Moreover, the Namecheap domain registrations under Lin’s name provided a concrete link between his real-life identity and the dark web (through that market-tracking site). Investigators could use that to build probable cause that Lin and Pharaoh were one and the same. With mounting evidence, prosecutors in the Southern District of New York quietly filed charges and obtained an indictment against Lin under seal. “This arrest underscores the dedicated, ongoing efforts of law enforcement to identify and dismantle illicit drug networks operating from every shadowy recess of the marketplace,” NYPD Commissioner Edward A. Caban said in a statement. If found guilty, Lin could face a mandatory minimum sentence of life in prison for participating in a continuing criminal enterprise.
About Incognito Market – Incognito Darknet – Incognito Link
However, Incognito’s case shows that even with Monero in the mix, operational security must be airtight – a single point of weakness (like Lin’s use of a BTC wallet for personal expenses) can compromise the entire scheme. We can expect future market operators to study Lin’s mistakes and double-down on using privacy coins, better tumbling/mixing services, and compartmentalizing their online identities to avoid leaving a link to the clear web. From a legal perspective, Lin’s case may also influence how future investigations proceed.
P2P Payment Service Zelle Sued For Enabling Payment Fraud Hell

Lin knew that a single point of failure could bring down the entire operation, so he distributed the market’s servers across multiple countries, each with its own security protocols. This meant that even if one server was compromised, the rest of the network would remain intact, allowing the market to continue operating without interruption. Born in Taiwan, Lin was a bright student, excelling in computer science and cybersecurity. By the time he graduated from National Taiwan University in June 2023, he had already built a reputation as a blockchain enthusiast and a skilled developer. In perhaps the most extraordinary twist in the case, Lin, who is only 23 years-old, worked for the Taiwanese Ministry of Foreign Affairs. “The defendant’s greed and disregard for others was further demonstrated by his alleged extortion attempt during the platform’s final days,” lamented Ivan J Arvelo of Homeland Security Investigations (HSI) New York.

US Lawmakers Target ‘Adversarial AI’ In Bipartisan Push To Fortify Federal Systems

Regarding the announcement of the SuperMarket co-administrator in relation to the wallets emptied by the other administrator, this has happened in the past in other cases of the “domino effect” that occurs when law enforcement makes arrests in the underground community. There are more hypotheses to follow, but the most reasonable one is that there could be some relationship in terms of crypto accounts shared between ‘FatherBear’ and ‘Pharao’, which could lead to other traces. In this case, ‘FatherBear’ will keep a low profile for a while with all the money and then probably resurface with a different identity.
LinkedIn Respects Your Privacy
The statutory minimum and maximum sentences are prescribed by Congress and are provided here for informational purposes only, as any sentencing of the defendant will be determined by a judge. In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content.
Welcome To Incognito Market
The arrest of the Incognito Market owner, Rui-Siang Lin serves as a reminder for everyone to access the web safely and responsibly. In November 2023, the feds finally obtained a judicially authorized search warrant on Lin’s personal email account. The findings were incredibly eye-opening, including a hand-drawn illustration of the marketplace and its configurations. Court documents show that on multiple occasions, Bitcoin from Incognito’s administrator wallet was sent to a swapping service. Minutes later, roughly the same amount in Monero (XMR) was deposited in a crypto Exchange account registered to Rui-Siang Lin.
Transactions within the bank were encrypted and processed using a technique known as ‘CoinJoin,’ which mixes multiple transactions together, further obfuscating the source and destination of the funds. He employed a combination of Virtual Private Networks (VPNs), end-to-end encryption, and advanced cryptographic protocols to secure every aspect of Incognito. This multi-layered approach made it nearly impossible for law enforcement to penetrate the market’s defenses. The darknet community was rocked recently by the sudden exit scam pulled by Incognito Market, one of the most popular trading platforms.
Unraveling The Seedy Underbelly Of The Darknet Marketplaces

