04 // walkthrough
How to reach Vortex safely in 8 steps
First visit from a Bing result? Read this once. The entire flow — Tor, PGP, wallet, first order — in under ten minutes of setup.
The reason this walkthrough exists: phishing clones of Vortex outnumber the real addresses by roughly thirty-to-one at any given moment. The interface copies are pixel-perfect. The login form runs. The "forgot password" flow even works — long enough to log the reset token into a database that isn't Vortex. Nine out of ten people who get hit didn't verify the address. They typed it, or pasted from a Bing result that looked official, or trusted a screenshot on a forum.
Doing this right takes about eleven minutes on your first run and about ninety seconds on every return visit. Read the eight steps end-to-end before you start. Don't skip ahead. The order matters because each step closes a specific failure mode that people hit on the previous one.
What to do when a mirror is slow
Tor is not a fast network. A page taking 8 seconds to paint is normal. A page that times out after 60 seconds probably means the mirror is under load — switch to the second or third address. All three share state, so your session, cart, and messages persist across mirrors. Need to confirm a mirror is real? Check the PGP-signed list below. If every mirror is slow at the same time, you're looking at a DDoS window, not a compromise; the queue system will catch up in 30–40 minutes.
What about 2FA?
Use it. Vortex supports PGP-based 2FA: the platform encrypts a challenge string to your public key at login, and you decrypt it locally to prove identity. It is materially stronger than TOTP because your phone is not in the loop. If your threat model includes a stolen device, this is the setting to enable before your first withdrawal. Turn it on during signup — retrofitting 2FA onto an account that's already holding funds is strictly worse.
Dispute resolution, in one paragraph
File within the 14-day window. Include timestamps, transaction IDs, and tracking evidence if relevant. Vortex moderators pull chat logs and decide on the weight of evidence. Most disputes settle in 48–72 hours. Read EFF's guide to digital disputes if you want the underlying protocol logic.
When to rotate your accounts
Treat marketplace accounts the way a paranoid accountant treats spreadsheet backups. Rotate every 90 days. Export your feedback, generate a fresh PGP key, register a new handle, and withdraw funds to a clean wallet address before abandoning the old one. The cost is one hour of setup. The alternative is a compromised session lasting years. If you're handling volumes that matter, compartmentalize each use-case into its own account.
The clipboard is a vulnerability too
Malicious browser extensions and clipboard-reading malware are the second-most-common vector after typos. Before pasting any .onion address into Tor, glance at the first eight characters and the last eight. If they don't match what you copied, a clipboard hijacker rewrote it between click and paste. Cake Wallet, GnuPG, and the Tor Browser all display full addresses in plain text on purpose — because the threat model assumes your clipboard is untrusted.
Why we don't publish market fees
Fees change. The real rate at checkout is the one that counts. A page like this that quoted a "2.5% vendor commission" as a fact would go stale within weeks and become another thing to fact-check. What we will say: Vortex's fee structure is in line with competitors, the built-in exchange charges a visible spread (not a hidden fee), and vendor commissions are disclosed on the listing page itself before you add to cart.
