What Is WeTheNorth Market? Canada's Darknet Marketplace Explained

WeTheNorth (WTN) is a Canada-focused darknet marketplace, a Tor-based underground shop named after the Toronto Raptors slogan that sells drugs alongside fraud tools, stolen data, malware, and counterfeit documents to a mostly Canadian audience. It launched in 2021 to replace an earlier Canadian market and has grown into the country's best-known regional darknet platform. This guide explains what WeTheNorth Market is, its history, everything it sells, how it operates, the 2025 RCMP enforcement action against Canadian vendors, and how both individuals and businesses can defend against the harm it fuels.

Updated: August 2026. A defensive, threat-intelligence and law-enforcement overview for security teams, Canadian organizations, and the public. It contains no marketplace addresses, mirror links, or access instructions, and does not endorse or assist any illegal activity.

A note on the name. "WeTheNorth" here refers to the Canadian darknet marketplace. It is unrelated to cryptocurrency tickers like WETH (Wrapped Ether) or any stock "market cap," which autocomplete sometimes suggests. This article is strictly about the dark web market.

The quick answer

Here is the whole picture in one table; the rest of this guide expands each row.

The one line to remember: WeTheNorth is a regional darknet market built to serve Canada, and its stolen-data listings put Canadian organizations directly in scope.

What is WeTheNorth Market?

WeTheNorth is a darknet marketplace that operates over the Tor network and deliberately targets a Canadian user base. Where global markets serve everyone, WTN positions itself as a home-grown option, with bilingual support and a brand built around national identity. It was discovered and profiled by Recorded Future's Insikt Group, whose research remains the authoritative account of its origins.

It belongs to the ecosystem we map in our top dark web marketplaces roundup, and like other hidden services it is reached through anonymity software, explained in dark web vs darknet vs Tor. While drugs make up most of its volume, the reason it matters to security teams is the other half of its catalog: the fraud tools, stolen credentials, and malware that make it a regional outlet for cybercrime against Canadians.

Why is it called WeTheNorth?

The name is a direct nod to the Toronto Raptors' "We The North" slogan, the rallying cry of Canada's only NBA team. The administrators leaned into national branding to present the market as one built to protect Canadian buyers and sellers specifically. It is marketing, not ethics, a criminal marketplace does not become trustworthy because it waves a flag, but the branding is a real and telling detail. It signals the market's whole strategy: be the local, familiar, Canada-first option in a global underground.

A short history: from Canadian HeadQuarters to WeTheNorth

WeTheNorth did not appear in a vacuum. It filled a gap left by the collapse of its predecessor.

Recorded Future's Insikt Group judged, with moderate confidence, that WeTheNorth was created specifically to replace The Canadian HeadQuarters. That succession pattern, one market falling and another rising to serve the same regional audience, is the defining rhythm of the darknet economy, and it is why takedowns rarely end the underlying demand. We track these transitions in dark web marketplace takedowns.

What WeTheNorth Market sells

WTN is a generalist market, but its catalog splits cleanly into two worlds: the drugs that drive its volume and the cyber goods that make it a security concern.

Drugs, chiefly cannabis, cocaine, and party drugs, are the bulk of the trade. But for a security audience, the important columns are the stolen data, credentials, and malware, because those are the products that turn WeTheNorth from a drug problem into a cybersecurity one.

The cyber goods: why WeTheNorth matters to security teams

Most coverage of WeTheNorth focuses on drugs. For defenders, the more relevant story is that it is another marketplace where stolen Canadian data is bought and sold.

• Stolen payment cards and bank details feed the same card-fraud economy as dedicated carding shops like BriansClub.
• Login credentials overlap with the infostealer-log trade that markets like Russian Market specialize in, and that we analyze in infostealer malware and credential theft.
• Malware and access-for-hire give buyers the means to breach organizations directly.
• Fraud tools and guides lower the skill barrier, the same fraud-as-a-service dynamic behind markets like STYX.

The regional angle sharpens the risk. A Canada-focused market can create a concentrated venue for Canada-specific fraud goods, credentials, and identity data, which makes Canadian banks, retailers, and their customers particularly relevant to what trades there.

