Technical Specifications & FAQ

Abacus Market operates as a next-generation decentralized marketplace, engineered for resilience and anonymity. Established in September 2021, the platform hosts over 1,200 verified vendors and serves a user base exceeding 800,000. The infrastructure utilizes advanced load balancing across the Tor network to maintain 97.4% uptime. We prioritize operational security (OpSec) through mandatory PGP encryption for vendors and support for privacy-centric cryptocurrencies like Monero (XMR).

Access is strictly limited to the Tor network via the .onion protocol. Users must configure their Tor Browser to 'Safest' security settings, effectively disabling JavaScript to prevent browser-based fingerprinting. It is mandatory to obtain verified onion mirrors solely from our cryptographically signed lists or the official Links page. Usage of VPNs over Tor is generally discouraged unless configured by advanced users, as it may introduce additional trust vectors.

Abacus Market employs a strict data minimization policy. Upon registration, a 12-word mnemonic seed is generated. This seed is the only mechanism for account recovery. If a password is lost, this seed allows users to reset credentials without administrative intervention. We do not store email addresses or personal identifiers. If the mnemonic is lost, the account and any associated funds are mathematically unrecoverable.

To prevent Man-in-the-Middle (MitM) attacks, Abacus Market signs all legitimate mirror lists with the official administrative PGP key. Users should import this public key into their GPG keychain. When accessing a new URL, verify the digital signature against the signed message provided on our Links page. This cryptographic verification is the only trustless method to confirm you are communicating with the genuine Abacus infrastructure.

Abacus utilizes an advanced, high-entropy rotating CAPTCHA system to mitigate automated brute-force attacks and DDoS attempts. This challenge-response mechanism prevents scripted bots from overloading the authentication gateway. The complexity of the rotation ensures that only human interaction can grant access, preserving the integrity of the login session.

PGP 2FA is mandatory for all Vendor accounts and optional but highly recommended for Buyer accounts. When enabled, the server encrypts a random nonce with the user's public PGP key during login. The user must decrypt this nonce and return it to prove ownership of the private key. This prevents unauthorized access even in the event of password compromise.

The platform supports Bitcoin (BTC) and Monero (XMR). Monero is the preferred standard due to Ring Signatures and Steiner trees which obfuscate sender, receiver, and transaction amounts, rendering blockchain analysis ineffective. Bitcoin transactions are supported for legacy compatibility but should be mixed prior to deposit. The market employs a walletless deposit system to minimize hot wallet exposure.

Unlike traditional centralized wallets, the walletless system generates a unique, derived sub-address for every individual order invoice. Funds sent to this address are mapped directly to the specific purchase order. This architecture significantly reduces the platform's central hot wallet risk profile and prevents the accumulation of seized funds. It also breaks on-chain links between multiple purchases by the same user.

Standard Escrow holds funds in a market-controlled cold wallet until the buyer confirms receipt or the auto-finalize timer (14 days) expires. For high-value Bitcoin transactions, we offer 2-of-3 Multi-Signature (Multisig) Escrow. In Multisig, keys are distributed between the Buyer, Vendor, and Market. Releasing funds requires cryptographic consensus from two parties, ensuring no single entity—including the market administrators—can confiscate funds unilaterally.

Disputes can be initiated if an order is not delivered or fails to match the product description. The escrow window pauses immediately. A moderator reviews encrypted correspondence, shipping proofs, and vendor terms. Resolution is merit-based; vendors with high dispute rates face suspension. We utilize an automated resolution system for unresponsive parties, usually concluding cases within 72 hours.

To mitigate spam and ensure vendor quality, a non-refundable bond is required for all new merchant accounts. The bond amount scales dynamically (0.3 - 2.0 XMR) based on the chosen category and market volatility. Established vendors from recognized competitor markets may apply for a bond waiver by providing cryptographic proof of identity (PGP signed message) and reputation history.

Abacus Market strictly enforces a harm-reduction policy. Prohibited items include weapons, explosives, poisons, fentanyl and its analogues, and any material related to child exploitation or non-consensual violence. Listings violating these parameters are purged immediately, and the associated vendor accounts are permanently blacklisted from the platform.

The Tor network is susceptible to volumetric DDoS attacks. Abacus mitigates this through a distributed network of rotating mirrors and proof-of-work endpoints. If a specific mirror becomes unresponsive, users should consult the signed mirror list saved locally or check the main verified URL. We maintain redundant backend clusters to ensure database integrity remains unaffected by frontend accessibility issues.

Support is accessible 24/7 via the user dashboard. Tickets are encrypted at rest. Do not attempt to contact administration through clear-net email or social media channels, as these are insecure. For account recovery issues involving lost 2FA or passwords, possession of the mnemonic recovery phrase is an absolute prerequisite for assistance.