Dark Web Market: WeTheNorth Market

WeTheNorth (WTN) is a Canada-focused Dark Web Marketplace (DWM) named after the famous Toronto Raptors slogan. Launched in 2021 after the shutdown of CanadianHeadquarters—an earlier DWM—it primarily caters to Canadian users by offering illegal goods and services. Although it is considered a DWM due to its nature, it has both clear web and TOR addresses, just like the popular hacker forum BreachForums.

Overview:

• Launch Date: 2021
• Language: English, French
• Special Characteristics: Canadian marketplace, similar design to Abacus Market
• Product Categories: Fraud, Drugs & Chemicals, Guides & Tutorials
• Operating Platforms: Clear Web and TOR
• Valuation: ~$3 million

Home page of WeTheNorth Canada

What is a Dark Web Market?

A Dark Web Market (DWM) is a hidden online marketplace used to trade illicit goods like stolen data, hacking tools, and counterfeit documents. Accessible via tools like TOR and using cryptocurrency for anonymity, DWMs are central to cybercriminal activity.

Explore top markets and threats on SOCRadar’s blog:

An overview of top Dark Web Markets: Top 10 Dark Web Markets

Market Structure

The market serves solely a regional audience and hosts thousands of listings across various illicit categories. From drugs and counterfeit documents to malware and fraud services, WeTheNorth is structured to support a whole ecosystem of local cybercrime.

About us section of WeTheNorth Market

The market operates with a user-friendly interface resembling typical e-commerce platforms, making it quite accessible. The marketplace includes a prominent navigation bar with access to Forum, Orders, Vendors, and Support sections. Buyers have a profile dashboard indicating levels, total sales, and balances, with activity displayed in CAD and BTC.

Listings by Category

The marketplace hosts the following notable categories:

• Drugs & Chemicals (5189 listings) – The largest category, highlighting its primary focus.

Featured Listings in Drugs & Chemicals category

• Fraud (2405 listings) – Includes stolen identities, fake documents, and bank drops.
• Guides & Tutorials (1738 listings) – Covers topics like carding, OPSEC, and further illegal goods related guides.
• Software & Malware (500 listings) – Offers stealer tools, remote access trojans, and ransomware kits.

Featured listings in Software & Malware category

• Security & Hosting (27 listings) – Includes VPNs, bulletproof hosting, and DDoS services.

Listing counts are subject to change. Below is the complete category list:

Browse Categories section in WeTheNorth Market

Drugs remain the dominant category with over 5,000 listings, followed by fraud services, guides and tutorials, and malware offerings. The fraud section includes fake IDs, stolen bank account data, and social engineering kits. Meanwhile, the malware section features stealers, encrypters, and remote access tools, which could be used in ransomware campaigns or credential harvesting.

WeTheNorth’s Operation Model

WeTheNorth functions as a typical Dark Web Marketplace but with features and policies tailored to enhance trust, automation, and operational security. Its internal systems are designed to streamline illegal trade while minimizing risk for users. Key elements of its operation model include:

• User Dashboard: Offers access to orders, balances in BTC and CAD, vendor pages, support tickets, and profile settings.
• Communication Restrictions: Vendors are strictly prohibited from listing external contact methods like Telegram, keeping all interactions on-platform.
• Escrow System: This system ensures transactions are mediated and disputes can be handled within the market, adding a layer of buyer protection, but it’s not working on Autoshop.
• Autoshop: This option is available for certain digital goods, such as Credit Cards, enabling instant delivery upon purchase without manual vendor action.

With filters, users can put purchase orders

Credit Card Autoshop interface

• Referral Program: Incentivizes user growth by rewarding members who bring in new users, often seen in both legal and illicit platforms.
• Vendor Reputation System: Vendors are ranked based on completed orders, feedback, and activity, influencing buyer decisions and marketplace trust.

Vendor Account rules

• Integrated Forum: A space for users to review products, report scams, ask questions, and receive updates on market changes.
• Redundancy via Mirrors: Users are encouraged to bookmark multiple access domains, ensuring availability during DDoS attacks or takedown attempts.

Despite being a highly regional-focused market, the blend of automation, security, and community building helps WeTheNorth Market establish itself as a scalable and semi-resilient Dark Web ecosystem, particularly appealing to cybercriminals seeking a base of operations.

Current Status of WeTheNorth

As of 2025, the marketplace hosts over 9,000 listings across various illicit categories, including drugs and chemicals, fraud tools, counterfeit documents, hacking services, malware, and digital guides.

Transactions on WTN are conducted using cryptocurrencies, adhering to the standard anonymity-focused practices typical of dark web markets. The platform emphasizes a secure, scam-free environment and allegedly keeps no log, particularly tailored for Canadian users. It enforces strict rules prohibiting the sale of weapons, terrorism-related content, doxxing, or third-party contact information.

Mitigation and Security Measures

Organizations and law enforcement agencies monitoring dark web activity should adopt proactive strategies to mitigate risks from emerging regional marketplaces like WeTheNorth.

• Dark Web Monitoring

SOCRadar’s Dark Web Monitoring includes comprehensive tracking of black market activity. Tools like SOCRadar’s Dark Web Monitoring are crucial for detecting stolen credentials, identifying counterfeit products targeting specific brands, and mitigating risks by monitoring dark web forums and marketplaces. This proactive approach enables early threat detection and response.

Black Market monitoring, SOCRadar’s Dark Web Monitoring

• Phishing Domain Takedown

With SOCRadar’s Integrated Takedown Service, organizations can swiftly counter phishing domains and fraudulent activities from platforms like WeTheNorth Market. Proactively eliminating malicious websites reduces the risk of brand impersonation and protects customers from exploitation.

• Public Awareness Campaigns

Raising public awareness about the risks associated with dark web marketplaces, particularly concerning the sale of dangerous substances, is essential to reducing harm and educating individuals on the dangers of engaging with these illicit networks.