His LinkedIn and social media posts – bragging about Chainalysis certifications and showing diagrams of darknet money flows – may not have been direct evidence of running Incognito, but they painted a picture of someone deeply involved in the subject matter. It likely raised eyebrows that a young diplomat was so invested in dark web analytics. Moreover, the Namecheap domain registrations under Lin’s name provided a concrete link between his real-life identity and the dark web (through that market-tracking site). Investigators could use that to build probable cause that Lin and Pharaoh were one and the same. With mounting evidence, prosecutors in the Southern District of New York quietly filed charges and obtained an indictment against Lin under seal. Once a transaction took place, funds were transferred from a buyer’s account into the seller’s, minus a 5 percent fee collected by Incognito Market.
Crypto’s Role And Law Enforcement’s Leverage
The threat actor’s post revealed the extent of their control, boasting of accumulated private messages, transaction info, and order details over the years. The announcement that data supposedly deleted remained intact heightened the stakes. Vendors paid five percent of the purchase price of every sale to “Incognito Market,” providing Lin with millions of dollars of profits, the Justice Department said. Hundreds of pounds of cocaine, methamphetamines and other drugs were sold on Incognito Market since its launch in October 2020, it said.
The adulterated drugs conspiracy, which is a more unusual charge in this context, relates to the sale of fake pharmaceutical pills (like the fentanyl passed off as oxycodone) and carries up to 5 years in prison. This last charge invokes statutes under the Food, Drug, and Cosmetic Act, illustrating prosecutors’ creativity in addressing the harm caused by the marketplace (essentially treating Lin not just as a drug trafficker, but as someone endangering public health by distributing mislabeled medicine). To become an Incognito Market vendor, people were required to register with the site and pay an admission fee. In exchange for listing and selling narcotics as a vendor on Incognito Market, each vendor paid 5% of the purchase price of every narcotic sold.
Throughout the investigation, law enforcement also leveraged the darknet community’s own reactions to Incognito’s collapse. When Pharaoh attempted to extort his users, many panicked vendors likely reached out to trusted contacts or even law enforcement for help. The public warnings from the Dread forum admin (Hugbunter) about Incognito’s exit scam not only alerted users, but also would have confirmed to investigators that the site’s operator was in a desperate endgame. Every move Lin made in those final weeks – freezing withdrawals, bribing forum mods, threatening exposure – further implicated him and provided investigators with evidence of consciousness of guilt. It’s conceivable that undercover agents or cooperating informants were among those communications, gathering intel on Pharaoh’s state of mind and next steps. LIN was arrested at John F. Kennedy Airport on May 18, 2024, and will be presented in Manhattan federal court before U.S.
Security Incognito Marketplace
There is a dark history of scammers, and even of government agents, making false and misleading public statements to people who browse Tor hidden services. On the other hand, based on his illicit background and willingness to make money, Riu-Siang Lin could have been a well-placed insider for Chinese intelligence in the Taiwanese embassy, and why not a first point of access in the Taiwanese MFA network for APT espionage operations. Even if one of his posts suggests an affinity with the current regime, HUMINT recruitment operations are only sometimes straightforward. The marketplace has been active since July 1, 2023, and has been among the top five infamous marketplaces providing shopping for illicit goods in the darkweb, offering more than 16 categories of narcotics and over 1000 products. Compared to other marketplaces, it offered innovative and a much more user-friendly interface.
Role Of “Pharaoh”: The Dual Life Of Rui-Siang Lin
The rise and fall of Incognito Market is a chapter in the ongoing evolution of darknet marketplaces – a world that has proven remarkably adaptive in the face of law enforcement crackdowns. To put Incognito’s trajectory in context, it helps to compare it with its predecessors and contemporaries, and to consider what its downfall implies for the future of illicit online markets. However, depending on how much Riu-Sian Lin knows about other accounts that could expose the criminal’s identity, we will see in the next period of time in the other law enforcement takedown and arrest operations. In the case of SuperMarket, users will likely migrate to other illegal communities due to a lack of trust in the platform. “Stay posted and fuck LE,” Pharoah wrote, using the abbreviation LE to mean “law enforcement.” Antinalysis eventually returned, however, and pivoted last year to acting instead as a service for swapping bitcoin for monero and vice versa. Lin was arrested at John F. Kennedy Airport on May 18, and will be presented in Manhattan federal court before U.S.
