Three onion mirrors, one signed key, no excuses.
The current Nexus Market URL set has held for the working week. Verification under fingerprint 0A9D remains the only authority worth trusting.
The mirror roster published in the right column has been signed by the master key that has held since the market opened in late 2023. Operators report no descriptor failures across the working week, and exit congestion on Tor itself remains within seasonal norms. The fingerprint that closes every signature, 0A9D, is the only check you need before submitting credentials anywhere claiming to be Nexus.
Phishing operators have responded to the platform's growth with the predictable playbook. New clearnet domains spun up overnight, scraped onion lists from public gateways, and dropped fake login screens behind them. Three of those domains were burned this week after community reports flagged signature failures on what looked like routine login pages. None of the burned addresses showed any deviation from the real login UI. The only tell was the missing or mismatched PGP block. This is exactly why every user is asked, quietly and without ceremony, to verify the signature before each session.
Buyers ask the same question every time a long quiet week passes. Why does the URL not change more often? The answer is that v3 onion addresses do not need to rotate to remain secure. The hostname embeds the public key, and unless an operator wants to retire a node entirely, the address stays put. What rotates is the daily signed timestamp that proves the gateway and the mirror are current, not the address itself. A static onion is not a stale onion.
For vendors the working notice this issue is short. The dispute panel cleared the backlog from the early month surge, average resolution time fell to 71 hours, and the new bond schedule for Category C goods takes effect at the end of next week. Vendors with bonds posted under the old schedule are grandfathered through the next probation cycle. Anyone unsure where their account sits should check the signed announcement on each mirror, signed by the same fingerprint that closes this column.
For buyers the practical reminder is the boring one. Pull addresses from a gateway you control. Verify the signature with your own copy of the master key. Use Tor Browser straight from torproject.org rather than any bundle distributed by a third party, including the ones that look legitimate. Keep the security slider on Safest before the login screen renders. None of this is paranoia. It is the procedure that costs nothing and prevents an account loss that costs everything.