The FBI linked Lin to Incognito Market by tracing cryptocurrency transfers to a digital wallet. The cryptocurrency exchange hosting the wallet provided the FBI with Lin’s identity documents, email address, and phone number. Many vendors around the world partner with Incognito Darknet because the Incognito Darknet Store has some of the lowest fees on the market and a good reputation among vendors. Incognito Market is one of the first markets to put XMR to use on the scene, XMR is an encrypted crypto-currency with a private blockchain, it is not traceable and can be used by cyber criminals to hide their tracks. The arrest of the Incognito Market owner, Rui-Siang Lin serves as a reminder for everyone to access the web safely and responsibly.
Tag Archives: Incognito Market
This case, an Organized Crime Drug Enforcement Task Forces (OCDETF) operation, is a great example of full of US law enforcement cooperation and collaboration. The case is being investigated by FBI, Homeland Security Investigations, DEA, FDA, and the New York Police Department. The case is being prosecuted by the US Attorney’s Office for the Southern District of New York.
The market’s sophisticated security measures, coupled with its global reach, made it one of the most challenging targets they had ever faced. But the agents assigned to the case were determined, and they began to devise a plan to bring down the empire that Lin had built. In addition to switching to Monero, Incognito Market employed a decentralized internal banking system. When users deposited Bitcoin into the market, it was immediately converted into Monero, leveraging the privacy features of Monero to ensure that even if the initial Bitcoin transaction could be traced, the trail would go cold once the funds were inside the market’s banking system. At its core, Incognito was built on the Tor network, an anonymizing service that hides users’ identities by routing their internet traffic through a series of encrypted servers around the world. This made it extremely difficult for anyone to trace the origin of the traffic, providing a shield of anonymity for users of the market.
Operation RapTor: The Largest Darknet Takedown In History
No matter where criminals hide, we will find them, dismantle their operations, and bring them to justice. This operation was about protecting innocent people from predatory criminals who profit from violence, addiction, and fear. Our commitment is unwavering,” said Chief Postal Inspector Gary Barksdale, United States Postal Inspection Service. Vendors paid a non-refundable admission fee of $750 and a 5% commission on each sale to Incognito Market, according to the indictment. Incognito Market mimicked legitimate e-commerce sites with features like branding, advertising and customer service.
The marketplace was raking in millions of dollars in cryptocurrency, with Lin taking a 5% cut from every transaction. His technical expertise, combined with his shrewd business acumen, allowed him to build a fortune in the shadows of the dark web. But as Incognito’s user base expanded, so too did the scrutiny from law enforcement agencies around the world. To further enhance anonymity, Incognito Market operated a sophisticated system for managing transactions.
Eight Months After Hydra Shutdown, New Russian-language Darknet Markets Are Filling The Void
- Operation RapTor builds on the successes of prior years’ operations and takedowns of marketplaces, which resulted in the seizure of darknet infrastructure from Nemesis, Tor2Door, Bohemia, and Kingdom Markets, providing investigators across the world with investigative leads and evidence.
- This charge alone carries a mandatory minimum sentence of life in prison upon conviction.
- If convicted, Lin faces a mandatory minimum penalty of life in prison for engaging in a continuing criminal enterprise.
- Finally, despite his supposed expertise in cryptocurrency tracing and digital privacy, it was Lin’s own relatively sloppy money trails that, the DOJ claims, helped the FBI to trace his real identity.
- Upon visiting the site via the Tor browser, users were greeted by a graphic interface and prompted to log in with a unique username and password.
With Incognito’s fall, many users are migrating to alternative markets like Nemesis or MGM Grand Market. But the darknet’s revolving door of markets opening and exit scamming is sure to continue. Operation RapTOR includes law enforcement actions taken by JCODE member agencies, to include ICE HSI; the DEA; FBI; FDA-OCI; IRS-CI; and USPIS; in addition to foreign partners listed below. Credible reporting from the referenced agencies, in addition to contributions from ATF; Army CID; CBP; Department of Treasury’s FinCEN and Office of Foreign Assets Control; and NCIS enabled domestic law enforcement actions in support of Operation RapTOR. Local, state, and other federal agencies also contributed to investigations through task force participation and regional partnerships. Although Incognito Market did not sell narcotics directly, it provided a dark web platform connecting customers with vendors.
Crypto-currency Prices
Since its inception in October 2020 until its closure in March, Incognito Market sold vast quantities of illegal narcotics, including hundreds of kilograms of cocaine and methamphetamines, globally via the dark web site that could be reached through Tor web browser. Incognito strives to grow by introducing our company to our customers and using the Incognito marketplace as large format specialty stores for products and services to further deepen their familiarity with them. Incognito Link is committed to keeping our platform secure by using the latest security measures to protect the identity and information of Incognito users.
Latest High-Profile Arrests