Most Popular Sites On The Darknet
The use of extraterritorial law enforcement tactics (like grabbing Lin during a layover) further shows that being outside the U.S. is not a guaranteed shield, especially if one travels internationally. Knowing that Lin resided overseas (Taiwan, and possibly on assignment in St. Lucia), law enforcement had to be strategic about how to apprehend him. It appears agents were monitoring his movements (possibly through alerts on his passport or flight bookings). As soon as Lin transited through a U.S. jurisdiction (JFK Airport in New York), authorities pounced. On May 18, 2024, Rui-Siang Lin was arrested by FBI and HSI agents at JFK, effectively ambushing him during a layover before he could continue elsewhere. This tactic – arresting a target during international transit – is often used when a suspect is based in a country with no easy extradition.
Any Intent To Pay A Ransom? UK Government Wants To Know
He also posted about the training he did for the Saint Lucia Police, but this time, he covered his face with an emoji. In an interesting post, he appeared to be proud of the newly elected president in Taiwan, suggesting that he likes the current regime, which is opposing China’s pressure. He also posted an analysis from Cloudflare showing that his DDoS solutions passed a stress test from China-based IPs.
- U.S. agencies like the FBI, DEA, IRS-CI, and HSI worked alongside Europol, the U.K.’s NCA, and law enforcement from over a dozen countries.
- The website operates exclusively using the Tor network infrastructure, which requires specific browsers to access.
- He claims to be an employee of Taiwan’s Ministry of Foreign Affairs, working as a “diplomatic specialist” in the technical section of the Taiwanese embassy in St Lucia.
- In exchange for listing and selling narcotics as a vendor on Incognito Market, each vendor paid 5% of the purchase price of every narcotic sold.
At the same time, financial enforcers like OFAC sanctioned individuals running darknet markets—including Iranian national Behrouz Parsarad of Nemesis—demonstrating how financial tools are being brought into alignment with traditional law enforcement. The court proceedings in Lin’s case showcase several legal implications for darknet market operators. Even though Lin was a foreign national operating a website on the Tor network, U.S. authorities claimed jurisdiction because the market sold drugs that ended up in the United States (and used infrastructure affecting the U.S.). This is a reminder that anyone facilitating drug trafficking that impacts the U.S. can become a target, regardless of where they sit physically.
Lin has been charged with not only narcotics conspiracy and money laundering but also running a “continuing criminal enterprise,” the so-called “kingpin statute” reserved for organized crime leaders who allegedly oversaw at least five employees. Lin was arrested at New York’s John F. Kennedy Airport on Saturday and will be presented in front of a Southern District of New York (SDNY) magistrate judge today. He faces one count of engaging in a continuing criminal enterprise, one count of narcotics conspiracy, one count of money laundering, and one count of conspiracy to sell adulterated and misbranded medication. Two new dark web services are marketing to cybercriminals who are curious to see how their various cryptocurrency holdings and transactions may be linked to known criminal activity. Dubbed “Antinalysis” and “AMLBot,” the services purport to offer a glimpse into how one’s payment activity might be flagged by law enforcement agencies and private companies that try to link suspicious cryptocurrency transactions to real people. U.S. agencies like the FBI, DEA, IRS-CI, and HSI worked alongside Europol, the U.K.’s NCA, and law enforcement from over a dozen countries.
