Since that time, and through its closing in March, Incognito Market sold more than $100 million of narcotics — including hundreds of kilograms of cocaine and methamphetamines. From a legal perspective, Lin’s case may also influence how future investigations proceed. The success in tying cryptocurrency to a real identity reinforces law enforcement’s confidence in tackling crypto-enabled crimes. We may see even greater use of blockchain analytics warrants and collaboration with crypto exchanges.
Incognito Dark Web Drugs Market Boss Collared In New York
The court proceedings in Lin’s case showcase several legal implications for darknet market operators. Even though Lin was a foreign national operating a website on the Tor network, U.S. authorities claimed jurisdiction because the market sold drugs that ended up in the United States (and used infrastructure affecting the U.S.). This is a reminder that anyone facilitating drug trafficking that impacts the U.S. can become a target, regardless of where they sit physically. The use of extraterritorial law enforcement tactics (like grabbing Lin during a layover) further shows that being outside the U.S. is not a guaranteed shield, especially if one travels internationally.
- The marketplace has become popular due to its professional appearance and level of operation.
- To become an Incognito Market vendor, people were required to register with the site and pay an admission fee.
- To put Incognito’s trajectory in context, it helps to compare it with its predecessors and contemporaries, and to consider what its downfall implies for the future of illicit online markets.
- Surely the whitehat teams working to identify the physical locations of servers hosting “darknet” Tor websites do not want journalists poking around and encouraging whistleblowers.
Industry-Specific Cyber Threat Intelligence Powered By Agentic AI
“There’s a larger issue here about bad actors accessing blockchain analytics tools,” says Robinson. According to the FBI, the market took nearly a year to catch on, with virtually no sales during that time. But by late 2021, Incognito had started to attract users, and by the middle of 2022, the market had drawn enough vendors and sellers to generate more than $1.5 million a month in sales. On March 12, 2020, before Incognito Market launched, LIN emailed himself a rough diagram of a darknet marketplace.
In addition, all data is encrypted with PGP keys, ensuring that your data never leaves the Incognito darknet. DarkDotFail’s investigation exposes the extent of the threat, from accumulated private messages to transaction details and order information. The specter of law enforcement involvement only adds to the sense of dread, as the deadline for the release of sensitive data draws near. The threat of law enforcement involvement loomed large as Incognito’s administrators announced their plans to publish a dump of over 557k orders and 862k crypto transaction IDs by the end of May. Users of Incognito Market were able to search thousands of listings for illegal narcotics, including heroin, cocaine, LSD, MDMA, oxycodone, methamphetamines, ketamine, and alprazolam.

To become an Incognito Market vendor, people were required to register with the site and pay an admission fee. In exchange for listing and selling narcotics as a vendor on Incognito Market, each vendor paid 5% of the purchase price of every narcotic sold. That revenue funded Incognito Market’s operations, including paying “employee” salaries and for computer servers. To facilitate these financial transactions, Incognito Market had its own “bank,” which allowed its users to deposit cryptocurrency on the site into their own accounts. After a narcotics transaction was completed, cryptocurrency from the buyer’s account was transferred to the seller’s account, less the 5% fee that Incognito collected. A federal district court judge will determine any sentence after considering the U.S.
The information is for educational and research use with the focus on complying with the law. The designation of Incognito Market as a dark web identifies its sole operation through onion services. The Incognito dark web market requires technical tools and specialized knowledge for secure access.
Secret Service Dismantles Telecom Threat That Could Have Crippled UN General Assembly
Until that moment, Lin led a double life that astonished both law enforcement and the darknet community. By day, he worked as a diplomatic tech expert training police in cybercrime; by night, he was “Pharaoh,” the secretive mastermind of Incognito Market – one of the world’s largest dark web drug marketplaces. Incognito Market’s rise and dramatic collapse, along with Lin’s arrest, sent shockwaves through the darknet economy. This deep dive examines the marketplace’s history, technical underpinnings, the man behind the alias, and how investigators brought down a darknet kingpin. We also explore the legal fallout and what Incognito’s downfall signals for the future of online black markets.
Agentic AI–Driven Threat Intelligence Tailored For Every Function
Surely the whitehat teams working to identify the physical locations of servers hosting “darknet” Tor websites do not want journalists poking around and encouraging whistleblowers. The public is fed a narrative that Tor is dangerous, a technology for CSAM and terrorism. Many journalists are hesistant to even log in to see what really exists in darknet communities, there’s a perception of too much legal risk. On other platforms, such as OpenSea, Lin sells NFTs with basketball players, and his collections appear to be up to 37 NFTs.
FTC Files Complaint Against Sendit App, CEO Over Illegal Data Collection From Children

