DrugDrugHub Marketplace FAQ
Straight answers from the market JSON and signed staff posts — what to know before browsing, how the fees, disputes and purge work, and why login is just your key.
How do I pay on DrugHub?
A single XMR invoice — order value plus the 5% market fee — paid to a fresh Monero address. Self-custody wallets only: official Monero GUI, Feather or Cake. Avoid online wallets and KYC services; the market itself runs with zero hot wallets and covers withdrawal fees. Full wallet and fee details on the Monero / XMR page.
What does the passwordless PGP login mean in practice?
Your PGP key is the credential and every action is 2FA via an enforced PGP signature — no usernames or passwords to remember or leak. If a key suddenly looks invalid, you usually need a newer PGP client with EC-key support, not a new market.
What does the enforced PGP E2EE actually cover?
All order, vendor and support messages — nothing plaintext except generic system messages. You encrypt to the counterparty key only, so even a seized server yields no readable plaintext. Never send addresses or tracking numbers in the clear; tracking numbers count as sensitive data and quick replies are for generic info only.
How does order finalization work?
Vendors set an auto-finalize timer between 5 and 45 days. Watch your AF timer, extend it and dispute if needed — forgetting it and complaining later doesn't change it. Open tickets and disputes are just waited out, not re-sent. A copy of each listing and its refund/reship policy is snapshotted at order time, so disputes run against the original.
What happens if my PGP key is lost?
Registration is tied to the key — staff don't restore accounts from memory, so keep multiple backups early. If you have records of the key you can re-register with it; without the key you register fresh.
What are the private mirrors and who gets them?
Your own unique onion, generated per account — vendors get two on approval; customers on request once their account meets certain requirements. They are account-linked: don't share them, and aggressive scraping on your private mirror gets the account banned. If one or both are down, contact staff from another account.
Which regions and items are excluded?
No business to or from the Russian Federation and CIS — including data sales about them. Prohibited items: weapons, fentanyl and analogues, poisons/harm chemicals, pornography, stolen law-enforcement/government/school-hospital data, tutorials & methods, transfers and get-rich-quick schemes. The full rule sets and penalties are on the rules page.
More of the signed key-facts post — AF timers, sign-in messages, Dread — is summarized on the rules page.