Each high-profile bust – from Silk Road to AlphaBay to Incognito – serves as a learning experience for agencies. The takedown of Incognito Market in particular demonstrated that investigators have become adept at following the money in cryptocurrency and coordinating globally to apprehend suspects. We can expect more proactive targeting of darknet markets by multi-country coalitions (similar to how Europe’s Europol and the FBI have partnered in the past).
Tracing Cryptocurrency Transactions
According to court records and the TRM Labs investigation, the end of Incognito was foreshadowed by chaos. In early 2024, vendors began reporting issues with BTC withdrawals—an ominous sign of what would become a classic darknet “exit scam.” In March, a message appeared on Incognito threatening to leak vendor identities and private messages to law enforcement unless paid in cryptocurrency. Though the platform’s administrator later claimed the extortion threat was a “joke,” the damage had been done. In an extraordinary twist, Lin had previously worked for Taiwan’s Ministry of Foreign Affairs, where he trained law enforcement officials on the very blockchain analytics techniques used to take down platforms like his own.
Incognito Market Incognito Market Link Incognito Market Mirror Incognito Market Onion
HSI New York leads and directs all operational and administrative activities of the El Dorado Task Force (EDTF). The EDTF is the premier money laundering task force in the nation and is comprised of more than 200 law enforcement personnel representing approximately thirty-five (35) federal, state, and local law enforcement and regulatory agencies. The EDTF encompasses a standalone Cyber Division as part of an effort to stay abreast of emerging criminal threats and in keeping with current and future investigative priorities. The mission of the EDTF is to disrupt, dismantle, or render ineffective, organizations involved in the laundering of proceeds of narcotics trafficking and other financial crimes. Since its inception in 1992, the Task Force has been responsible for the seizure of approximately $600 million and more than 2100 arrests.
“Incognito Market” Founder Arrested At JFK Airport, Accused Of Selling $100 Million Of Illegal Drugs On The Dark Web
Incognito Market, once one of the most secure and reliable platforms on the dark web, was no more. Other darknet markets quickly took notice, with many administrators shutting down their operations in fear of being the next target. Users, too, began to migrate to smaller, more obscure markets, hoping to avoid the attention of law enforcement. Users began to panic, and many quickly tried to withdraw their funds from the market. But by then, it was too late—Lin had already drained the cryptocurrency wallets, leaving his users high and dry.
- Court documents show that on multiple occasions, Bitcoin from Incognito’s administrator wallet was sent to a swapping service.
- Drug vendors on the darknet site paid a fee to register and a commission of 5% on every sale, revenue that prosecutors say funded Lin’s “employee” expenses and computer servers.
- Users began to panic, and many quickly tried to withdraw their funds from the market.
- Prosecutors said Lin would face a minimum penalty of life in prison if convicted for engaging in a continuing criminal enterprise or narcotics conspiracy.
- That revenue, according to the indictment, funded Incognito Market’s operations, including paying “employee” salaries and for computer servers.
P2P Payment Service Zelle Sued For Enabling Payment Fraud Hell
- JCODE and Europol’s European Cybercrime Centre (EC3) continue to compile intelligence packages to identify entities of interest.
- Lin’s undoing came in May 2024, when he was arrested while transiting through New York’s JFK Airport.
- Lin managed to keep his darknet identity separate from his day job for years, even as he moved from Taiwan to the Caribbean for work.
- Lin was accused of being the principal operator of a Continuing Criminal Enterprise (CCE) – often referred to as the “kingpin” or “drug lord” statute – due to the large-scale, ongoing narcotics trafficking conspiracy he oversaw.
- Once users logged in, they could buy or sell illegal narcotics and misbranded prescription medication, the DOJ alleges.
- Undercover agents posed as both buyers and sellers, engaging in hundreds of transactions on the platform, gathering as much information as possible about the market’s operations.
He claims to be an employee of Taiwan’s Ministry of Foreign Affairs, working as a “diplomatic specialist” in the technical section of the Taiwanese embassy in St Lucia. Previous jobs include a three-year internship at Cathay Financial Holding as a “Backend and Blockchain R&D” since November 2019. The former Incognito Market administrator claims to have graduated from National Taiwan University in June 2023. On May 18, the latest post on LinkedIn was related to the celebration of obtaining the Chainalysis Reactor Certification (CRC). Later, on May 22, ‘MommaBear’ returned with another post, indicating that the restoration process was ongoing and that he had not abandoned the community.
Supply Chain Resilience And Physical Security: Lessons For 2025
The marketplace has been active since July 1, 2023, and has been among the top five infamous marketplaces providing shopping for illicit goods in the darkweb, offering more than 16 categories of narcotics and over 1000 products. Compared to other marketplaces, it offered innovative and a much more user-friendly interface. Among these features one could find Direct Pay, implying buyers could use their wallets instead of those provided by the marketplace. Operation RapTor involves law enforcement actions taken by JCODE member agencies, including the DEA, FBI, FDA OCI, HSI, IRS-CI, and USPIS.