The 23-year-old Taiwanese administrator is charged with 4 counts, including engaging in a continuing criminal enterprise, narcotics conspiracy, money laundering, and conspiracy to distribute adulterated and misbranded drugs, which carry a minimum of 5 years and a maximum of 20 years in prison. Only earlier this week did it become clear exactly what Lin’s “professional background and qualifications in the field” allegedly entailed, seemingly unbeknownst to either his Taiwanese employers or his St. Lucian law enforcement trainees. For nearly four years, according to the US Justice Department, 23-year-old Lin ran a dark-web drug market called Incognito that authorities say enabled the sale of at least $100 million worth of narcotics, ranging from MDMA to heroin for cryptocurrencies including bitcoin and monero. That was before Lin’s alleged theft of his own users’ funds earlier this year and then his arrest last week by the FBI in New York’s JFK airport. Lin allegedly made millions from operating Incognito Market, which took a 5% cut of every sale. The darknet market had its own “bank,” prosecutors said, which gave users an additional layer of anonymity by allowing them to deposit cryptocurrency into their own accounts, which the site then automatically transferred from buyers to sellers, minus the fee.
Payment On Incognito Darknet

Antinalysis allowed anyone (for a fee) to input their cryptocurrency address and see how likely it was to be flagged as “dirty” or linked to illicit activity – effectively letting criminals check if their funds could be traced. Pharaoh openly advertised Antinalysis on Dread, framing it as a way to help darknet users and “those who needed complete privacy on the blockchain” evade law enforcement scrutiny. In a statement dripping with irony, he wrote that “Our goals do not lie in aiding the surveillance autocracy of state-sponsored agencies… This service is dedicated to individuals that have the need to possess complete privacy on the blockchain”.
Darknet Markets Explained
They understood that the administrators had already committed an exit scam, as they could not withdraw their money. On May 21, after online media wrote about Rui-Siang’s arrest and rumors spread throughout the darknet community, ‘MommaBear’, one of the administrators of the SuperMarket darknet marketplace, posted on Dread that the Cold Storage Escrow and Joint Pocket wallets had been emptied. A 2022 Twitter thread about Incognito posted by Eileen Ormsby, an author of several dark-web-focused books including The Darkest Web, shows how the market by that time had added features that may have helped it to catch the attention of security- and safety-conscious users.

How AI Transforms Criminals Into Data Hunters
Over the past two years, Incognito Onion has continued to evolve, adding new features and improving the user experience. Incognito also guarantees Incognito customers access to new products and the most in-demand products and services on the Dark Web by consolidating our products and offerings. Many vendors around the world partner with Incognito Darknet because the Incognito Darknet Store has some of the lowest fees on the market and a good reputation among vendors. Moreover, prior to revealing the scam, Incognito Market announced that it will support ETH and DAI and purchased the news site Darknetlive. Later on, the withdraws stopped working for BTC and other cryptocurrencies with staff members not logging into their accounts. Incognito Market included “many features of legitimate e-commerce sites such as branding, advertising, and customer service,” the Justice Department said.
It’s not clear whether Lin obtained his Chainalysis certification to bolster a new career training law enforcement in blockchain analysis or, if US prosecutors are to be believed, to advance his previous alleged career as a dark-web criminal. But it raises the troubling possibility that a former dark-web kingpin—one who was still extorting his own users—was perhaps playing both sides of the crypto tracing game, says Elliptic’s Tom Robinson. At the same time the FBI says Lin was laying the groundwork for this double-cross, he also appears to have briefly tried engineering an entirely different scheme. During those same busy years, Pharoah also launched a web service called Antinalysis, designed to defeat crypto money laundering countermeasures—only for Lin, who prosecutors say controlled that Pharoah persona, to later refashion himself as a crypto-focused law enforcement trainer. Finally, despite his supposed expertise in cryptocurrency tracing and digital privacy, it was Lin’s own relatively sloppy money trails that, the DOJ claims, helped the FBI to trace his real identity.
He also posted an analysis from Cloudflare showing that his DDoS solutions passed a stress test from China-based IPs. Later, on May 22, ‘MommaBear’ returned with another post, indicating that the restoration process was ongoing and that he had not abandoned the community. However, there’s no mention of how they’re going to get their money back from ‘FatherBear’. WIRED reached out to Chainalysis to ask about Lin’s Reactor certification and what sort of safeguards prevent criminals from using the company’s software, but the company declined to comment.