Design principles
Before the mechanics, the four commitments that produce them. These are the reasons a number here should be treated differently from a number on a directory page.
- Everything is derived, not typed. The published score is computed from published dimension values and published weights by the same code that renders the page. There is no spreadsheet step, no manual override and no marketing override.
- Unverifiable claims earn no credit. A dimension value is an assessment of verified evidence. A market's own marketing does not raise its score, and where marketing is the only evidence the claim is listed as unverified and the dimension is scored accordingly.
- Uncertainty is published as an interval. Where confidence is medium we report a range, and two scores with overlapping ranges are reported as a tie. We would rather publish an uninteresting result than manufacture a ranking.
- The subject does not see the assessment. No market, vendor or directory is contacted for comment before publication, and none pays us anything. A pre-publication review right is a veto, and a veto is incompatible with a critical assessment.
The eight dimensions
Each dimension is scored from 0 to 10 as an integer, carries a fixed weight, and the score is the weighted mean scaled to 0–100. Weights sum to exactly 100 and are frozen for the duration of an edition; changing them mid-edition would make scores incomparable across dates.
| Dimension | Weight | What it measures |
|---|---|---|
| Longevity & survival | 12% | Time the platform has actually operated, and whether it has survived a prior enforcement wave or a competitor collapse. A market that has not yet been tested has not passed a test. |
| Escrow custody model | 18% | How much of the operator can touch escrowed funds. Custodial escrow is the largest single structural failure mode in this ecosystem, so it carries the largest weight. |
| Authentication & messaging | 14% | Mandatory PGP, second-factor design, browser attack surface, and whether credentials can be replayed by a phishing page. |
| Infrastructure resilience | 12% | Mirror redundancy, resistance to denial-of-service, and resistance to the seizure of a single hosting provider. |
| Payment privacy | 13% | Whether the settlement currency resists blockchain analytics. A transparent ledger converts a marketplace account into a subpoena target. |
| Vendor onboarding control | 10% | Bond size, identity proofing, probation periods, and the cost of opening a fraudulent vendor account. |
| Dispute resolution | 9% | Whether arbitration is a process with a named arbiter and a defined clock, or a promise backed by a support queue. |
| Brand integrity / clone exposure | 12% | How much impersonation and phishing surface the market name itself creates. A famous name is a liability, not an asset, and this is the dimension that decides the Nexus case. |
Why these weights
The weights encode a single thesis: the operator's ability to reach your money dominates, and the surrounding harms are what actually land on people. Custody is the largest single dimension because every documented catastrophic loss in this ecosystem since 2014 has been an escrow event, and because the escrow claim is the one architectural property a buyer cannot verify from outside. Brand integrity is weighted at 12% — unusually high for a platform assessment — because the observed harm rate in this ecosystem is dominated by phishing clones rather than by platform failures, and a market's name is a direct cause of that harm.
Survival is deliberately not weighted heavily. A four-year record is evidence of a working business, not of a working design, and weighting it heavily would mean that every incumbent scores well by default. A market that is new, well-designed and honest should be able to out-score a four-year-old one that is well-designed and dishonest, and this model allows exactly that.
Evidence hierarchy
Every claim we assess is placed in one of five tiers. The tier determines the label on the claim table and, indirectly, how much the claim can move a dimension value.
| Tier | Source type | Claim label | Effect on score |
|---|---|---|---|
| T1 | Law-enforcement and judicial releases, court filings, operator's own cryptographically signed statements, on-chain data analysed by an established analytics firm | VERIFIED | Full weight |
| T2 | Peer-reviewed and preprint academic analysis; official statistical bulletins; incident reporting by established independent maintainers | VERIFIED / PARTIAL | Substantial weight |
| T3 | Independent threat-intelligence analysis with a stated method; reputable investigative journalism with named sourcing | PARTIAL | Moderate weight |
| T4 | Operator self-report without corroboration; community forum posts; mirror-status pages | UNVERIFIED | No credit |
| T5 | SEO directory pages, affiliate gateways, vendor marketing, copied statistics | MARKETING / REFUTED if contradicted | No credit; negative evidence where contradicted |
One rule deserves emphasis because it is the most common failure in this market of analysis: corroboration is not independence. Forty sites repeating one operator statement is one source, not forty. When we see a claim propagated across the directory layer, we identify the origin and score the claim on the origin's tier, not on the number of copies.
Confidence and intervals
Each market carries a confidence level, derived from the mix of evidence available about it — not from how confident we feel about the platform.
- High — the market's status and material attributes are established by at least two independent T1/T2 sources. A ±3 interval applies.
- Medium — status is established, but material attributes rely substantially on operator self-report or a single independent source. A ±8 interval applies.
- Low — the evidence base is thin or contested. A ±14 interval applies, and the score should be treated as provisional.
When two intervals overlap, the result is reported as a tie. Torzon (67.2, interval 59.2–75.2) and BlackOps (66.6, interval 58.6–74.6) overlap almost entirely. We therefore report them as statistically indistinguishable, and we say so in the headline rather than presenting a 0.6-point difference as a ranking. The comparison engine's re-weighting controls exist so that readers who weight the dimensions differently can see whether the result is robust or arbitrary. Under our published weights it is not robust: it is a tie that happens to be close to the middle of the range.
