The announcement stated that operators had collated incriminating information about vendor identities, purchase details and private messages. They threatened to leak the contents unless users paid a ransom commensurate with the volume of their transactions on the platform. In its heyday, the platform raked in millions of dollars per month and incorporated many features of legitimate e-commerce sites such as branding and customer service.
Initially, the market relied on Bitcoin, but as law enforcement agencies developed more advanced blockchain analysis tools, Bitcoin’s transparency became a liability. Lin recognized this vulnerability and transitioned the market to Monero, a cryptocurrency designed specifically for privacy. In mid-March 2024, the Incognito administrator(s) announced an exit scam and threatened to release all of the vendor information and private messages between vendors and buyers to law enforcement. Pharaoh asked vendors for payment by April 1, 2024 in exchange for not releasing information to law enforcement.
Salesforce CEO Marc Benioff Says His Company Has Cut 4,000 Customer Service Jobs As AI Steps In: ‘I Need Less Heads’
Testing on those tablets revealed that they were not authentic oxycodone at all and were, in fact, fentanyl pills,” the Justice Department said. Just as Incognito built on the playbook of its predecessors, future markets will learn from RapTor. But with blockchain intelligence advancing and global partnerships strengthening, law enforcement is better positioned than ever to detect, disrupt, and dismantle these operations. Designed to resemble a legitimate e-commerce platform, Incognito offered a slick user experience with branding, advertising, and customer support.
Market Links
In a fourth example, a San Fernando Valley man, Brian McDonald, 23, was sentenced to more than 20 years in federal prison in the Central District of California for using darknet marketplaces to sell hundreds of thousands of dollars’ worth of fentanyl-laced pills and cocaine to buyers nationwide. The rise and fall of Incognito Market is a chapter in the ongoing evolution of darknet marketplaces – a world that has proven remarkably adaptive in the face of law enforcement crackdowns. To put Incognito’s trajectory in context, it helps to compare it with its predecessors and contemporaries, and to consider what its downfall implies for the future of illicit online markets. But Lin’s arrest was more than just a victory for law enforcement—it was a turning point in the fight against cybercrime. The investigation had demonstrated that even the most sophisticated darknet operations could be infiltrated and dismantled, given enough time and resources. It also highlighted the growing importance of cryptocurrency forensics and blockchain analysis in combating cybercrime.
US Lawmakers Target ‘Adversarial AI’ In Bipartisan Push To Fortify Federal Systems
The takedown of Incognito Market in particular demonstrated that investigators have become adept at following the money in cryptocurrency and coordinating globally to apprehend suspects. We can expect more proactive targeting of darknet markets by multi-country coalitions (similar to how Europe’s Europol and the FBI have partnered in the past). There’s also a legislative trend of sanctioning known darknet markets; for example, Hydra’s crypto wallets were sanctioned by the U.S. If Incognito had still been active, it might have faced similar sanctions designations to choke its financial lifelines. Lin managed to keep his darknet identity separate from his day job for years, even as he moved from Taiwan to the Caribbean for work. His colleagues and government employers presumably had no idea of his clandestine activities.
This made it the perfect currency for darknet transactions, as it allowed users to send and receive funds without leaving a trace. Fascinated by the anonymity that cryptocurrencies like Bitcoin and Monero offered, Lin started experimenting with small-scale darknet markets. He learned how these markets operated, studying their vulnerabilities and thinking about how he could improve upon them. By the time he graduated, Lin had a plan—a plan to create the most secure and successful darknet market the world had ever seen. The final evidence that law enforcement found linking Lin to the administrator “Pharoah” of Incognito Market was a “simple” hand-drawn workflow diagram of a darknet marketplace that was mailed from Lin’s personal email address. “For example, in November 2023, an undercover law enforcement agent received several tablets that purported to be oxycodone, which were purchased on Incognito Market.
Markets: Incognito
The operator of Incognito revealed the scale of information at risk, including a comprehensive dump of 557,000 orders and 862,000 cryptocurrency transaction IDs. The extortion note implies that the users’ information included in this dump depends entirely on their actions. In addition to standard items like drugs and fraud-related materials, the market offers a wealth of unique and captivating products, all described in an engaging manner. It supports Bitcoin (BTC) and Monero (XMR) for transactions, highlighting its commitment to privacy and security, and adopts a direct payment method for each transaction, catering to users who prioritize privacy.
Thoughts On “Incognito Darknet Market Mass-Extorts Buyers, Sellers”
Attorney’s Office for the Southern District of New York of narcotics conspiracy, money laundering, and conspiracy to sell adulterated and misbranded medication for owning and operating Incognito Market, one of the largest narcotics marketplaces on the internet. Lin was arrested at John F. Kennedy Airport on May 18, and will be presented in Manhattan federal court before U.S. Lin allegedly made millions from operating Incognito Market, which took a 5% cut of every sale. The darknet market had its own “bank,” prosecutors said, which gave users an additional layer of anonymity by allowing them to deposit cryptocurrency into their own accounts, which the site then automatically transferred from buyers to sellers, minus the fee. The first charge – sometimes called the “kingpin statute” – carries a mandatory minimum sentence of life in prison. Ross Ulbricht, the creator and operator of the now-shuttered Silk Road darknet drug marketplace, was found guilty of the same crime and sentenced to life in prison.
