This might drive some buyers back to street dealing or to smaller local rings to obtain drugs, at least temporarily. The prospect is concerning for law enforcement, as it means criminals might be gaining insider knowledge on investigative techniques. After Incognito’s collapse in March 2024, users reportedly migrated to alternative marketplaces, and there was chatter in forums about which market would “inherit” Incognito’s user base. We can expect future market operators to study Lin’s mistakes and double-down on using privacy coins, better tumbling/mixing services, and compartmentalizing their online identities to avoid leaving a link to the clear web. In the ensuing years, Incognito became one of the top multi-drug marketplaces on the Tor network.
Durham Police Identify Man Shot And Killed Inside Grab And Go Market On Morehead Drive
Surpassing other major darknet markets like Empire, White House, and Cannazon. But as Incognito’s user base expanded, so too did the scrutiny from law enforcement agencies around the world. The variety of goods available on Incognito was staggering, but it was the market’s reputation for security and reliability that kept users coming back. The platform offered everything from narcotics and counterfeit currency to hacking tools and illegal firearms. The market also used multiple wallets to manage its funds—hot wallets for active transactions and cold storage for the bulk of its assets. Lin recognized this vulnerability and transitioned the market to Monero, a cryptocurrency designed specifically for privacy.
Tag Archives: Incognito Market
But by then, it was too late—Lin had already drained the cryptocurrency wallets, leaving his users high and dry. Lin announced that Incognito Market would be shutting down, but not before attempting to extort the market’s users. In March 2024, Lin decided to initiate what is known as an 'exit scam,' a common tactic used by darknet administrators to steal funds from their users before disappearing. Many darknet users, particularly those who are less technically proficient, fail to follow proper encryption protocols. Another significant obstacle for law enforcement was Incognito’s use of PGP encryption for all communications. Law enforcement agencies collaborated with blockchain forensics firms like Chainalysis, which specialize in tracking and analyzing cryptocurrency transactions.
Alleged $100M Dark-web Drug Kingpin, 23, Arrested
The bold mass extortion attempt comes just days after Incognito Market administrators reportedly pulled an “exit scam” that left users unable to withdraw millions of dollars worth of funds from the platform. Just as Incognito built on the playbook of its predecessors, future markets will learn from RapTor. TRM has identified structured withdrawals from the market to personal wallets and then to services with less stringent KYC. As DOJ noted, the conspiracy involved laundering darknet proceeds through exchanges and peer-to-peer brokers. They often sell across multiple markets or operate standalone storefronts via encrypted apps like Telegram and Signal.
Lin allegedly used those funds to pay employees and for computer servers – as well as collecting millions of dollars in profit. Its front page promised visitors that "Incognito Market is a market with a focus on both ease of use and security. With a small, dedicated staff team and nothing useless or bloated to slow you down. Be a part of something bigger and enjoy the nice UI/UX." The dark web site was formed in October 2020 and ran until March of this year, serving as a forum to buy and sell commodities including heroin, cocaine, LSD, MDMA, oxycodone, methamphetamines, ketamine, and alprazolam. The story of Rui-Siang Lin and Incognito Market is a cautionary tale for both cybercriminals and cybersecurity professionals.
- He now faces multiple charges, including engaging in a criminal enterprise and conspiracy to sell adulterated medication, with potential penalties ranging from 10 years to a lifetime in prison.
- During this time, Lin gathered millions of dollars in personal profit, and Incognito Market grew to become one of the biggest online narcotics sales platforms.
- According to a cryptocurrency-focused publication CoinTelegraph, on March 6th, Incognito was accused of exit-scamming users out of their Bitcoin and Monero deposits.
- According to the indictment, between 2022 and 2023, law enforcement agents executed search warrants to gain access to three servers used to operate the marketplace and containing marketplace data.
- “Working through the JCODE initiative, IRS Criminal Investigation and our international partners led the largest and most impactful takedown to date—seizing over $200 million in assets, removing deadly drugs and weapons from circulation, and holding more than 270 individuals accountable.
- Incognito Market’s online storefront showcased illegal drugs like heroin, cocaine, and other narcotics, complete with product listings, prices, and vendor ratings.
