By keeping transactions within the market, Lin made it significantly harder for law enforcement to trace payments, adding an additional layer of anonymity for both buyers and sellers. In October 2020, Lin allegedly launched Incognito Market on the Tor network, a platform designed with the sole purpose of enabling anonymous transactions for illegal goods. Prosecutors say Lin, a native of Taiwan, supervised all of the market's operations, employees and vendors for four years. Federal prosecutors said they have put a stop to one of the largest illegal narcotics marketplaces on the internet after arresting its operator. The coding projects include operation of cryptocurrency servers and web applications like PoW Shield, a tool to mitigate DDoS attacks; Monero Merchant, a software tool that allows online merchants to accept XMR for payment; and Koa-typescript-framework, a webframe software program used as a foundation for web applications. It kept the financial information of vendors and buyers separate, making it more difficult for any one actor on the marketplace to learn any other actor’s true identity, a complaint filed against Lin said.
Role Of “Pharaoh”: The Dual Life Of Rui-Siang Lin
Lin, who allegedly used the aliases Pharoah and faro, faces charges that include running a criminal enterprise and money laundering. Most notably, there was a tool to mitigate DDoS attacks, software that allows online merchants to accept XMR for payment, and "Koa-typescript-framework" – a program used as a foundation for web applications. "After a narcotics transaction was completed, cryptocurrency from the buyer's 'bank account' was transferred to the seller's 'bank account,' less the five percent fee that Incognito collected. The bank enabled buyers and sellers to stay anonymous from each other," the Department further explained. Rui-Siang Lin – who also went by the online pseudonym "Pharoah" or "faro" – is accused of having run the entire business.
- If convicted, Lin faces a mandatory minimum penalty of life in prison for engaging in a continuing criminal enterprise.
- Incognito Market deals primarily in narcotics, so it’s likely many users are now worried about being outed as drug dealers.
- To become an Incognito Market vendor, each vendor was required to register with the site and pay an admission fee.
- The El Dorado Task Force’s Darkweb and Cryptocurrency Task Force leverages cutting-edge techniques to target even the Internet’s most savvy criminals.
- “The FDA is committed to continuing its work to disrupt and dismantle the illegal sales of drugs on the dark web, where such sales far too often have tragic consequences,” said Special Agent in Charge Charles Grinstead of the Food and Drug Administration’s Office of Criminal Investigations (FDA-OCI) Kansas City Field Office.
ARC Data Sale Scandal: Airlines’ Travel Records Used For Warrantless Surveillance
The operational security mistakes the FBI describes suggest that, regardless of which side of the cryptocurrency cat-and-mouse game Lin intended to end up on, he was far from a criminal mastermind. Although the FBI says Lin tried to swap his bitcoins for harder-to-trace monero before cashing out the cryptocurrency at an exchange, the criminal complaint points to timing and amount correlations that nonetheless allowed the FBI to follow his funds to a crypto exchange where he allegedly liquidated the dirty funds. In a post to the dark-web market forum Dread, Pharoah made clear that Antinalysis was designed not to help anti-money-laundering investigators, but rather those who sought to evade them—presumably including his own dark-web market's users. In retrospect, Ormsby says that the site's apparent user-friendliness and its security features were perhaps a multiyear con laying the groundwork for its endgame, a kind of user extortion never seen before in dark-web drug markets.
- While on April 1, 2024, Pharoah announced that the extortion announcement had been a joke, vendors on the platform had already looked for other options.
- On May 21, after online media wrote about Rui-Siang’s arrest and rumors spread throughout the darknet community, ‘MommaBear’, one of the administrators of the SuperMarket darknet marketplace, posted on Dread that the Cold Storage Escrow and Joint Pocket wallets had been emptied.
- This meant that even if one server was compromised, the rest of the network would remain intact, allowing the market to continue operating without interruption.
- Incognito Market has emerged as a significant player in the darknet marketplace, acclaimed for its clean and minimalist design that focuses on a smooth user experience.
- “As alleged, Rui-Siang Lin’s brazen operation resulted in the illicit sale of over $100 million in narcotics, including those that were mislabeled and later found to include deadly fentanyl.
He Trained Cops To Fight Crypto Crime—and Allegedly Ran A $100M Dark-Web Drug Market
All criminal companies, especially those whose leaders distribute illicit substances on the dark web, will be targeted and dismantled by the FBI. A coordinated operation by the FBI, HSI, DEA, FDA-OCI, and NYPD led to Lin’s arrest. Users could log in with a unique username and password, and browse thousands of narcotics listings. Those looking to flout the law will not find refuge in the so-called “dark web.”
“Under the promise of anonymity, Lin’s alleged operation offered the purchase of lethal drugs and fraudulent prescription medication on a global scale,” said James Smith, an assistant director in the FBI’s New York office. Lin’s arrest is the latest in a string of U.S. and international actions against illicit online marketplaces. Prosecutors said that the market, beginning in 2020, sold $100 million of controlled substances, “including hundreds of kilograms of cocaine and methamphetamines” as well as bogus prescription drugs like mislabeled oxycodone. And how can trust be established in high-risk or unregulated environments, including legal marketplaces in countries with low state capacity and rule of law?
How The November 2025 Bitcoin Crash Fractured The Cybercriminal Economy
His LinkedIn and social media posts – bragging about Chainalysis certifications and showing diagrams of darknet money flows – may not have been direct evidence of running Incognito, but they painted a picture of someone deeply involved in the subject matter. When Lin eventually moved the funds back into the regular financial system via a cryptocurrency exchange, those patterns gave him away. Even though Lin attempted to obfuscate the money trail by converting Bitcoin to Monero (a cryptocurrency specifically designed to be untraceable), the timing and amounts of certain transfers created identifiable patterns. The exact method remains classified, but possibilities include a mix of operational mistakes by Lin and sophisticated cyber investigative techniques. In November 2023, for example, an undercover agent ordered what was advertised as pharmaceutical oxycodone from an Incognito vendor. Agents posing as customers made purchases on Incognito Market to gather evidence of illegal activity and to sample the products being sold.
