RapTor

Nexus Market Archive: The Interface Everyone Copied

Nexus's logo: the wordmark NEXUS with a red X, above the tagline NEXT GENERATION MARKET.
Nexus's wordmark, as it appeared on the market's login and account pages before the exit.

A market built like a product

Nexus launched in early 2024 and grew into one of the larger general-purpose markets after Abacus went dark in July 2025. What set it apart in reviewers' descriptions was not scale — directories disagreed on that by an order of magnitude — but polish. The homepage split physical and digital goods with an explicit mode switch before you saw a single listing, which kept a large catalogue navigable instead of dumping everything into one tree.tordark.com The Autoshop was a separate storefront for digital inventory: a vendor preloaded stock, and the platform delivered automatically on payment with no vendor action required. That was a real convenience for legitimate digital-goods sellers. It was also a sharper scam surface — an automated checkout on a clone completes the same way, takes the coins, and delivers nothing, with nobody to dispute against because there was never a real vendor behind it.

Nexus's logged-in homepage, showing a DDoS-attack notice advising buyers to save private mirror links, a row of top vendor shops with star ratings and sales counts, and a grid of top product listings with escrow badges and prices in XMR and USD.
Nexus's homepage during a DDoS incident — the banner telling buyers to save private mirror links is the market's own admission that its public address could go down without warning.
Nexus's product-type prompt, asking 'What type of products are you interested in?' with two buttons: Physical and Digital.
The physical/digital split on the way in — a layout choice other markets copied because it worked.

Reviewers consistently called Nexus's interface among the most copied on the darknet — popular enough to be worth cloning well, which mattered long before the exit and matters more after it. Recognition is not verification; a login screen that looks exactly like Nexus proves nothing about who runs it.

Why RapTor never published one canonical link

Even while Nexus was live, three directories published three overlapping but not identical address sets, and none of them acknowledged the others. One listed three mirrors and stated plainly that it had not been able to confirm PGP co-published with the address — a more cautious posture than sites printing a confident feature table.Zero Trace Hub Another's set differed from the closest match on a third list by a single character in one address — which, under how onion addresses work, is either a copy-paste mistake or a phishing URL that had been sitting in a "verified" list unchecked. Launch year was disputed (2023 versus 2024). Listing counts ranged from roughly 4,000 to a reported 40,000 for the same period. RapTor carried an address while the market was running and a verification routine beside it; after the exit, publishing any address helps only whoever is hosting a clone. The archival lesson is the disagreement itself — if three directories cannot agree on a live market's mirrors, treating any one of them as "the link" was never safe.

Three coins and a built-in balance

Nexus was the only market RapTor reviewed that accepted Bitcoin, Monero, and Litecoin, funded either by pre-depositing into a built-in wallet or paying per order. Bitcoin support was disputed by at least one reviewer; whether all three paths were live at once is part of the same pattern of disagreement. The built-in wallet was the convenient option and the riskier one — a balance on Nexus's servers was a balance Nexus's operators controlled. Standard market-side escrow throughout; no multisig on any account. Finalize-early was limited to top-tier vendors with a sustained dispute-free history, which capped one common fresh-vendor scam vector without removing it entirely.

Nexus's Add deposit screen on the account dashboard, with an amount field and a Coin dropdown set to Bitcoin, next to a Deposit button.
The built-in wallet deposit screen — fund once, spend from a balance the platform held.

Account credentials worth harvesting

Nexus's registration went beyond username and password. Buyers set a separate PIN for withdrawals, so a stolen login alone could not move funds. Signup also issued a recovery token — functionally a mnemonic — for restoring account access.TorWiki Both were genuine protections against an ordinary compromised password. Both were also exactly what a phishing page exists to capture: a fake support link, a bogus withdrawal prompt, a registration clone built from Nexus's own layout. Whoever holds the recovery phrase can take the account regardless of the password.

Nexus's account-creation form, with fields for Username, a minimum-six-digit Pin and its confirmation, Password and its confirmation, plus an image-based anti-bot challenge.
The withdrawal PIN set at registration — separate from the login password.
Nexus's Recovery Token screen, confirming successful registration and displaying a blurred recovery token with a warning to save it, next to a button reading 'I saved recovery token'.
The recovery token issued after signup — as powerful as the account itself for anyone who copies it.

That design choice is why operator-run phishing before the exit was especially nasty: Nexus had trained users to type sensitive material into pages that looked exactly like the real thing. After the exit, the published onion keys added a second layer — a verified address string is no longer proof of the original operators. If you saved a recovery token or reused a password from Nexus anywhere else, treat both as compromised and rotate them; this page cannot recover a balance that is already gone.

Vendor vetting and disputes — claims, not audits

Nexus marketed a multi-step vendor review: PGP verification for sellers, cross-market reputation checks for migrants, a probationary period without finalize-early, product-sample checks for some categories, and dispute resolution described as faster than the multi-day queues common elsewhere — typically hours rather than days, with a structured evidence workflow before a moderator ruled. If enforced, that should have meant fewer scam listings reaching the catalogue. Nobody outside Nexus's staff could audit whether it was enforced: no published rejection rate, no third party confirming the probation period was real, no way to tell rigorous vetting from marketing copy. Archived now, those claims are a record of how the market presented itself — not evidence it protected escrow when the operators decided to keep it.

How Nexus sat against its peers, while it lasted

Nexus at archive date versus two markets still running and one also archived
PropertyNexus (archived)TorZonBlackOps
StatusExit scam, Sept–Oct 2026; keys leaked 7 OctActive as of Oct 2026Active as of Oct 2026
CoinsBTC, XMR, LTC (BTC disputed)BTC, XMRXMR only
EscrowTraditional; FE for top-tier vendors onlyTraditional; FE for top-tier vendors onlyTraditional
MultisigNot offeredNot offeredNot offered
Distinctive featureAutoshop, copied interface, three-coin walletLargest Western catalogue post-AbacusSmall, screened, Monero-only

DarkMatter — the only reviewed market that offered optional multisig — exited the same month and is archived separately. None of the multisig, vetting, or fast-dispute features on this page returned escrow once withdrawals stopped.

Active reviews on RapTor as of this archive: TorZon, DrugHub, BlackOps, WeTheNorth.