Crypto Crime 2024 – 2025: Scale, Sophistication, And Violence
There’s also a legislative trend of sanctioning known darknet markets; for example, Hydra’s crypto wallets were sanctioned by the U.S. If Incognito had still been active, it might have faced similar sanctions designations to choke its financial lifelines. Lin managed to keep his darknet identity separate from his day job for years, even as he moved from Taiwan to the Caribbean for work. His colleagues and government employers presumably had no idea of his clandestine activities.
Its suppliers tend to be smaller and less reputable, but that doesn’t necessarily mean they’re inferior; just less experienced. As a new market, it has not yet established itself in the community, although it remains a reliable alternative when larger markets decline. One of the key features that sets Incognito Market apart is that it uses Monero, a privacy-focused cryptocurrency, as its primary payment method. Monero allows our Incognito customers to make purchases with complete anonymity, providing additional protection from external participants in the Incognito darknet link market. Accusations intensified after Incognito Market released an official statement on the site confirming earlier suspicions. The announcement stated that operators had collated incriminating information about vendor identities, purchase details and private messages.
It kept the financial information of vendors and buyers separate, making it more difficult for any one actor on the marketplace to learn any other actor’s true identity, a complaint filed against Lin said. One particularly revealing moment came in February 2024, when Incognito users reported that BTC withdrawals were disabled—likely part of a deliberate “exit scam.” Lin, or others acting on his behalf, threatened to leak vendor identities to law enforcement unless paid. That extortion threat, combined with increased tracing and investigative pressure, led many users to flee the platform, dramatically reducing deposits and facilitating law enforcement’s final takedown. Prosecutors said the online marketplace allowed users to anonymously buy and sell illegal drugs from anywhere on the globe with an internet connection and a Tor web browser, a tool that makes it difficult to track users. Users began reporting unexplained delays and failures in withdrawing funds, sparking fears that Incognito’s administrators were perpetrating an “exit scam” – a scenario where the operators disappear with all the money held in escrow.
Role Of “Pharaoh”: The Dual Life Of Rui-Siang Lin
It supports Bitcoin (BTC) and Monero (XMR) for transactions, highlighting its commitment to privacy and security, and adopts a direct payment method for each transaction, catering to users who prioritize privacy. “Crypto tracing leverages the power of immutable ledgers that’s innate to blockchain databases and combines it with traditional methods of following money through forensic accounting and pattern matching. “As alleged, Rui-Siang Lin’s brazen operation resulted in the illicit sale of over $100 million in narcotics, including those that were mislabeled and later found to include deadly fentanyl. The El Dorado Task Force’s Darkweb and Cryptocurrency Task Force leverages cutting-edge techniques to target even the Internet’s most savvy criminals,” HSI Special Agent Ivan J. Arvelo said. Incognito Market mimicked legitimate e-commerce platforms, complete with customer service, branding, and a vendor registration system. Vendors paid a 5% commission on their sales, generating revenue that supported the site’s operations and Lin’s profits.
The indictment alleges the illegal sale of more than $100 million in illicit narcotics and misbranded prescription drugs, including heroin, cocaine, LSD, MDMA, oxycodone, methamphetamines, ketamine, and alprazolam. In addition, in November 2023, an undercover law enforcement officer received several tablets purporting to be oxycodone purchased on the Incognito Market. Tests on these tablets revealed that they were not authentic oxycodone at all but were, in fact, fentanyl pills. One poignant trend is the increasing involvement of international law enforcement and harsher legal consequences, as evidenced by Incognito’s case.
One was used to host Incognito’s DDoS prevention system, one hosted the back-end marketplace data, including all completed narcotics transactions, while the third acted as the market’s bank and was used to process all cryptocurrency transactions. This illegal drug market was used to sell more than $100 million worth of narcotics, including over 1,000 kilograms (kgs) of illicit drugs, including 295 kgs of methamphetamines, 364 kgs of cocaine, 112 kgs of amphetamine, and 92 kgs of ecstasy (MDMA). Lin announced that Incognito Market would be shutting down, but not before attempting to extort the market’s users. He threatened to leak private messages, transaction details, and other sensitive information unless users paid a fee ranging from $100 to $20,000. This act of desperation was a clear indication that Lin’s time was running out, and it set off alarm bells within the darknet community. The FBI was able to identify several such errors during their investigation, which gave them critical insights into how the market operated and who was involved.
The FBI has been closing in on him for months, carefully unraveling the web of anonymity he meticulously crafted. They know this is their moment—the moment to bring down the kingpin of one of the dark web’s most notorious drug markets. HSI is a worldwide law enforcement leader in Darknet and other cyber-related criminal investigations. The DHS Cyber Crimes Center (C3) combats cybercrime, online child sexual exploitation, and criminal exploitation of the internet with state-of-the-art forensic technology.