Charges, Court Proceedings, And Ripple Effects
Individuals across the world can report suspicious criminal activity to the ICE Tip Line 24 hours a day, seven days a week at 866-DHS-2-ICE. Highly trained specialists take reports from both the public and law enforcement agencies on more than 400 laws enforced by ICE. No matter where criminals hide, we will find them, dismantle their operations, and bring them to justice. This operation was about protecting innocent people from predatory criminals who profit from violence, addiction, and fear. Our commitment is unwavering,” said Chief Postal Inspector Gary Barksdale, United States Postal Inspection Service. They often sell across multiple markets or operate standalone storefronts via encrypted apps like Telegram and Signal.
Silk Road popularized the use of Bitcoin, anonymizing technologies like Tor, and vendor reputation systems. Pharoah is centralizing the darknet to a scale that previous darknet market admins have only dreamed of. CoinTelegraph notes that Incognito Market administrators initially lied about the situation, and blamed users’ difficulties in withdrawing funds on recent changes to Incognito’s withdrawal systems. Lin, a self-described crypto developer and fan of privacy coin Monero, said on X that he facilitated a four-day workshop on cyber crime and cryptocurrency for 30 police officers at the Saint Lucia Police Academy in early April. This effort is part of an Organized Crime Drug Enforcement Task Forces (OCDETF) operation.
Incognito Market Vendors
During those same busy years, Pharoah also launched a web service called Antinalysis, designed to defeat crypto money laundering countermeasures—only for Lin, who prosecutors say controlled that Pharoah persona, to later refashion himself as a crypto-focused law enforcement trainer. Finally, despite his supposed expertise in cryptocurrency tracing and digital privacy, it was Lin’s own relatively sloppy money trails that, the DOJ claims, helped the FBI to trace his real identity. Listings included offerings of prescription medication that was advertised as being authentic but was not. For example, in November 2023, an undercover law enforcement agent received several tablets that purported to be oxycodone, which were purchased on Incognito Market.
The arrest of Riu-Siang Lin, the former administrator of the closed Incognito marketplace, by the US authorities on 18th May is causing a domino effect in the underground illegal communities, leading to an alleged exit plan on the SuperMarket. On Dreads, the co-administrator of the Supermarket announced to the community on May 21, 2024, that the wallets had been emptied and that the only person who would have had access to them was “FatherBear”, the other administrator of the marketplace. That exchange account, too, was registered in Lin’s real name, according to the DOJ. Law enforcement agencies and cybersecurity experts continually adapt their strategies to monitor and regulate the darknet. In this cat-and-mouse game, the marketplace evolves to maintain its promise of anonymity while remaining resilient against potential threats.
This historic takedown, led by Europol, resulted in the highest number of seizures in JCODE’s history. He “was scheduled to go to Singapore via New York when he was arrested by the police in New York,” he said, adding that Taiwan was closely monitoring the case. He had applied to work as part of the embassy’s technical corps in lieu of military service — mandatory for Taiwanese men — and had “behaved normally.”
The operational security mistakes the FBI describes suggest that, regardless of which side of the cryptocurrency cat-and-mouse game Lin intended to end up on, he was far from a criminal mastermind. His brief, strange journey from alleged kingpin to crypto crime expert ultimately provides plenty of lessons to criminals and law enforcement alike—though probably not the ones he intended. It’s not clear whether Lin obtained his Chainalysis certification to bolster a new career training law enforcement in blockchain analysis or, if US prosecutors are to be believed, to advance his previous alleged career as a dark-web criminal. But it raises the troubling possibility that a former dark-web kingpin—one who was still extorting his own users—was perhaps playing both sides of the crypto tracing game, says Elliptic’s Tom Robinson. At the same time the FBI says Lin was laying the groundwork for this double-cross, he also appears to have briefly tried engineering an entirely different scheme.
We do not affiliate with darknet markets; our purpose is solely to provide information for research purposes. Original marketplace URLs get regularly updated for security reasons, hence the reason for verification. The Incognito Market URL verification involves cross-referencing using several independent trusted sources.