Black Ops Market: A New Era Of Darknet Marketplaces
I know I’ve lined it up perfectly but it never goes through first time. He could also receive a maximum penalty of life in prison for narcotics conspiracy, a maximum penalty of 20 years for money laundering, and a maximum of five years for conspiracy to sell adulterated and misbranded medication. "The defendant's greed and disregard for others was further demonstrated by his alleged extortion attempt during the platform's final days," lamented Ivan J Arvelo of Homeland Security Investigations (HSI) New York.
Lin was accused of being the principal operator of a Continuing Criminal Enterprise (CCE) – often referred to as the “kingpin” or “drug lord” statute – due to the large-scale, ongoing narcotics trafficking conspiracy he oversaw. The legal case against Rui-Siang Lin is being prosecuted in the Southern District of New York, a jurisdiction known for tackling high-profile cybercrime and narcotics cases. Lin’s case is a study in the classic cat-and-mouse game – with a twist that the cat (law enforcement) had some very powerful new mice-hunting tools. For cybersecurity professionals and law enforcement agents, the take-down of Incognito Market is rife with lessons. Knowing that Lin resided overseas (Taiwan, and possibly on assignment in St. Lucia), law enforcement had to be strategic about how to apprehend him. Moreover, the Namecheap domain registrations under Lin’s name provided a concrete link between his real-life identity and the dark web (through that market-tracking site).
Security Incognito Marketplace
The operator of Incognito revealed the scale of information at risk, including a comprehensive dump of 557,000 orders and 862,000 cryptocurrency transaction IDs. "….SURPRISE SURPRISE!!! Anyway, if anything were to leak to law enforcement, I guess nobody ever slipped up." The operators are demanding payment and have warned that failure to comply will result in the information being disclosed to law enforcement authorities. Hundreds of pounds of cocaine, methamphetamines, and other drugs were sold on Incognito Market since its launch in October 2020, it said. The stings have included markets for cybercrime tools and stolen data, including BreachForums last week and xDedic in January.
Users of Incognito Market were able to search thousands of listings for illegal narcotics, including heroin, cocaine, LSD, MDMA, oxycodone, methamphetamines, ketamine, and alprazolam. "As alleged, Rui-Siang Lin was the architect of Incognito, a $100 million dark web scheme to traffic deadly drugs to the United States and around the world," Attorney General Merrick Garland said in a statement. On March 12, 2020, before Incognito Market launched, LIN emailed himself a rough diagram of a darknet marketplace. In exchange for listing and selling narcotics as a vendor on Incognito Market, each vendor paid 5% of the purchase price of every narcotic sold to Incognito Market.
Notably, the diagram indicated “vendor,” “listing,” “pgp key,” and “admin review,” all of which are features of (Incognito Market),” the complaint said. “Collectively, these coding projects indicate that LIN has significant technical computing knowledge, including knowledge necessary to administer a site like (“Incognito Marketplace”),” the complaint said. Lin seems like a knowledgeable person in the field of security and cryptocurrency, as per social media accounts listed in the complaint against him. The escrow service was set in such a way that a buyer’s money would be released to a seller only after specified actions, for example, the shipment of narcotics is made.
Vinomofo Failed To Protect Customer Data, Australian Privacy Commissioner Rules
The 'bank' also facilitated the exchange of different cryptocurrencies, giving users more flexibility in how they conducted their transactions. This wasn’t just a simple wallet for storing Bitcoin or Monero—it was a full-fledged banking system that allowed users to deposit funds, conduct transactions, and even earn interest on their deposits. One of Lin’s most innovative contributions to the darknet was the creation of a cryptocurrency 'bank' within Incognito.
HSI New York leads and directs all operational and administrative activities of the El Dorado Task Force (EDTF). Lin’s alleged actions of putting profits before public health were not only reckless and dangerous, but unconscionable. The so-called ‘dark web’ is not a safe haven for those who seek to break the law.” The long arm of the law extends to the dark web, and we will bring to justice those who try to hide their crimes there.” “Drug traffickers who think they can operate outside the law on the dark web are wrong,” said U.S. To become an Incognito Market vendor, people were required to register with the site and pay an admission fee.
"Lin collected millions of dollars of profits from Incognito. To facilitate these financial transactions, Incognito Market had its own 'bank,' which allowed its users to deposit cryptocurrency on the site into their own 'bank accounts,'" explained the DoJ. A 23-year-old Taiwanese man was arrested in New York for allegedly running the $100 million global dark web narcotics e-commerce operation known as Incognito Market. Users, too, began to migrate to smaller, more obscure markets, hoping to avoid the attention of law enforcement. Other darknet markets quickly took notice, with many administrators shutting down their operations in fear of being the next target. This could have been during the registration of online accounts or through other transactions that required some form of identification. Additionally, Lin made the critical mistake of using identifiable personal information at some point during his operations, which law enforcement was able to capture.
Special Features
The success in tying cryptocurrency to a real identity reinforces law enforcement’s confidence in tackling crypto-enabled crimes. Such a sentence would underline that running a darknet market, even “just” as the technical facilitator, is treated as severely as if one were a traditional drug cartel boss. In addition to the CCE charge (under U.S. drug laws), Lin faced counts of conspiracy to distribute narcotics, conspiracy to commit money laundering, and conspiracy to sell adulterated and misbranded drugs.