The Cryptocurrency ‘Bank’ System
It’s not publicly known if Lin is cooperating (providing information on other criminals) as part of his plea, but the darknet vendor community is certainly anxious. Throughout the investigation, law enforcement also leveraged the darknet community’s own reactions to Incognito’s collapse. There were also unconfirmed rumors in the cybercrime community that Incognito’s sudden troubles (the withdrawal freezes) could have been linked to law enforcement pressure – though the evidence suggests it was Pharaoh’s own exit scam scheme. Antinalysis allowed anyone (for a fee) to input their cryptocurrency address and see how likely it was to be flagged as “dirty” or linked to illicit activity – effectively letting criminals check if their funds could be traced.
Vinomofo Failed To Protect Customer Data, Australian Privacy Commissioner Rules
If convicted, Lin faces a mandatory minimum penalty of life in prison for engaging in a continuing criminal enterprise. In the 41 months that Incognito Market was open, it facilitated the sale of more than $100 million of narcotics. The site allowed buyers to search through thousands of listings for narcotics of their choice. The dark web’s Incognito Market allowed people to buy and sell narcotics worldwide. Mr. Lin’s alleged actions of putting profits before public health were not only reckless and dangerous, but unconscionable.
By DarkNet
Further, in an attempt to extort the members, the admin threatened to leak private messages, transaction information, and order details of vendors and buyers unless they paid a fee ranging from 100 to 20 thousand dollars. One of the servers searched by the agents was the so-called “bank”, a database containing all cryptocurrency transactions. In addition, in November 2023, an undercover law enforcement officer received several tablets purporting to be oxycodone purchased on the Incognito Market. On Dreads, the co-administrator of the Supermarket announced to the community on May 21, 2024, that the wallets had been emptied and that the only person who would have had access to them was “FatherBear”, the other administrator of the marketplace. As we move forward, the lessons from this case will inform both the defenders of the law and the next generation of cybercriminals. There’s also a legislative trend of sanctioning known darknet markets; for example, Hydra’s crypto wallets were sanctioned by the U.S.
How The November 2025 Bitcoin Crash Fractured The Cybercriminal Economy
Instead, he warned users that he had records of over 500,000 orders and more than 860,000 cryptocurrency transaction IDs. The message included a list of the "top" vendors who had paid the ransom to protect their customers and themselves. They warned that this would cause law enforcement to get involved. On 28th February, a few Incognito Market vendors reported missing withdraws.
Germany's Federal Criminal Police Office Takes Down Hydra Darknet Marketplace
“These predators who peddled poison on the dark web might have thought they are untouchable — hiding behind screens, pushing fentanyl, fueling overdoses, and cashing in on misery. In furtherance of Operation RapTor and in its first action as a JCODE member agency, the Office of Foreign Assets Control (OFAC) additionally sanctioned Iranian national Behrouz Parsarad for his role as the founder and operator of Nemesis Market following seizure of the market. Even if one of his posts suggests an affinity with the current regime, HUMINT recruitment operations are only sometimes straightforward. He has contributed 1,741 times on the platform, and his main projects are related to blockchains, cryptocurrency, and network security. In a LinkedIn post in April 2024, Lin shared some pictures from a “cybercrime and cryptocurrency training” at the Saint Lucia Police Academy. The administrator has promised to keep users updated as more information becomes available and efforts continue to recover the lost funds.
Legacy Tech Blunts UK Top Cops' Fight Against Serious Crime, Inspectors Find
Drug vendors on the darknet site paid a fee to register and a commission of 5% on every sale, revenue that prosecutors say funded Lin’s “employee” expenses and computer servers. Operation RapTor involves law enforcement actions taken by JCODE member agencies, including the DEA, FBI, FDA OCI, HSI, IRS-CI, and USPIS. From at least April 2021 until May 2023, McDonald and others conspired to sell fentanyl and cocaine via multiple darknet marketplaces. In a fourth example, a San Fernando Valley man, Brian McDonald, 23, was sentenced to more than 20 years in federal prison in the Central District of California for using darknet marketplaces to sell hundreds of thousands of dollars’ worth of fentanyl-laced pills and cocaine to buyers nationwide. Srinivasan received virtual currency as payment for the drugs and then routed that virtual currency through cryptocurrency exchanges.
Lin’s “strategy” as a marketplace operator combined technical savvy with an eye for community dynamics. Under his leadership, Incognito attained a level of trust (until the end) that attracted high-volume vendors. He vetted and approved vendor applications, decided on commission rates and promotional events, and oversaw the enforcement of the market’s rules. At the exchange, Lin had again used his real identity to register the account, so when law enforcement subpoenaed the exchange, they obtained his passport and personal details, email, and phone number on file.
