As alleged in the complaint and the indictment, Incognito Market was an online narcotics bazaar that existed on the dark web. Since that time, and through its closing in March, Incognito Market sold more than $100 million of narcotics — including hundreds of kilograms of cocaine and methamphetamines. The message included a list of the “top” vendors who had paid the ransom to protect their customers and themselves. The payments ranged from $100 to $20,000, depending on how many transactions each person had handled. They didn’t want their business to be exposed to the police, but paying the blackmailers could lead to even higher demands.
Exit Scam & Extortion
According to TRM, deposits to Incognito dramatically decreased but still continued during this time period. And if that weren’t enough, the platform’s finals days were allegedly spent extorting its users between $100 and $20,000, under threat of revealing they had participated in the purchase and sale of illegal drugs. U.S. agencies like the FBI, DEA, IRS-CI, and HSI worked alongside Europol, the U.K.’s NCA, and law enforcement from over a dozen countries. At the same time, financial enforcers like OFAC sanctioned individuals running darknet markets—including Iranian national Behrouz Parsarad of Nemesis—demonstrating how financial tools are being brought into alignment with traditional law enforcement. Investigation of crypto transactions that led to the arrest of Riu-Siang Lin shows that threat actors and criminals in the underground forums cannot operate alone and without leaving any traces when switching to real life. “Pharao” created the Incognito marketplace when he was just a student, probably trying to make more money.
ICE USWDS Footer Links
That revenue, according to the indictment, funded Incognito Market’s operations, including paying “employee” salaries and for computer servers. Buying illegal drugs is dangerous, but investigators found that even prescription medication advertised as authentic on the site could not necessarily be trusted. For instance, an undercover law enforcement agent bought tablets on Incognito Market in November 2023 that were supposed to be oxycodone, but were actually fentanyl. Incognito, like other modern darknet platforms, operated entirely on cryptocurrency—primarily Bitcoin and Monero.
Food and Drug Administration’s Office of Criminal Investigations’ Kansas City field office, and the New York City Police Department. The markets agencies said in a joint statement they’re OK with certain crypto assets trading on registered entities now, before Congress’ market structure bill. Assistant U.S. Attorneys Ryan B. Finkel and Nicholas Chiuchiolo are in charge of the prosecution.
Incognito Link
By the time he graduated, Lin had a plan—a plan to create the most secure and successful darknet market the world had ever seen. The final evidence that law enforcement found linking Lin to the administrator “Pharoah” of Incognito Market was a “simple” hand-drawn workflow diagram of a darknet marketplace that was mailed from Lin’s personal email address. “For example, in November 2023, an undercover law enforcement agent received several tablets that purported to be oxycodone, which were purchased on Incognito Market. Testing on those tablets revealed that they were not authentic oxycodone at all and were, in fact, fentanyl pills,” the Justice Department said. Just as Incognito built on the playbook of its predecessors, future markets will learn from RapTor. But with blockchain intelligence advancing and global partnerships strengthening, law enforcement is better positioned than ever to detect, disrupt, and dismantle these operations.
Incognito Market Incognito Market Link Incognito Market Mirror Incognito Market Onion
On other platforms, such as OpenSea, Lin sells NFTs with basketball players, and his collections appear to be up to 37 NFTs. In October 2021, the defendant also gave a YouTube interview explaining how his anti-DDoS tool “PoW Shield” worked for Pentester Academy TV, demonstrating his technical skills. Rui-Siang Lin is a 23-year-old developer who describes himself on LinkedIn as a “crypto enthusiast and developer” from Taiwan. He claims to be an employee of Taiwan’s Ministry of Foreign Affairs, working as a “diplomatic specialist” in the technical section of the Taiwanese embassy in St Lucia.
Inside A $100M Darknet Drug Empire: Taiwanese Founder Pleads Guilty
Buyers and sellers used wallets controlled either directly or through third-party mixers and exchanges. While Monero obscures transaction details, Bitcoin’s traceable blockchain provided law enforcement with critical leads, particularly at the point of off-ramp—when vendors converted crypto into fiat or moved assets through centralized exchanges. According to the indictment, between 2022 and 2023, law enforcement agents executed search warrants to gain access to three servers used to operate the marketplace and containing marketplace data. One of the servers searched by the agents was the so-called “bank”, a database containing all cryptocurrency transactions. This allowed US law enforcement to trace cryptocurrency transfers to a digital wallet linked to Lin, leading to his identification and arrest.
Latest News Incognito Market
Lin recognized this vulnerability and transitioned the market to Monero, a cryptocurrency designed specifically for privacy. In mid-March 2024, the Incognito administrator(s) announced an exit scam and threatened to release all of the vendor information and private messages between vendors and buyers to law enforcement. Pharaoh asked vendors for payment by April 1, 2024 in exchange for not releasing information to law enforcement. While on April 1, 2024, Pharoah announced that the extortion announcement had been a joke, vendors on the platform had already looked for other options. This banking service obscured the locations and identities of vendors and customers from each other and from law enforcement. It kept the financial information of vendors and buyers separate, making it more difficult for any one actor on the marketplace to learn any other actor’s true identity, a complaint filed against Lin said.