“Incognito Market” Operator Arrested For Running $100M Narcotics Marketplace
This tactic – arresting a target during international transit – is often used when a suspect is based in a country with no easy extradition. Taiwan does not have a formal extradition treaty with the U.S., so luring or waiting for Lin to enter U.S. soil was the surest way to get custody of him. The arrest operation at the airport was coordinated and swift, giving Lin little time to react or attempt any digital sabotage (like wiping devices). It’s not clear whether Lin obtained his Chainalysis certification to bolster a new career training law enforcement in blockchain analysis or, if US prosecutors are to be believed, to advance his previous alleged career as a dark-web criminal. But it raises the troubling possibility that a former dark-web kingpin—one who was still extorting his own users—was perhaps playing both sides of the crypto tracing game, says Elliptic’s Tom Robinson. “Stay posted and fuck LE,” Pharoah wrote, using the abbreviation LE to mean “law enforcement.” Antinalysis eventually returned, however, and pivoted last year to acting instead as a service for swapping bitcoin for monero and vice versa.
Disguised Gunman Who Killed Lawmaker Is Linked To Russia, Ukraine Says
The market’s user-friendly interface, combined with its robust security features, attracted a diverse range of users, from small-time buyers looking for recreational drugs to large-scale vendors dealing in high volumes of illicit goods. The market’s reputation for reliability and security quickly spread, and soon, Incognito was competing with—and in many cases, surpassing—It appears the response got cut off midway. By 2023, it had become one of the most popular darknet marketplaces, attracting thousands of users from around the world. The platform offered everything from narcotics and counterfeit currency to hacking tools and illegal firearms. The variety of goods available on Incognito was staggering, but it was the market’s reputation for security and reliability that kept users coming back.
- However, in March 2024, customers reported being unable to withdraw Bitcoin and Monero, raising concerns about the possibility of an exit scam.
- The cryptocurrency-focused publication Cointelegraph.com reported Mar. 6 that Incognito was exit-scamming its users out of their bitcoins and Monero deposits.
- In furtherance of Operation RapTOR and in their first action as a JCODE member agency, the Office of Foreign Assets Control (OFAC) additionally sanctioned Behrouz Parsarad, an Iranian national, for his role as the founder and operator of Nemesis Market following seizure of the market.
- Details of the bust were announced in a DOJ press release published on May 20, 2024, which revealed that Lin was apprehended on May 18 at John F. Kennedy Airport.
- Court documents show that on multiple occasions, Bitcoin from Incognito’s administrator wallet was sent to a swapping service.
- The darknet community was rocked recently by the sudden exit scam pulled by Incognito Market, one of the most popular trading platforms.
Lin’s Early Life And Education
That diagram, which is pictured below, contains features consistent with the operation of Incognito Market. While analyzing the marketplace transaction data, they were also able to chart how the marketplace’s sales volume increased over time, as shown in the image below. To further complicate matters, reports suggest that a whitelist portal will be established, allowing purchasers to potentially erase their records. Ironically, amidst these threats, the administrator expresses “gratitude” towards customers and vendors for their involvement with Incognito Market, a sentiment that clashes starkly with their current extortion tactics. Incognito expands its product offerings beyond conventional boundaries, encompassing categories like drugs, fraud, hacking, counterfeits, and even defense/intelligence, each with in-depth subcategories.
In the case of SuperMarket, users will likely migrate to other illegal communities due to a lack of trust in the platform. At that time, the project administration threatened to publish a complete dump of 557,000 orders and 862,000 hashes of cryptocurrency transactions by the end of May. They understood that the administrators had already committed an exit scam, as they could not withdraw their money. To facilitate the millions of dollars in transactions, Incognito Market had its own “bank,” allowing users to deposit cryptocurrency into “bank accounts” that would transfer the agreed-upon amount to a seller’s “bank account” minus Lin’s 5% fee. According to court documents and statements made in court, Srinivasan and Ta used the “redlightlabs” darknet account to advertise and sell counterfeit M30 oxycodone pills containing fentanyl and other illicit drugs. Srinivasan also used the encrypted messaging application Wickr to communicate with and sell drugs to customers.
The DDOS has been heavily effective due to Pharoah prioritizing low-end specifications rather than 1 massive server per mirror, or high end bandwidth with internal port speed. The story of Rui-Siang Lin and Incognito Market is a cautionary tale for both cybercriminals and cybersecurity professionals. Lin believed that his technical skills and sophisticated encryption would make him untouchable, but in the end, it was his own greed and human error that led to his downfall. Monero’s privacy features, such as ring signatures, stealth addresses, and Ring Confidential Transactions (RingCT), made it exceedingly difficult for anyone to trace the flow of funds. In essence, Monero obscured who was sending and receiving money and how much was being transferred. Its front page promised visitors that “Incognito Market is a market with a focus on both ease of use and security. With a small, dedicated staff team and nothing useless or bloated to slow you down. Be a part of something bigger and enjoy the nice UI/UX.”
At the same time the FBI says Lin was laying the groundwork for this double-cross, he also appears to have briefly tried engineering an entirely different scheme. In the summer of 2021, during Incognito Market’s relatively quiet first year, Lin’s alleged alter ego, Pharoah, launched a service called Antinalysis, a website designed to analyze blockchains and let users check—for a fee—whether their cryptocurrency could be connected to criminal transactions. Incognito Market was designed to foster seamless narcotics transactions across the internet and across the world and incorporated many features of legitimate e-commerce sites, such as branding, advertising and customer service. Upon visiting the site, users were met by a splash page and graphic interface, which is pictured below. In March, Incognito Market shut down after reportedly pulling an exit scam that left users unable to withdraw their funds.