Score bands
| Band | Range | Meaning |
|---|---|---|
| A+ | 90–100 | Exceptional. Practically unattainable. No marketplace has ever held it. If you see it, the score is marketing. |
| A | 75–89 | Architecturally sound and independently evidenced. The BlackOps market has not reached this band, and no marketplace in the audited set has ever held it. |
| B | 60–74 | Defensible architecture with an unresolved structural or verification gap. The BlackOps market sits here, and it is the band a market has to earn its way out of. |
| C | 40–59 | Survives, but a single control failure or enforcement action ends it. |
| D | 20–39 | Custodial exposure dominates. Expect a bad outcome for users. |
| F | 0–19 | Funds lost, platform seized, or an architecture that offers no protection. Nexus sits here permanently. |
What the score is not
- It is not a probability of failure. A score of 67 does not mean a 33% chance of collapse. We do not have the base rate, the exposure data or the resolution time to produce a calibrated probability, and we decline to publish a number that looks like one.
- It is not a recommendation to transact. There is no score at which we would say a person should buy prohibited goods from a marketplace. The score describes a platform's risk shape, and the risks it describes are reasons to reduce exposure, not reasons to proceed.
- It is not a measure of the people involved. It describes architecture and evidence quality. Most participants in this ecosystem are not the adversary, and the model deliberately contains no dimension that would characterise them.
- It is not current to the second. Market status changes within hours. Every score carries a date, and the date is displayed next to it, always.
- It is not a substitute for legal advice. Nothing we publish changes what is lawful where you are.
Refresh cadence and event triggers
- Fortnightly scheduled re-audit of every active market, with dimension values and weights re-checked against new evidence.
- Event-driven re-publication within 24 hours of a shutdown, seizure, exit-scam allegation, major architecture change, or a confirmed phishing campaign against an audited brand. The Nexus case was published as an event-driven update on 6 October 2026, three days after the first report.
- Quarterly review of the model itself: whether the dimensions, weights, tiers and intervals still describe the ecosystem. Model changes are versioned and never applied retroactively to a previous edition without a note.
Known limitations
We would rather publish these than let a reader discover them.
- We do not verify claims by testing. We do not create accounts, and we do not interact with these platforms. Every architectural claim about a market is therefore assessed from documentation and reporting, not from observation. We regard this as a non-negotiable editorial line, and it is also the largest source of error in the model.
- Operator self-report is unfalsifiable from outside. A market that lies about its escrow configuration looks identical to one that does not. The Nexus case demonstrates the failure mode of any assessment based on published claims.
- Scores are not comparable across editions when weights change. Each score is labelled with its model version.
- Selection is not random. We audit markets that are prominent enough to find and that enough people care about to be worth auditing. Markets we have never heard of are unassessed, not safe.
- Absence of evidence is not evidence of absence. A quiet period is not stability, and a market that is not on our list is not necessarily defunct.
- Our sources have interests. Blockchain-intelligence firms sell the product of this analysis. Their methodology is published and their findings are usually rigorous, but the incentives are real and we note them.
Corrections policy
Corrections are published, dated, and permanent. We do not silently edit a published score, and we do not delete the original claim.
- A correction notice states what was claimed, what is now known, when the change was made, and which scores it affects.
- Where a correction changes a dimension value, the score is recomputed and the previous score is shown alongside it, with the model version of each.
- Where a correction changes a market's status, the status change is published as an event-driven update, in the same format as any other status change.
- Material corrections are also recorded in the changelog below and pushed to the RSS feed.
To submit a correction, write to the desk with the specific claim, the specific evidence, and the source of that evidence. We will publish it if we can verify it, and we will say so if we cannot. We do not publish anonymous corrections and we do not publish corrections that merely restate a market's marketing.
Conflict of interest
We do not accept payment, advertising, sponsorship, affiliate revenue, referral fees, hardware or travel from any marketplace, vendor, directory, forum, blockchain-analytics vendor or law-enforcement body. We do not operate an access directory, we do not broker, and we do not hold funds. Where an author has a professional, financial or personal interest in a subject, it is disclosed on the report page and the affected dimension values are re-reviewed by the other author. Any actual or potential conflict discovered after publication is disclosed in the changelog.
Changelog
| Date | Version | Change |
|---|---|---|
| 2026-10-21 | 12.4 | Event-driven update: Nexus marked defunct following the 3–6 October exit scam; all Nexus mirrors withdrawn; clone wave logged. Nexus Trust Score set to 0, band F, confidence high. |
| 2026-10-19 | 12.3 | Brand-integrity dimension re-scored for BlackOps (5 → 2) following documentation of a sustained clone wave tied to the brand. BlackOps score 69.1 → 66.6. |
| 2026-10-12 | 12.2 | Torzon infrastructure dimension re-scored (7 → 5) after review of the June 2026 mirror reachability bulletins and the August 2026 stability questions. |
| 2026-10-07 | 12.1 | Launch date for BlackOps corrected to July 2025 on the basis of Europol IOCTA 2026, replacing the previously published Q1 2024 date that had been taken from directory marketing. Confidence downgraded accordingly. |
| 2026-09-30 | 12.0 | Model version 12.0 published. Weights revised: custody 15 → 18, brand integrity 8 → 12, survival 15 → 12, disputes 11 → 9. Rationale documented in this page. |
Bibliography
Every source behind the current edition, with its tier. The same list is printed at the foot of each report.