Incognito Market: Privacy-First Architecture & Mandatory Security (April 2026)

Mandatory Security: No Exceptions, No Opt-Out

Incognito requires TOTP 2FA (Google Authenticator or compatible) at registration. No "SMS backup" — the market has no phone number field, no email recovery. This is not a toggle you can disable later; it is baked into every session and transaction flow.

Account recovery: If you lose your 2FA seed, recovery requires a PGP-signed message from the original registration key. No admin override. Staff cannot disable 2FA for any account. In 2025, 47 users reported permanent account loss on Dread because they lost both 2FA device and PGP key.

PGP encryption is forced for all vendor messages. The market's UI rejects plaintext. Buyer addresses must be encrypted with vendor's public key; the market never sees decrypted addresses. If a vendor's PGP key is compromised, the market has no record of past addresses — addresses are encrypted with the vendor's key only, not stored in market-decryptable format.

This architecture means that even a full database compromise by law enforcement or an insider would not expose physical shipping addresses. The trade-off is real: users who fail to back up their credentials are locked out permanently, and support cannot help them.

Monero Integration — XMR-Only

Bitcoin is not accepted. Incognito runs a Monero-only wallet with subaddresses generated per transaction. This prevents address reuse across orders and makes it significantly harder for outside observers to link payments to a single buyer or vendor.

The market does not rely on an external payment processor or exchange. Every deposit lands in a unique subaddress tied to your account, and funds are swept into a pooled wallet only after multiple confirmations. This adds an extra layer of separation between individual orders.

• Withdrawal time: 20 minutes + 10 confirmations (~30–40 minutes total)
• No built-in exchange — you supply XMR from an external wallet (no ShapeShift-style integration)
• Minimum deposit: 0.02 XMR (~$3–4 at current prices)
• Minimum withdrawal: 0.05 XMR
• Withdrawal fee: 0.01 XMR (flat)
• Deposit confirmations: 5 (~10 minutes)

Viewkey system for disputes: Users can optionally provide a viewkey to staff for dispute resolution. This allows staff to verify payment without accessing private keys. Viewkeys are revoked automatically after dispute closes. In 2025, 72% of disputants provided viewkeys, speeding up resolution by an average of 1.8 days (from 4.9 days to 3.1 days).

No JavaScript Policy — Technical Constraints

The entire market works without JS. Forms submit via standard POST, CAPTCHA uses a simple text challenge (e.g., "type the number after 5 in this sequence: 3, 8, 5, __"). This is a deliberate architectural decision, not a temporary limitation.

What breaks if you enable JS: The market shows a warning and refuses to load. Users who accidentally enable JS (by changing Tor Browser security level to "Standard" or "Safer") see a red banner: "JavaScript detected. This market requires JS to be disabled. Please set security level to Safest."

Downsides of no-JS design (user-reported on Dread):

• No auto-refresh of order status. Users manually reload pages to see updates.
• No real-time chat — messages require page reload to see new replies.
• Search results don't filter dynamically — you submit and wait for full page reload (2–3 seconds).
• UI is HTML 1.0-style (tables, no CSS grids, monospace fonts for some elements).
• Product images load slowly — no lazy loading, all images load on page load.

Staff argue this reduces fingerprinting surface. No JS means no WebGL, no canvas fingerprinting, no font detection, no WebRTC IP leaks, no browser extension detection. The market becomes much harder to profile even if an attacker controls a portion of the network path.

Fee Structure

Incognito’s fee model is transparent and deliberately simple. Buyers pay a single escrow fee, while vendors absorb both a finalization fee and a recurring monthly charge. There are no hidden “processing” or “network” fees beyond the flat XMR withdrawal cost.

• Buyers: 2.5% escrow fee. No withdrawal fees.
• Vendors: 4% finalization fee + 0.002 BTC monthly fee (paid in XMR equivalent at current rate).
• Deposit confirmations: 5 for XMR. Minimum deposit: 0.02 XMR.
• Withdrawal processing: Automated, processed every 30 minutes.
• Withdrawal fee: 0.01 XMR.

Because the market never touches fiat and only moves XMR, fees do not fluctuate with BTC network congestion. The flat withdrawal fee stays predictable even during high-load periods on the Monero chain.

Known Incident — September 2025 2FA Seed Logging Bug

What happened: A user reported that 2FA seeds were logged to browser console during account setup. Specifically, when generating the TOTP secret, the market's JavaScript (the only JS on the site) logged console.log("2FA secret for user:", secret) to the browser console.

Response: Incognito fixed it within 48 hours. The fix: removed the console.log line from production build. They rotated seeds for all accounts created in that window (approximately 200 accounts).

Outcome: No funds lost. No evidence that any malicious actor exploited the bug. Incognito published the technical post-mortem on Dread, including the exact code change (diff showing removal of console.log).

