Wethenorth Independent public record & warning

Independent project. Not affiliated with We The North Market or any marketplace. No links, no addresses, no access — ever.

Section 02 · Case file

The case file: what is documented

This page assembles what published, citable sources establish about We The North Market and the case around it. It is short on drama, long on attribution — and it states plainly what the record does not show.

Timeline of the record

  1. Summer 2021

    A new name appears

    Threat-intelligence researchers describe a new marketplace aimed at Canada, named after a Toronto Raptors slogan and presented as the successor to the Canada-only market Canadian Head Quarters, which had just gone offline. As described in that reporting, the marketplace ran in English and French, required vendors to use two-factor authentication, and prohibited weapons, terrorism-related material and doxxing. The same reporting notes what those rules did not exclude from the catalogue: drugs — cannabis, opioids, stimulants, psychedelics — alongside stolen payment cards, credentials and intrusion tools. [1][4]

  2. January 2022

    Enforcement closes the predecessor

    Canada's telecom regulator announces CA$300,000 in penalties against four individuals in the Canadian Head Quarters investigation, tying the marketplace's clear-web operation to phishing campaigns that mimicked major brands to harvest personal and financial data. The regulator describes the marketplace as "one of the largest Dark Web marketplaces of its kind in the world", says the investigation identified further vendors, and says additional enforcement is expected. [2]

  3. August 2022

    The first file resolves

    The CRTC's public register of enforcement actions records a voluntary undertaking by the marketplace's administrator, including a CA$40,000 monetary payment and other conditions. An undertaking is a negotiated settlement, not a finding of guilt — and it is the quiet ending that usually sits behind an enforcement headline. [3]

The pitch

Professional trackers describe the marketplace's own sales argument: Canada-only trade, with domestic shipping that avoids border checks — "reliability" framed as lower risk. Alongside drugs, its vendors offered hacking guides, stolen credit card information and malware. [4] Everything a marketplace says about itself is marketing. It is recorded here to show what was advertised — not because any of it can be trusted.

What the record does not show

Why this file exists

A search for this name returns two kinds of pages: funnels that sell access, and pages that claim to know which funnel currently "works". Neither is on the reader's side — both are paid for by the trade they describe. This file is the third kind of result: an account of what the record actually shows, drawn only from sources that stand behind their words.

A note on the name

The name borrows a well-known Canadian sports slogan — local pride, used as storefront signage for goods that harm the people who buy them. This project uses the name only as the subject of documentation. It is not an endorsement, an affiliation, or an address.

Sources

  1. Recorded Future (Insikt Group), "WeTheNorth: A New Canadian Dark Web Marketplace". recordedfuture.com/blog/wethenorth-canadian-dark-web↩
  2. CRTC, "CRTC investigation targets Dark Web marketplace vendors and administrator", news release, 26 January 2022. canada.ca — en/radio-television-telecommunications/news/2022/01↩
  3. CRTC, Enforcement actions register (entry concerning the Canadian Head Quarters investigation). crtc.gc.ca/eng/ce/actions.htm↩
  4. Searchlight Cyber, "Dark Web Marketplaces: Intelligence for Cybersecurity and Law Enforcement" (guide, updated 27 August 2026). slcyber.io/learn/dark-web-marketplaces↩

Statements of fact are referenced. Assessments are labelled. Full sourcing policy on For researchers.