A second captcha round now appears after login

Signing in used to end at the login page. Now there is a second captcha waiting on the other side of it. That is the shift.

The place the second one appears is not always the same. Sometimes it fires on the account page as soon as you land. Sometimes it fires on the first click after login, which will usually be the messages tab or the wallet page. Either way, you are prompted to solve another challenge before the market lets you do anything useful.

How it read before

The old flow was linear. You typed a username. You typed a password. You solved one captcha. You landed on the account page. From there you could go straight to your wallet, straight to a listing, straight to a vendor message. The captcha was the single gate. Once it opened, you were inside.

A wrong captcha bounced you back to the login form. A right captcha, followed by right credentials, meant the session was live. The market did not stop you again on the way in.

How it reads now

The first captcha is still there and looks the way it did in the smaller redressed login screen. The second one appears after credentials are accepted. It is a plain modal or a full-screen panel. The instructions are terse. The image or the text challenge is roughly the same style as the login one, sometimes a little smaller.

If you solve the second one, you are through and the session behaves normally from there. If you fail it, you get another try. Fail three or four in a row and the market will kick you back to the login page and make you start again from scratch, credentials included.

Why this probably shifted

The most-likely reading is a defence against credential-stuffing traffic that had learned to solve the first captcha. If a script or a solver is walking a list of leaked usernames and passwords, a single challenge at the front door is a speed bump, not a wall. A second challenge, sprung after credentials are validated, is harder to plan around because the attacker has to keep the session alive between the two, and each successful pair costs another solve.

A second reading is a per-session risk check. If the login came from a circuit or a browser fingerprint the market has not seen before, a second challenge is a cheap way to make the reader do a small human-in-the-loop before touching anything expensive.

A third reading is simpler: general bot slowdown across the whole logged-in surface, not just the front door.

What to change on your side

The main thing is to treat the second challenge as normal now, not as a sign that something is wrong with your account.

• Do not read the second captcha as evidence you are flagged. It fires for most sessions now, not only for suspect ones.
• Do not refresh in a loop when it appears. Solve it once, then wait for the page it protects to render. Refreshing on top of a live challenge can invalidate it and force you to start over.
• If it loops and refuses even a correct answer, back out and re-enter through your saved address. See the note on fresh onion panic before you decide the market is broken.
• If it appears mid-session on a page that used to load without challenge, treat it as a soft signal that a session token expired. Related shift: shorter session length.
• Do not confuse the second challenge with the confirmation prompts that live on the checkout page. Those are separate. See the note on address warnings at checkout.
• If you tend to skip the browser update prompt, do not blame the market when the second captcha misbehaves. Related note: browser updates skipped.
• A second captcha is not the same as a payment warning. Related note: combining payments warn.

What this entry is not claiming

This entry does not claim the market is under attack. It does not claim a second captcha means anything about your account, your reputation, or your wallet. It only names a new step in the flow and reads the most-likely explanations for it. If the step is missing on your session, that is also normal. It does not appear for every login on every day.