There is also the
http://g7pz322wcy6jnn4r.onion/opensource/ovdb/ac/index.php drug market.
Tracing hidden services is trivial for a skilled attacker. The best way to do it is to send a time modulated stream of packets to the hidden service over many different circuits. Hidden services open new circuit for every rendezvous point and the clients can select to use as many rendezvous points as they desire. This makes locating hidden service entry guards easy as you can flood some nodes to the network and look for the pattern in the packets you send to the hidden service. This will locate the three entry guards which can then be trap and traced to find the hidden services location, or tons of other attacks. Don't count on Tor hidden service to give you a server that can't be traced! You should edit the Tor source code to select for a four or five hop circuit, with the first two or three nodes being guards(from a small pool, meaning two-three guard chain). You could select to use a single entry guard, this will reduce the chance that the attacker owns one of them. However it is bad for uptime and there are some other attacks that this could theoretically be weaker to than using three guard nodes. I personally think it is a good idea, others may disagree.
The main risk if the attackers locate the hidden service is that they could take it over and be in a good position for application layer side channel attacks. All orders must be encrypted with GPG if you want a chance, this helps tremendously because then if the server is compromised the attacker can not impersonate vendors or harvest customer addresses. The hidden service being compromised should be assumed after some time. You can make it harder for the attacker to trace the hidden service on the application layer by using a few techniques. First of all you can run things on an OpenBSD server with ASLR and a 64 bit processor to make buffer overflow attacks all but impossible. If you have some money to spend I suggest you make a tamper resistant case that can detect if it is physically penetrated and wipe the volatile memory, put the ram in encapsulation material and do co-location anonymously. Be careful not to leave DNA fingerprints or other links on the physical server if you go this route. You can isolate the server by putting it on a virtual machine, isolate the processes by using BSDjails style virtualization inside this VM. Tor should be in its own VM separate from the VM the web server is in, with all traffic forced on the host to go through the Tor VM. This way an application layer compromise of the web server can not side channel Tor unless the attacker can go through the hypervisor. You should also use mandatory access control profiles to really lock the web server down as much as possible.
The biggest thing to worry about is geolocation intelligence being coupled with Tor observability. I imagine these sites are going to be attacked by the feds intersecting the crowd of Tor users with the people in a rough proximity of where packages are shipped to narrow in on a likely suspect pool. In other words, you should worry less about the hidden service and more about the operational security of the vendors. Vendors should not connect from home or even use Tor or other anonymizers from home. They should use Tor bridges to offer membership concealment, however it is not known if the FBI or DEA are capable of detecting bridged connections. Using bridges makes you easier to trace through the network but for our threat model membership concealment is quite important....they feds don't need to trace through the network they can look for connections into the network since they can determine geolocation from mail.
I suggest that you make a clear separation between order retrieval and order decryption. Use Tor + Bridges + open wifi in always changing random locations, not from a car but on foot + ASLR + MAC + FDE + General hardening on the machine you use to get orders. Another option is to use a live CD, these will not be as technically secure as you can configure things yourself but they have the huge advantage of leaving no traces as soon as they are shut down which will give you more plausible deniability in court than if you refuse to decrypt a machine. Another disadvantage of live CD is the lack of ability to use bridges usually, open Wifi is not true membership concealment but rather location unlinkability (the attacker will likely be able to determine where Tor connections were made from, but they may not be able to link these geographic locations connections were made from to your base location). You should also use virtual machine with NAT connection so that if your order retrieval machine is hacked they can not access your WiFi adapter and pull near by MAC addresses to geoposition you. Plus Tor Browser seperation via a VM and firewall rules on the host.
After encrypted orders are retrieved you should burn them to a CD still encrypted. The decryption should take place on a fully separate machine with no access to the internet. This way even if they manage to compromise the machine that can connect to the internet, they can only pull ciphertext. If they compromise the decryption machine, they can not communicate back customer addresses. You could build a copper mesh cage to contain the decryption machine and cover it with blankets and generate noise to create a make shift SCIF, to protect from transient electromagnetic signals being used to reconstruct your monitor hidden cameras pulling the screen/keyboard, acoustic analysis of keystrokes. Or you could use an on screen keyboard to protect from audio analysis of keystrokes. These are disadvantages to using a SCIF, primarily you will have a hard time to explain it in court and copper mesh is not cheap. On the other hand, if they do van eck radiation analysis to pull your screen they pretty much win anyway. Your best bet is to make it so they can't find your location to do this sort of attack in the first place.
I would also consider compartmentalising customer support from shipping. Communicate with the shipper using steganography or some covert channel to conceal the link.