How WeTheNorth Market operates

WTN runs on the same playbook as other established darknet markets, tuned for its Canadian audience.

Two details stand out. The bilingual support underscores how deliberately Canadian the market is. And the acceptance of Monero alongside Bitcoin matters for law enforcement: Monero is a privacy coin designed to obscure transaction trails, which complicates the blockchain tracing that police use to follow the money, a challenge we return to in the enforcement section.

A word on the market's advertised "rules." WeTheNorth publicly prohibits certain categories, and markets often tout such rules to appear principled. This is not ethics; it is business and self-preservation. A marketplace trafficking drugs, stolen data, and malware is a criminal enterprise regardless of what it bans, and its "rules" should be read as reputation management, not a moral stance.

Why regional darknet markets like WeTheNorth persist

WeTheNorth's Canada-first model is a strategy, and understanding why it works explains why regional markets keep appearing.

• Trust and familiarity. Buyers prefer a market that speaks their language, ships domestically, and understands local logistics.
• Faster, safer domestic shipping. Staying within one country avoids the customs inspections that catch international drug parcels.
• A ready audience after takedowns. When a market falls, its national users look for a same-country replacement, exactly the CanadianHQ-to-WTN handoff.
• Smaller law enforcement footprint. Regional markets can fly under the radar of the large international operations that target the biggest global platforms.

This is the same succession dynamic that keeps the whole ecosystem alive: demand is regional and persistent, so when one market dies, another rises to serve the same buyers.

WeTheNorth vs other darknet markets

WeTheNorth is best understood next to the markets it sits beside, because its regional niche is what defines it.

The contrast is the point. The global markets specialize by product, one does logs, one does fraud services, one did card dumps. WeTheNorth specializes by geography, offering a bit of everything to one country. That regional model is less about scale and more about trust and logistics, and it is why a smaller market can hold a loyal national audience even as larger global platforms rise and fall.

The Canadian darknet context

WeTheNorth exists because of conditions specific to Canada, and those conditions explain why it persists.

• A regional buyer base that values staying domestic. Canadian buyers prefer in-country shipping that avoids international customs, and sellers who understand Canadian logistics and payment habits.
• The opioid crisis. Canada's synthetic-opioid epidemic drives both demand and an intense law enforcement and financial-intelligence response, including FINTRAC indicators aimed squarely at opioid-trafficking money flows.
• Bilingual reach. English and French support widens the market's usable audience across the country.
• A history of succession. CanadianHQ fell and WTN rose; if WTN falls, the same demand will seek another Canadian home. The pattern, not any single site, is the durable thing.

For defenders, the lesson is that a regional market is a regional risk. A Canada-focused platform concentrates stolen Canadian data, so Canadian organizations cannot treat the darknet as a distant, foreign problem, some of it is aimed at them specifically.

Law enforcement pressure: the 2025 RoadRunna case

While WeTheNorth itself has not been confirmed taken down, its vendors and users are squarely in law enforcement's sights, and 2025 brought one of Canada's largest darknet drug enforcement actions.

In September 2025, the Ontario RCMP dismantled a major dark web drug trafficking network and charged seven people from the Greater Toronto Area, aged 30 to 46. The operation centered on a Canadian vendor known as "RoadRunna," described as a sophisticated enterprise shipping roughly 400 packages a week across the country, as CBC and other outlets reported.

The most instructive detail is how it started: the RCMP investigation began after German authorities took down a darknet marketplace and flagged Canadian users to their Canadian counterparts. Public RCMP reporting did not identify that marketplace by name. That is the modern reality of darknet enforcement, international, cooperative, and patient. A separate 2025 US case saw a Canadian dark web vendor sentenced for importing millions of counterfeit Xanax pills, underscoring that Canadian darknet activity draws cross-border prosecution.

Following the money: crypto tracing and Monero

The financial side of enforcement is evolving alongside the operations. The RCMP and Canadian financial-intelligence bodies increasingly treat darknet crime as a money-laundering problem to be solved with blockchain analytics.

