Nexus Entrance / Board index /Reference
Nexus addresses three doors, one platform behind them

Your account, balance and orders are the same through all three. Copy rather than retype, and check the signature once you are through.

Door A nexusb2l73qzjn4slhyfxa3jvpolw7fomiz5sgyyefnsdhikaqgborqd.onion
Door B nexusma2iegzo7atzwbrwxhcdopyri3vare2twibldnlc3txqjdeb5yd.onion
Door C nexusabcd6xxpjuftr7i3uohealsg64xtgwrmznkfh3o3rkcf3raxead.onion

An address that opens is not an address that is genuine. The check that settles it takes under a minute.

The account

Three things at setup, one of which is the one people regret skipping.

At setup

  1. A password used nowhere else. Credential reuse is the most common way accounts are lost across this whole space, and it has nothing to do with how strong the password is.
  2. Two factor, immediately. Before you have a balance worth stealing and before you build habits without it.
  3. Save the recovery material before closing the page. This is the step people regret. Recovery without it is limited and sometimes impossible.
Why the third one mattersThe position you do not want is holding a balance behind a challenge you can no longer answer. It costs a minute now and an evening later, and sometimes the account.

Where to keep the recovery material

What two factor does and does not do

It defeats a leaked or reused password, which is the common attack. Somebody trying a credential pair from an unrelated breach hits the challenge and stops.

It does nothing against a live phishing page, which collects the password and the challenge response together and replays both immediately. That is why arriving at the right address matters more than any account setting, and why the key is upstream of everything here.

Two failures that read as account problems

SymptomActually
Codes suddenly rejectedClock drift. Time based codes fail when the machine has drifted, common on systems that were off a while.
Code accepted then rejectedA slow circuit pushed you past the window. New circuit, try again.

If something goes wrong

Work in this order, because it puts what an attacker can act through ahead of what you are most worried about. Password first, from an address you verified yourself. Then reset two factor. Then read the message log, because a stolen account is most valuable as a way to talk to people who trust it. Then open orders. The balance last. The full sequence is on locked out.