

• The .onion address differs from both addresses listed on this page — even by one character
• The page loaded unusually fast — legitimate Tor connections take 10–30 seconds through three relay hops
• No CAPTCHA on login — WeTheNorth uses one; many phishing clones skip it to simplify their setup
• You found this address through a clearnet search engine, forum post, or messaging app link
• The site prompts for a seed phrase, recovery code, or wallet private key at any point
• The layout looks slightly wrong — different font weight, wrong spacing, logo dimensions off
• You're asked to deposit immediately after login without being able to browse first
• The CAPTCHA image looks different from the screenshot shown on the portal homepage

If you suspect a phishing site

Don't enter credentials. Close Tor Browser entirely — not just the tab. On Tails OS, the session is already amnesic and wiped on shutdown. On a regular OS, restart Tor Browser before the next session to clear any circuit state that may have been logged.

If you've already entered credentials on a phishing site, act immediately. Change your WTN password via the real mirror address. Generate a new PGP key pair using GnuPG if the old one was used on the suspect site. Move any accessible cryptocurrency — assume the attacker has your old credentials and may act on them within minutes.

Report the phishing address to the WTN team via Dread's direct message system. The WTN community tracks known phishing domains — your report may prevent the next loss. Setting up Whonix with isolated VMs, or running sessions from Tails OS, makes future incidents like this harder — compartmentalization means one compromised session can't reach others. And read the Qubes OS documentation if you want the strongest isolation available.