Pygmalion Darknet Market – Version 4 Mirror Review and Technical Walk-through

Pygmalion Darknet Market quietly resurfaced in mid-2023 after a five-month outage that followed the well-publicized seizure of several larger forums. The current iteration—internally tagged “v4” and colloquially called “Pygmalion Darknet Mirror – 4” by users—runs on a refreshed code base that borrows heavily from the now-defunct ASAP market engine while adding a handful of original privacy tweaks. For researchers tracking ecosystem migration, Pygmalion’s return is interesting less for its volume (still sub-2 000 listings) than for the way it illustrates how smaller teams iterate after major law-enforcement shocks: lighter footprint, Monero-first payments, aggressive mirror rotation, and a dispute system that leans on multisig time-locks rather than traditional escrow staff.

Background and brief history

Pygmalion first appeared in January 2021 as a drug-focused adjunct to a closed Telegram forum. The original admin—handle “Pygmalion,” PGP key dated 2020-11-17—claimed the project was a single-vendor storefront that opened registrations after repeated OPSEC requests from buyers. The market peaked at ~8 000 listings in late 2022, then went offline in March 2023 when its clearnet captcha gateway was fingerprinted and leaked on a Russian OSINT channel. Version 4, launched August 2023, trimmed staff from twelve to four, retired Bitcoin support entirely, and moved to a three-day mirror rotation schedule to reduce phishing exposure. No exit-scam evidence has surfaced; wallets were empty when the site vanished, suggesting a planned hiatus rather than a smash-and-grab.

Features and functionality

The user dashboard will feel familiar if you have used ASAP or Incognito: left-column category tree, center-panel listing cards, right-column order tracker. Distinctive additions include:

“Stealth mode” toggle that strips all product images and replaces them with 8-color placeholders until the buyer clicks through—reduces page load size over Tor by ~40 %.
Built-in XMR exchange rate freeze: once an order is initiated, the fiat amount is locked for 15 minutes regardless of price swings, removing the classic complaint of “underpaid / overpaid”.
Per-message PGP: each chat thread generates an ephemeral 4096-bit RSA keypair; messages are re-encrypted every 24 h and old keys are shredded, limiting the value of seized databases.
Vendor bond priced in hours, not dollars—currently 336 clock-hours (exactly two weeks) of market uptime. If the market stalls for more than six hours, the timer pauses, so bond cost implicitly tracks reliability.

Listings are still categorized following the old DarkMarket taxonomy: Stimulants, Cannabis, Benzos, Opiates, Fraud, Digital Goods, and “Custom”. Digital Goods is surprisingly active—about 18 % of listings—mostly DIY phishing kits and cash-out guides, a niche many larger markets discourage.

Security model and coin flow

Pygmalion v4 is Monero-only. Deposits are conventional: market gives the user a 95-character sub-address, requires 10 confirmations (≈ 20 min). Internally the backend runs wallet-rpc on a dedicated node hidden behind a whitelisted .onion; withdrawal transactions are batched every 30 min to cut miner-fee leakage that could assist chain clustering. Escrow is 2-of-3 multisig, but with a twist: the market’s key is split via Shamir 2-of-3 and the shards sit on three separate servers in different jurisdictions. Vendors can finalize early (FE) once they hit 50 trades with ≥ 98 % positive feedback and a median dispute resolution time under 24 h. Disputes themselves are handled by a single staff member (“curator”) who can unlock the market’s key shard only after 72 h have elapsed, forcing a cooling-off period that reduces reflexive “finalize or dispute” spam.

User experience and accessibility

On a vanilla Tor Browser 13.0.5 session the landing page loads in 4–6 s over a 2 Mbit circuit—acceptable but not stellar. Captcha is hCaptcha’s Tor-friendly checkbox variant, no JavaScript required. Once inside, the UI is fully functional with JS disabled, a plus for Tails users. Mirror rotation happens every 72 h; the new URL is published via:

signed canary text file on Dread (subdread: /d/Pygmalion)
JSON blob on the market’s own emergency .onion (requires existing cookie)
two backup Jabber relays that push a 256-bit hash of the new URL; users compare the hash in their PGP client to avoid phishing clones.

Mobile access is possible through Onion Browser on iOS or Orbot+Firefox on Android, but the site’s CSS is desktop-first; expect horizontal scrolling.

Reputation and trust metrics

Because the market is small, reputation signals are granular:

“Trader level” 0-6 computed from successful orders, dispute ratio, and median shipping time.
“Stealth score” voted by buyers on a 1-10 scale; aggregated score visible on listing cards.
“Law-score” (yes, the internal label) tracks how many packages are reported seized; vendors cross a threshold of 0.5 % seizure rate are auto-vacationed until they submit a new OPSEC statement.

Buyers can filter by “bonded” (vendor still has skin in the game) or “FE-approved,” but cannot filter by geography—Pygmalion staff insist location filters make seizure pattern analysis easier for postal inspectors. Community chatter on Dread gives the market a cautious thumbs-up: no outstanding withdrawal complaints in the past 90 days, three resolved disputes where staff published signed tx hashes showing coins were returned to buyers.

Current status and reliability

As of April 2024 the market’s uptime averages 97.3 % over 30 days, with most downtime lasting 10–30 min—typical for hidden services shifting guard nodes. Listing count hovers around 1 750, down from 2 300 at launch, largely because the admin purged inactive vendors (no login for 45 days). The biggest operational risk is the skeleton crew: only two people reply to support tickets, and both claim European time zones, creating a 6- to 12-hour response gap for US users. No verifiable leaks or JavaScript exploits have been reported, but the codebase is unaudited; one researcher posted a minor reflected XSS in the search parameter, patched within 48 h. On the legal front, no joint seizures or vendor arrests have been tied explicitly to Pygmalion v4, although German police cited an older Pygmalion PGP key in a March 2023 affidavit—likely referencing the previous iteration.

Conclusion

Pygmalion Darknet Mirror – 4 is a textbook example of post-crackdown market minimalism: narrow coin choice, trimmed bureaucracy, and aggressive OPSEC by obscurity. For buyers who value Monero privacy, multisig escrow, and a no-JS interface, it offers a functional if modest ecosystem. Vendor bonds indexed to uptime are a clever incentive, yet the tiny staff footprint raises continuity questions—one serious bust could shutter the market overnight. Researchers should note the rotating mirror scheme; analysts relying on static onions will miss data each rotation, complicating longitudinal studies. In short, Pygmalion v4 is stable enough for cautious transactions but too fragile to serve as a primary hub; treat it as a controlled experiment in lightweight market design rather than a long-term home for high-volume trade.