• Blockchain tracing lets investigators follow Bitcoin transactions across the ledger, which is why markets and vendors push privacy coins.
• Monero's design obscures sender, receiver, and amount, making transaction tracing substantially harder than with transparent blockchains such as Bitcoin.
• FINTRAC, Canada's financial-intelligence unit, has published indicators to help businesses spot and report laundering tied to synthetic-opioid trafficking.
• International frameworks like the Canada to US Opioids Action Plan coordinate the cross-border money-tracing that darknet cases require.

For businesses, the takeaway is that darknet proceeds move through the regular financial system eventually, and the same monitoring that catches fraud can surface laundering, if it is in place.

What the RoadRunna case teaches defenders

The RoadRunna takedown is more than a headline; it is a case study in how darknet enforcement actually works, and the lessons apply well beyond drugs.

• Anonymity is not permanence. Vendors believe pseudonymity and Tor protect them indefinitely. In practice, operational mistakes, shipping patterns, and cross-border data sharing unravel that over time. The same is true of buyers of stolen data.
• The money is the weak link. Investigations increasingly follow cryptocurrency and physical logistics; the 400-packages-a-week shipping operation and the branded packaging were as incriminating as anything on-chain.
• International cooperation is the norm, not the exception. A German market takedown seeded a Canadian investigation. No darknet actor operates in a single jurisdiction's blind spot anymore.
• Takedowns are patient and cumulative. Enforcement rarely happens in one dramatic strike; it builds from tips, seizures, and shared intelligence over months or years.

For a corporate security team, the parallel is direct: the criminals who buy your stolen credentials on a market like WeTheNorth are not untouchable, and the same evidence trail that convicts a drug vendor can support the investigation of a fraud or breach against your organization. Preserving logs, monitoring for your exposed data, and engaging law enforcement early all feed that process, which is a core part of any mature incident response plan.

Is WeTheNorth Market real or a scam?

Searches asking whether WeTheNorth is "real," how to reach it, or which link is genuine are common, and the honest answer is a warning, not a directory.

• The market is real, but its core offerings facilitate criminal activity. Buying controlled drugs, stolen credentials, malware, or fraud services can violate Canadian criminal and drug laws. Exact offenses depend on the conduct involved.
• The search results are a minefield of clones. The single biggest risk to anyone searching "WeTheNorth" is that most of the "mirror," "verified link," and "login" pages that rank are phishing sites and scams built to rob or infect would-be visitors, not the market itself.
• Darknet markets scam their own users. Even genuine markets exit-scam, vanishing with escrow funds, and vendors defraud buyers routinely.
• Casual access is not research. Legitimate intelligence firms may examine criminal platforms using controlled, authorized research methods rather than casual access or transactions.

So "real or fake" resolves to: real enough to get you charged or scammed, and surrounded by clone sites that are pure traps. The safe move is to stay away entirely.

Who is at risk from WeTheNorth

The harm from a market like WTN falls on two very different groups.

The common thread for a security audience is that a regional market concentrates regional victims. If your customers and staff are Canadian, a Canada-focused market is where their stolen data is most likely to surface.

How to defend: individuals and the public

There is no safe way to use a darknet drug market, and the defensive advice is simple and firm.

• Do not access it. Beyond the legal risk, the clone and phishing sites that dominate search results are designed to steal from and infect visitors.
• Treat drug listings as doubly dangerous. Darknet drug supply is unregulated and frequently adulterated, including with synthetic opioids; there is no quality guarantee behind an escrow badge.
• Recognize the scam ecosystem. "Verified link" directories and login pages for these markets are overwhelmingly fraudulent.
• Report, don't engage. Suspected darknet drug activity should go to the RCMP or local police, and suspected fraud to your bank and Canadian anti-fraud authorities.

How to defend: businesses and security teams

For organizations, WeTheNorth is a reminder that your data may be traded on markets you never see. The defense is the same disciplined program that counters the broader darknet economy.