He employed a combination of Virtual Private Networks (VPNs), end-to-end encryption, and advanced cryptographic protocols to secure every aspect of Incognito. This multi-layered approach made it nearly impossible for law enforcement to penetrate the market’s defenses. The darknet community was rocked recently by the sudden exit scam pulled by Incognito Market, one of the most popular trading platforms. Incognito’s admins made off with an estimated $10+ million in Bitcoin and Monero stolen from user accounts and escrow. While Lin is in custody, the case could take a number of twists and turns with Incognito vendors nervous about Lin’s possible cooperation with the government.
The Double Life Of Rui-Siang Lin
As Lin suddenly shuttered the Incognito Market in March 2024, he tried pulling an exit scam stealing the users’ funds stored in its escrow system and also tried to ransom the market’s drug vendors. Lin demanded ransom in the range of $100 to $2,000 from them in exchange of not turning their data over to the law enforcement. That revenue went to fund the site’s operations, including servers and what the DOJ described as “employee” salaries.
He had applied to work as part of the embassy’s technical corps in lieu of military service — mandatory for Taiwanese men — and had “behaved normally.”

Born in Taiwan, Lin was a bright student, excelling in computer science and cybersecurity. By the time he graduated from National Taiwan University in June 2023, he had already built a reputation as a blockchain enthusiast and a skilled developer. In perhaps the most extraordinary twist in the case, Lin, who is only 23 years-old, worked for the Taiwanese Ministry of Foreign Affairs.
How Incognito Market Maintained Anonymity
The 23-year-old darknet kingpin, popularly known as Pharoah or Faro, had long been on the FBI’s radar and eventually met his comeuppance at JFK airport. On the X platform, formerly known as Twitter, where he has been active since March 2022, most of Lin’s posts are about cryptocurrencies. He also posted about the training he did for the Saint Lucia Police, but this time, he covered his face with an emoji. In an interesting post, he appeared to be proud of the newly elected president in Taiwan, suggesting that he likes the current regime, which is opposing China’s pressure. He also posted an analysis from Cloudflare showing that his DDoS solutions passed a stress test from China-based IPs. Incognito Market says it plans to publish the entire dump of 557,000 orders and 862,000 cryptocurrency transaction IDs at the end of May.

Compared to other marketplaces, it offered innovative and a much more user-friendly interface. Among these features one could find Direct Pay, implying buyers could use their wallets instead of those provided by the marketplace. Operation RapTor involves law enforcement actions taken by JCODE member agencies, including the DEA, FBI, FDA OCI, HSI, IRS-CI, and USPIS. State, local, and other federal agencies also contributed to Operation RapTor investigations through task force participation and regional partnerships, as well as the multi-agency Special Operations Division. That exchange account, too, was registered in Lin’s real name, according to the DOJ. Once a transaction took place, funds were transferred from a buyer’s account into the seller’s, minus a 5 percent fee collected by Incognito Market.

However, Incognito’s case shows that even with Monero in the mix, operational security must be airtight – a single point of weakness (like Lin’s use of a BTC wallet for personal expenses) can compromise the entire scheme. We can expect future market operators to study Lin’s mistakes and double-down on using privacy coins, better tumbling/mixing services, and compartmentalizing their online identities to avoid leaving a link to the clear web. From a legal perspective, Lin’s case may also influence how future investigations proceed. The success in tying cryptocurrency to a real identity reinforces law enforcement’s confidence in tackling crypto-enabled crimes.