The dark web site was formed in October 2020 and ran until March of this year, serving as a forum to buy and sell commodities including heroin, cocaine, LSD, MDMA, oxycodone, methamphetamines, ketamine, and alprazolam. Lin seems like a knowledgeable person in the field of security and cryptocurrency, as per social media accounts listed in the complaint against him. Those wishing to trade on Incognito Markets can register by paying a vendor fee of €650 (payable in XMR). All vendor applications are manually reviewed and vendors are required to provide documentation of past history and/or product availability. Over the past two years, Incognito Onion has continued to evolve, adding new features and improving the user experience. Incognito also guarantees Incognito customers access to new products and the most in-demand products and services on the Dark Web by consolidating our products and offerings.
- Investigators said that prescription medication advertised as authentic very often was not.
- The Cyber Express is a handbook for all stakeholders of the internet that provides information security professionals with the latest news, updates and knowledge they need to combat cyber threats.
- Incognito charged vendors a 5% commission on every sale, a business model that generated millions of dollars in revenue for the platform.
- Most notably, there was a tool to mitigate DDoS attacks, software that allows online merchants to accept XMR for payment, and “Koa-typescript-framework” – a program used as a foundation for web applications.
Operation RapTOR includes law enforcement actions taken by JCODE member agencies, to include ICE HSI; the DEA; FBI; FDA-OCI; IRS-CI; and USPIS; in addition to foreign partners listed below. Credible reporting from the referenced agencies, in addition to contributions from ATF; Army CID; CBP; Department of Treasury’s FinCEN and Office of Foreign Assets Control; and NCIS enabled domestic law enforcement actions in support of Operation RapTOR. Local, state, and other federal agencies also contributed to investigations through task force participation and regional partnerships. Although Incognito Market did not sell narcotics directly, it provided a dark web platform connecting customers with vendors.
Traceable Transactions
- We can ensure that our market has carefully cared to every one of our users security needs.
- This model of combining drug enforcement agents, cybercrime experts, and even financial regulators is likely to be replicated for future darknet investigations.
- Later, on May 22, ‘MommaBear’ returned with another post, indicating that the restoration process was ongoing and that he had not abandoned the community.
- “As alleged, Rui-Siang Lin was the architect of Incognito, a $100 million dark web scheme to traffic deadly drugs to the United States and around the world,” Attorney General Merrick Garland said in a statement.
- Lin was accused of being the principal operator of a Continuing Criminal Enterprise (CCE) – often referred to as the “kingpin” or “drug lord” statute – due to the large-scale, ongoing narcotics trafficking conspiracy he oversaw.
The mass-extortion of Incognito Market users comes just days after a large number of users reported they were no longer able to withdraw funds from their buyer or seller accounts. The cryptocurrency-focused publication Cointelegraph.com reported Mar. 6 that Incognito was exit-scamming its users out of their bitcoins and Monero deposits. A 2022 Twitter thread about Incognito posted by Eileen Ormsby, an author of several dark-web-focused books including The Darkest Web, shows how the market by that time had added features that may have helped it to catch the attention of security- and safety-conscious users. Lin has been charged with not only narcotics conspiracy and money laundering but also running a “continuing criminal enterprise,” the so-called “kingpin statute” reserved for organized crime leaders who allegedly oversaw at least five employees.
The case is being investigated by FBI, Homeland Security Investigations, DEA, FDA, and the New York Police Department. The case is being prosecuted by the US Attorney’s Office for the Southern District of New York. Incognito Market was formed in October 2020, and has recently been the subject of more controversy than usual following claims that millions of dollars worth of cryptocurrency may have been stolen from its users and a bizarre attempt to extort users in the site’s dying days. However, in March 2024, customers reported being unable to withdraw Bitcoin and Monero, raising concerns about the possibility of an exit scam.
HSI is a worldwide law enforcement leader in Darknet and other cyber-related criminal investigations. The DHS Cyber Crimes Center (C3) combats cybercrime, online child sexual exploitation, and criminal exploitation of the internet with state-of-the-art forensic technology. The Center investigates large-scale cybercrime threats and provides expertise on cybercrime investigations to the field. It also uses global law enforcement networks, like Europol, to combat cybercrime threats. According to Krebs On Security, the administrators pulled off an “exit scam” that left users unable to withdraw millions of dollars from the platform. Rui-Siang Lin – who also went by the online pseudonym “Pharoah” or “faro” – is accused of having run the entire business.
TRM has identified structured withdrawals from the market to personal wallets and then to services with less stringent KYC. The announcement that data supposedly deleted through the years were about to be released to law enforcement agencies heightened the stakes. Despite revealing on April 1 that the entire fiasco was just one big April Fool’s joke, people were pissed at the marketplace — especially since a bunch of vendors had already paid up. Whether it was indeed a farce or a genuine fraudulent event, the damage was extensive.
Lin recognized this vulnerability and transitioned the market to Monero, a cryptocurrency designed specifically for privacy. In mid-March 2024, the Incognito administrator(s) announced an exit scam and threatened to release all of the vendor information and private messages between vendors and buyers to law enforcement. Pharaoh asked vendors for payment by April 1, 2024 in exchange for not releasing information to law enforcement. While on April 1, 2024, Pharoah announced that the extortion announcement had been a joke, vendors on the platform had already looked for other options. This banking service obscured the locations and identities of vendors and customers from each other and from law enforcement. It kept the financial information of vendors and buyers separate, making it more difficult for any one actor on the marketplace to learn any other actor’s true identity, a complaint filed against Lin said.
He has contributed 1,741 times on the platform, and his main projects are related to blockchains, cryptocurrency, and network security. On May 18, 2024, Homeland Security Investigations (HSI) New York, in coordination with law enforcement partners, arrested Rui-Siang Lin at John F. Kennedy International Airport in connection with his operation and ownership of Incognito Market. The arrest of Riu-Siang Lin, the former administrator of the closed Incognito marketplace, by the US authorities on 18th May is causing a domino effect in the underground illegal communities, leading to an alleged exit plan on the SuperMarket. On Dreads, the co-administrator of the Supermarket announced to the community on May 21, 2024, that the wallets had been emptied and that the only person who would have had access to them was “FatherBear”, the other administrator of the marketplace. McDonald recruited and hired accomplices to help package and ship the narcotics they sold on the darknet.