We Are Amsterdam Darknet Market: Technical Profile of the Fourth-Generation Mirror

The fourth iteration of the We Are Amsterdam (WAA) darknet market has been circulating through Tor hidden-service directories since late-2023, positioning itself as a cannabis-focused bazaar that claims to ship strictly from the Netherlands. While dozens of niche markets appear and vanish each quarter, WAA has survived longer than most single-vendor shops and attracted a small but active following. This brief examines what is actually under the hood, how the mirror rotation works, and whether the market’s operational security matches its marketing promises.

Background and Market Genealogy

We Are Amsterdam first surfaced in April 2021 as a collection of PGP-signed vendor pages linked through Pastebin dumps. The original operator—“AmsterdamRoot”—branded the project as a “coffee-shop-style” escrow service that would only allow Dutch vendors, arguing that domestic mail within the Netherlands faces minimal customs screening. By autumn 2022 the project had evolved into a full market script, borrowing heavily on the open-source “Daeva” codebase but stripping out the alt-coin plumbing to keep only Bitcoin and later Monero. Law-enforcement seizure banners never appeared, yet the site disappeared for three weeks in February 2023, prompting the staff to relaunch under the “Mirror-3” domain. Mirror-4, the current generation, went live in November 2023 after a short phishing wave targeted the previous onion keys. Each generation has reused the original user database (hashed passwords + 2FA seeds) so old accounts migrate seamlessly, a continuity feature that both reassures returning buyers and creates a tempting forensic link for investigators.

Core Features and Functionality

The market runs on a modest Laravel/PHP stack hidden behind a nginx→Tor proxy. Feature depth is intentionally narrow: no digital goods, no weapons section, no “services” tab—only physical cannabis products and a small hash/oil sub-category. Key elements include:

Per-order escrow with a 14-day auto-finalize timer (extendable once)
Optional “early-finalize” for trusted buyers >30 completed orders
Multisig withdrawal for vendors (2-of-3, market holds one key)
XMR primary wallet, BTC legacy wallet with automatic conversion via MorphScript
Built-in “stealth calculator” that recommends vacuum-layer + mylar combinations based on destination country
Simplified “Dutch auction” listings where price drops 3 % every 24 h until a buyer bites

Search is deliberately minimal: strain name, weight brackets, and three shipping zones (EU, UK, “World”). No filters for THC % or vendor level, reinforcing the coffee-shop vibe that everything is basically “good enough”.

Security Architecture and Escrow Flow

From a network perspective, WAA Mirror-4 uses a single-application server plus a “cold” Bitcoin wallet VM that is only spun up every six hours to sign transactions, reducing the hot-wallet attack surface. The staff publish a fresh PGP-signed message each Monday that contains the current onion URL, the deposit address pool checksum, and the latest canary string. Users who skip this ritual sometimes land on well-crafted phishing clones that replicate the UI but swap the withdrawal addresses; the clones are usually taken down within 48 h, yet they siphon a steady trickle of coins.

All communications are PGP-encrypted by default: the market strips any plaintext message that contains keywords such as “address” or “tracking” and forces the sender to re-encrypt. Two-factor authentication is TOTP-based (RFC-6238) rather than the more common PGP challenge; while slightly less secure against SIM-swap vectors, it speeds up mobile logins. Vendor bond is fixed at 0.05 XMR (~€20), low enough to attract small growers but coupled with a 5 % finalization fee that scales upward for high-volume sellers.

User Experience and Practical Workflow

First-time setup is painless: create username, set 2FA, deposit Monero. The wallet interface shows a sub-address that rotates every order, mitigating the privacy pitfalls of address reuse. Product pages mimic a minimalist Dread layout: one photo, free-form description, and shipping times (24–72 h inside NL, 3–7 d EU, “up to 14 d” elsewhere). Buyers click “Order”, input optional delivery notes, and are immediately shown a Bitcoin-equivalent total if they insist on paying with BTC; the conversion rate locks for 90 min to prevent slippage disputes.

Dispute mediation is handled by a single staff account—“Support_NL”—with a published response SLA of 24 h. In practice, resolution averages 72 h and usually ends with a 50 % refund split, a compromise that discourages frivolous complaints but also annoys vendors who feel buyers exploit the policy.

Reputation Signals and Community Feedback

Dread’s /d/WeAmsterdam board lists roughly 1,300 subscribers, modest compared with multisig giants like Bohemia, yet activity is consistent. Vendors are ranked by “successful finalized orders” rather than star ratings, a metric that is harder to game but also hides qualitative issues such as compression or smell leakage. Top-tier sellers—those above 500 orders—receive a green “NL-Verified” badge that merely confirms the bond was paid and the PGP key has remained constant for three months; it is not a substitution test or lab analysis. Periodic “doxx anxiety” threads appear because many listings brag about Amsterdam postmarks, a geographic fingerprint that narrows the vendor pool for law enforcement. So far no controlled deliveries have been publicly documented, but German customs reported a three-fold spike in intercepted NL-origin cannabis parcels during Q1-2024, coincidence or not.

Current Reliability and Uptime Metrics

Mirror-4’s onion has maintained 97 % uptime over the past 120 days according to independent crawlers, outperforming several larger markets that suffer from DDoS ransom campaigns. Scheduled maintenance windows are announced six hours in advance and typically last 15–30 min. Withdrawals are processed in the next batch as long as the hot wallet balance exceeds 0.3 XMR; otherwise a queue forms that can stretch to 36 h. The staff claim this delay protects vendor privacy by merging outputs, yet it also fuels exit-scam rumors every time the blockchain crawls. So far all pending withdrawals have cleared, keeping the market off the “Wall of Shame” maintained by darknetlive.

Conclusion – Weighing the Trade-Offs

We Are Amsterdam Mirror-4 delivers exactly what it advertises: a small, cannabis-only market with fast Dutch shipping and no-frills escrow. Its narrow scope reduces exposure to fraud categories that plague generalist bazaars—no ransomware ads, no meth vendors, no counterfeit coupons—but the same minimalism means fewer redundancy layers if the staff decide to vanish. Low vendor bonds keep entry costs reasonable for local growers, yet they also lower the barrier for selective-scam artists who build reputation quickly and then require early-finalize on large orders. For buyers inside the EU the convenience is undeniable: packages arrive in letterbox-friendly envelopes with professional stealth, and the Monero workflow eliminates the address-reuse headaches that still haunt Bitcoin-first markets. Outside the EU the risk/reward calculus is less favorable; customs profiling of Dutch mail continues to tighten, and the market’s geofocused branding makes plausible deniability harder. Treat WAA as you would a neighborhood coffeeshop that happens to run over Tor: reliable for small, frequent purchases if you value speed over diversification, but never keep excess coins in the on-site wallet and always encrypt the drop details yourself, no matter how user-friendly the interface feels.