The single highest-value move for most organizations is continuous monitoring for their own exposed credentials, combined with authentication strong enough that a leaked password alone is not enough to get in. When something does leak, a rehearsed incident response plan decides how contained the damage stays.

How darknet-sold data shows up in a breach

For a security team, the abstract threat of a market like WeTheNorth becomes concrete when stolen data is put to use. Recognizing the pattern helps you catch it early.

The critical insight is that you rarely see the first two stages, they happen on markets you cannot watch. Your leverage is at the access and takeover stages, where strong authentication and monitoring decide whether a leaked credential becomes a breach. That is why defense assumes the leak has already happened and focuses on making it worthless.

Why this matters for security teams

WeTheNorth illustrates a point that is easy to miss when darknet coverage fixates on drugs: every generalist market is also a data market. Stolen Canadian cards, logins, and malware trade there beside the narcotics, which means a Toronto retailer or a Montreal fintech can be harmed by a market it will never visit. Our dark web statistics roundup shows how much stolen data circulates and how quickly it moves from breach to marketplace.

That is why defense cannot stop at the firewall. It has to assume your credentials may already be for sale and validate that your controls survive it. DeepStrike's penetration testing is manual-first and adversary-realistic: our team probes the authentication, payment, and access paths that darknet-bought credentials and malware target, confirms whether your defenses actually hold, and delivers the concrete fixes before your data becomes someone's listing. For US-based organizations, see our US penetration testing services.

FAQ

What is WeTheNorth Market?

WeTheNorth (WTN) is a Canada-focused darknet marketplace on the Tor network. It sells mainly drugs, along with fraud tools, stolen credit cards, login credentials, malware, and counterfeit documents, and markets itself specifically to Canadian buyers and sellers with bilingual support.

Why is it called WeTheNorth?

The name references the Toronto Raptors' "We The North" slogan, the rallying cry of Canada's NBA team. The administrators used the national branding to present the market as built for and protective of Canadian users, though the branding is marketing, not any indication of legitimacy or safety.

What does WeTheNorth Market sell?

Its largest category is drugs, mainly cannabis, cocaine, and party drugs. It also sells fraud tools, stolen payment card data, account credentials, malware and hacking services, counterfeit documents, and digital how-to guides. The stolen-data and malware listings are what make it a cybersecurity concern, not just a drug market.

When did WeTheNorth launch?

WeTheNorth launched in 2021, filling the gap left when The Canadian HeadQuarters, the previous dominant Canadian market, shut down in July 2021. Recorded Future's Insikt Group discovered it that same year and judged it was likely created to replace its predecessor.

Is WeTheNorth the same as CanadianHQ?

No. CanadianHQ was an earlier Canada-focused darknet marketplace that shut down in July 2021. Recorded Future's Insikt Group assessed with moderate confidence that WeTheNorth was likely created to replace it and serve the same regional audience.

Has WeTheNorth been shut down?

As of this writing, there is no credible confirmation that WeTheNorth itself has been taken down, and it is reported to remain active. However, its vendors are being pursued: in September 2025 the RCMP dismantled a major Canadian darknet drug network and charged seven people, an investigation that began with a tip from German authorities.

Is WeTheNorth Market real or a scam?

The market is real, but engaging with it is dangerous and illegal. More practically, most of the "mirror," "login," and "verified link" pages that appear in search results are phishing clones built to scam or infect visitors. Darknet markets also exit-scam and vendors defraud buyers, so there is no safe version to find.

Is it legal to access WeTheNorth in Canada?

Using the market to buy illegal drugs, stolen data, malware, or fraud services can violate Canadian law. Merely viewing a site is a different legal question and depends on the circumstances, but interacting with criminal marketplaces also creates substantial security, fraud, and law-enforcement risk.

How can businesses protect against darknet-sold stolen data?

Monitor dark web and stealer-log sources for your brand and customer credentials, enforce phishing-resistant MFA so leaked passwords are not enough to log in, run fraud and endpoint monitoring, verify identities strongly, and penetration test your authentication and payment flows. A tested incident response plan limits damage when data does leak.