Operation RapTor builds on the successes of prior years’ operations and takedowns of marketplaces, which resulted in the seizure of darknet infrastructure from Nemesis, Tor2Door, Bohemia, and Kingdom Markets, providing investigators across the world with investigative leads and evidence. JCODE and Europol’s European Cybercrime Centre (EC3) continue to compile intelligence packages to identify entities of interest. These leads allow U.S. and international law enforcement agencies to identify darknet drug vendors and buyers, resulting in a series of coordinated, but separate, law enforcement investigations, reflected in the statistics announced today. In furtherance of Operation RapTor and in its first action as a JCODE member agency, the Office of Foreign Assets Control (OFAC) additionally sanctioned Iranian national Behrouz Parsarad for his role as the founder and operator of Nemesis Market following seizure of the market. Parsarad was also indicted by a federal grand jury in the Northern District of Ohio on drug trafficking charges related to the illegal business he ran on the dark web.
- Conversely, some privacy advocates look at cases like Lin’s and argue that people like him misuse anonymity tools, making it harder for those tools to be available for legitimate purposes.
- In addition, the United States and international law enforcement partners made 270 arrests of dark web vendors, buyers, and administrators in Austria, Brazil, France, Germany, Netherlands, South Korea, Spain, Switzerland, United Kingdom, and the United States.
- Then, the scammers threatened to share the private chat details that were supposed to be secret.
- Further, in an attempt to extort the members, the admin threatened to leak private messages, transaction information, and order details of vendors and buyers unless they paid a fee ranging from 100 to 20 thousand dollars.
- In the 41 months that Incognito Market was open, it facilitated the sale of more than $100 million of narcotics.
Minutes later, roughly the same amount in Monero (XMR) was deposited in a crypto Exchange account registered to Rui-Siang Lin. Designed to manage seamless narcotics transactions across the web, Incognito Market ran in much the same way as a legitimate business, incorporating advertising, customer service and branding. Lin, a self-described crypto developer and fan of privacy coin Monero, said on X that he facilitated a four-day workshop on cyber crime and cryptocurrency for 30 police officers at the Saint Lucia Police Academy in early April.
On the other hand, based on his illicit background and willingness to make money, Riu-Siang Lin could have been a well-placed insider for Chinese intelligence in the Taiwanese embassy, and why not a first point of access in the Taiwanese MFA network for APT espionage operations. Even if one of his posts suggests an affinity with the current regime, HUMINT recruitment operations are only sometimes straightforward. “The bank enabled buyers and sellers to stay anonymous from each other,” federal officials said. Drug vendors on the darknet site paid a fee to register and a commission of 5% on every sale, revenue that prosecutors say funded Lin’s “employee” expenses and computer servers. In a November 2023 undercover operation, a federal agent purchased oxycodone through Incognito Market, but testing revealed the pills were fentanyl. The Justice Department established the FBI-led JCODE team to lead and coordinate government efforts to detect, disrupt, and dismantle major criminal enterprises reliant on the darknet for trafficking opioids and other illicit narcotics, along with identifying and dismantling their supply chains.
- Once users logged in using a unique username and password, they were able to search thousands of listings for illegal drugs like heroin, cocaine, LSD, MDMA, methamphetamines, oxycodone, ketamine and alprazolam.
- One of the key features that sets Incognito Market apart is that it uses Monero, a privacy-focused cryptocurrency, as its primary payment method.
- The final evidence that law enforcement found linking Lin to the administrator “Pharoah” of Incognito Market was a “simple” hand-drawn workflow diagram of a darknet marketplace that was mailed from Lin’s personal email address.
- “Operation RapTor shows that the dark web is not beyond the reach of law enforcement,” said Head of Europol’s European Cybercrime Centre, Edvardas Šileris.
McDonald recruited and hired accomplices to help package and ship the narcotics they sold on the darknet. McDonald purchased bulk quantities of fentanyl and cocaine and then directed others to complete hundreds of drug sales involving large quantities of both fentanyl and cocaine. Another prong of the investigation was old-fashioned OSINT (Open-Source Intelligence) and surveillance. His LinkedIn and social media posts – bragging about Chainalysis certifications and showing diagrams of darknet money flows – may not have been direct evidence of running Incognito, but they painted a picture of someone deeply involved in the subject matter. It likely raised eyebrows that a young diplomat was so invested in dark web analytics. Moreover, the Namecheap domain registrations under Lin’s name provided a concrete link between his real-life identity and the dark web (through that market-tracking site).
