OPSEC — Operational Security Grimoire
Operational security (OPSEC) is the practice of protecting sensitive information and identity from adversarial observation. In the context of darknet markets, OPSEC encompasses network-level anonymity, device hygiene, communication encryption, payment privacy, and behavioural discipline. A single OPSEC failure can permanently compromise anonymity built over months.
Why Do You Need to Think About OPSEC?
Darknet market investigations historically succeed not through breaking Tor, but by exploiting human OPSEC failures. The operators of Silk Road, AlphaBay, and other high-profile markets were identified through metadata, reused usernames, clearnet activity, shipping records, and financial mistakes — not cryptographic breaks.
Your threat model determines how rigorous your OPSEC must be. Consider: who might be motivated to identify you, what capabilities they have, and what information trails you are creating. The Nexus Darknet operates in an adversarial environment where passive observation is constant.
What Helps You Remain Anonymous?
Tier 1 — Essential Tools
- Tor Browser — Official download from torproject.org. Routes all browser traffic through three Tor relays. The only browser that resolves .onion addresses. Use Security Level: Safest for darknet access.
- PGP Encryption — All order addresses and sensitive communications must be PGP-encrypted. Tools: GnuPG, OpenPGP-compatible clients. Never send an address in plaintext.
- Monero (XMR) — Private by default. No chain analysis risk. Severs the financial link between buyer and platform. See the XMR guide.
Tier 2 — Strongly Recommended
- Tails OS — Live operating system downloaded from tails.boum.org. Boots from USB, leaves no trace on host. Routes all traffic through Tor. Amnesic by design — no persistent logs.
- VPN before Tor — A no-log VPN connected before Tor Browser hides Tor usage from your ISP. Select providers with: no-log audits, RAM-only servers, strong jurisdiction. Recommended: Mullvad (accepts XMR payment), ProtonVPN.
- Whonix — Two virtual machine setup from whonix.org. Gateway VM routes all traffic through Tor. Workstation VM has no direct network access. Malware in the Workstation cannot leak your real IP.
- Dedicated Device — Use a device purchased with cash that is never used for personal accounts or clearnet browsing. Compartmentalisation prevents cross-contamination of identities.
Tier 3 — Advanced Measures
- Public WiFi or Mobile Data (Non-Linked) — Accessing Tor from home broadband links your physical location to the session time. Public networks add a layer of distance.
- Hardware Security Keys — FIDO2/U2F keys (YubiKey, Nitrokey) for any accounts that support them. Cannot be phished via keylogger or remote access.
- Metadata Removal — Use MAT2 to strip metadata from documents, images, and files before sharing. Camera EXIF data embeds GPS coordinates and device model.
- Air-Gapped Machine — For PGP key generation and high-sensitivity operations, a computer that has never connected to any network provides the strongest key protection.
What Are the Red Flags and What Should You Avoid?
Critical Mistakes That Led to Real Arrests
🚫 Using the Same Username Across Platforms
The Silk Road operator was identified partly because the username "altoid" appeared on both a Bitcoin forum asking about Tor and a clearnet job posting years earlier. Search your intended username across clearnet before using it anywhere darknet-related.
🚫 Logging Into Clearnet Accounts on Tor
Logging into Gmail, Facebook, or any identity-linked account while Tor is active links your Tor session to your real identity at the application layer — regardless of network-layer anonymity.
🚫 Sending Crypto Directly from KYC Exchanges
Exchanges with KYC (Know Your Customer) requirements record your real identity linked to wallet addresses. A direct transfer from a KYC exchange to a darknet market creates a permanent on-chain link between your identity and the transaction.
🚫 Opening Downloads While Connected to Tor
Downloaded files (PDFs, Word documents, media) can contain beacons that call home when opened. If opened while Tor is active but in an application that makes direct connections, your real IP is exposed.
🚫 Photographing Packages with Metadata
Smartphone photos embed GPS coordinates, device fingerprint, and timestamp in EXIF metadata. A photo of an order package sent through any channel is a map to your location and device.
🚫 Discussing Darknet Activity in Personal Circles
Human intelligence (HUMINT) — informants, social engineering, pillow talk — is responsible for more arrests than technical surveillance. The covenant is broken by speech as surely as by data.
🚫 Changing Browser Fingerprint or Resizing Tor Window
Tor Browser is designed to present a uniform fingerprint. Resizing the window, changing fonts, or installing extensions breaks this uniformity and creates a unique fingerprint that can be tracked across sessions.
OPSEC Checklist Before Each Session
- Boot Tails OS from USB (or start Whonix VMs)
- Connect VPN before opening Tor Browser
- Open Tor Browser at default window size — do not resize
- Set Security Level to Safest
- Navigate directly to bookmarked .onion — never search
- Verify the onion address character-by-character
- PGP-encrypt all sensitive communications before sending
- Do not log into any clearnet service during the session
- After session: close Tor Browser, disconnect VPN, shut down cleanly