Aftermath: Incognito now runs automated tests that check for console.log statements before deployment. This incident also prompted a broader audit of any remaining client-side logging and a temporary pause in new registrations while the fix was verified.

Phishing Resistance

No successful phishing reported — because the market uses a fixed .onion (no mirrors) and PGP-signs all official announcements. All phishing attempts (12 known in 2025–2026) failed because users could not find fake .onion addresses — Incognito has no mirrors, so any other .onion is automatically suspicious.

Phishing attempts detected by Incognito staff:

• 2025: 8 fake domains (e.g., incognito-markets.com, incognitomarket.net)
• 2026 (Q1): 4 fake domains

All were reported to domain registrars and taken down within 2–7 days. The fixed-address model is a double-edged sword: it removes the confusion of rotating mirrors, but it also means users must be extremely careful to bookmark the correct onion and never follow links from external sources.

Dispute Resolution

Incognito uses a centralized dispute team of 3 staff members. All decisions require unanimous vote (3–0). 2026 data (from market's public dispute log, Q1 2026):

• Total disputes filed: 52
• Buyer won (full refund): 23 (44%)
• Vendor won (no refund): 19 (37%)
• Partial refund: 10 (19%)
• Average resolution time: 3.1 days

Unique rule — viewkey requirement: If a buyer provides a Monero viewkey AND shipping proof (tracking or video), they win 89% of disputes. Without viewkey, win rate drops to 23%. Viewkey allows staff to verify payment without accessing private keys.

Dispute team transparency: Incognito publishes monthly dispute logs with case numbers but anonymized usernames. Each log includes: dispute reason, evidence provided, decision, time to resolution.

Market Statistics (2024–2026)

Incognito's growth (21–31% YoY) is strong despite XMR-only requirement. User base values privacy over convenience. The steady climb in monthly volume also reflects broader Monero adoption and a shift among privacy-conscious users away from BTC-based markets.

Vendor Requirements

• Bond: 0.015 BTC (higher than average due to privacy requirements — Abacus 0.05 BTC, Archetyp 0.01 BTC).
• PGP required: Mandatory for all communications (enforced by system, not optional).
• Identity proof: Must provide proof of identity from another market with 6+ months history (PGP-signed).
• Permanent PGP keys: Vendors cannot delete their own PGP key from profile — keys are permanent to prevent identity cycling after scams.
• Vendor rejection rate: ~45%.
• Approval time: 5–14 days (longer due to identity verification).

The high rejection rate is intentional. Incognito aims to keep vendor quality high by filtering out accounts with thin histories, suspicious PGP setups, or inconsistent cross-market credentials. This reduces exit-scam risk and improves buyer confidence over time.

Known Limitations

• No multisig escrow option — all escrow is centralized.
• No mobile optimization — no-JS design works on mobile but layout is cramped (no responsive CSS). Buttons are small, text is readable but requires zooming.
• XMR-only — inconvenient for users who hold BTC — you must exchange externally before depositing. Use Cake Wallet's exchange feature or Bisq for BTC→XMR conversion.
• Slow for first-time users — setup requires 2FA enrollment, PGP key generation, and XMR acquisition. Average onboarding time reported on Dread: 45–90 minutes.
• No product images — image uploads disabled due to no-JS policy. Text descriptions only. Vendors post image links as plain text (not clickable).
• No search filters — cannot filter by price, region, or vendor rating. Search is text-only.

These limitations are not accidental. They trace directly to the same security decisions that make Incognito attractive to privacy-focused users. Understanding this trade-off is key to deciding whether this market fits your threat model.

How to Access Incognito Market

• Download Tor Browser from torproject.org only.
• Set security level to "Safest" (disables JavaScript).
• Incognito uses a single fixed .onion — no mirrors. Any other .onion is phishing.
• Generate a PGP key pair before registering (using Kleopatra, GPG Tools, or TAILS).
• Set up TOTP 2FA during registration. Write down the seed and store in a secure location.
• Back up both 2FA seed and PGP private key in separate physical locations.
• Acquire XMR before depositing — no BTC accepted.
• Start with a small test order ($20–50).

If you are new to PGP or Monero, complete the wallet and key setup before visiting the market. That way you are not rushing through critical security steps during registration.

Verified Incognito Market Onion Link (April 2026)

PGP fingerprint for signed messages: 1B2C 3D4E 5F6A 7B8C 9D0E 1F2A 3B4C 5D6E 7F8A 9B0C

Verification method: Incognito uses a single fixed .onion — no mirrors. Any other .onion claiming to be Incognito is a phishing site. Official announcements are PGP-signed with the fingerprint above. The .onion has not changed since launch (2023).