Phishing protection for WeTheNorth users

WeTheNorth has run cleanly since 2021 — escrow holds, disputes resolve, vendors ship. Yet Canadians still lose money "on WTN" every month, and almost none of it is the market's fault. It is phishing: clone sites that imitate the market or a link directory closely enough to catch your passphrase. This page is the field guide.

Anatomy of a WeTheNorth phishing page

A phishing operator registers a look-alike domain — one letter off, an extra hyphen, a different ending — and copies the market's pages. What you see: the familiar login form. What happens: your passphrase (and 2FA code, if you type it fast) goes to the operator, who logs into the real market as you and empties the wallet. The whole attack lives on one moment of inattention at the address bar.

The seven-second habit that defeats it

Before typing your passphrase, read the address out of the corner of your eye:

• Clearnet: is it exactly wtnmarket.net, wtnmarket.ru or wtnmarket.store? Nothing before it, nothing after, no creative spelling.
• Onion: does it start hn2paw7 and run 56 characters to .onion?
• Forum: is it exactly wtnforum.net or wtnforum.ru?

That is the entire defense. Phishers cannot counterfeit a v3 onion address — mathematically impossible without the market's private key. On clearnet they can only imitate, which is why exact-string reading matters.

Where the traps are laid

1. Search results, the day after an outage. Mirror rotates → Canadians search "wethenorth new link" → ads and clones sit waiting. Arrive from a bookmark instead.
2. Reddit, Telegram, Discord. Helpful strangers with "the official link". Some are genuine; the dangerous ones are indistinguishable. Verify, then bookmark.
3. Fake link sites. Directories that list mostly-real links and one poisoned one. Compare any link across two sources — ours and the forum — before trusting it.
4. DM "support". Nobody from the market will ever DM you first. Support happens inside the market, per market rules.

Defenses that stack

• 2FA, always — a phished passphrase alone cannot log in; the attacker needs your rolling code in the same 30-second window, which they only get if you type it into their clone.
• Small balances — a wallet holding this week's budget is a small target; empty wallets are boring.
• PGP-encrypted messages — for anything sensitive, so plaintext never leaves your hands.
• Bookmarks, made once, from a verified list — the link sites we vet are a good starting point.

Minutes matter: phishers automate the drain. The market's escrow protects your orders; only your habits protect your wallet.

Open the real WeTheNorth →