Operator of Incognito Market Sentenced to 30 Years for Global Darknet Drug Trafficking

Key takeaways:

• Rui-Siang Lin, who operated Incognito Market under the alias “Pharaoh,” was sentenced to 30 years in federal prison and ordered to forfeit more than USD 105 million for running a large-scale darknet narcotics marketplace.
• From 2020 to 2024, the Tor-based marketplace facilitated over USD 100 million in drug sales by connecting nearly 1,800 vendors with hundreds of thousands of buyers worldwide.
• Incognito Market relied exclusively on cryptocurrency and an internal escrow system, yet every transaction created an immutable on-chain record that became central to the investigation.
• Investigators followed funds through marketplace wallets, identified consolidation and laundering patterns, and linked on-chain activity to Lin’s real-world identity and control over the platform.
• Withdrawal failures and an attempted exit scam in early 2024 provided additional proof of Lin’s authority over marketplace operations and financial infrastructure.
• The investigation was conducted as an OCDETF operation involving FBI, HSI, DEA, FDA-OCI, and NYPD, and prosecuted by the U.S. Attorney’s Office for the Southern District of New York.
• The Incognito Market sentencing underscores that anonymizing networks and cryptocurrency do not shield large-scale criminal enterprises from sustained financial and investigative scrutiny.

‍

{{horizontal-line}}

‍

This week, the US Attorney’s Office for the Southern District of New York announced that Rui-Siang Lin was sentenced to 30 years in federal prison for operating Incognito Market, a large-scale darknet narcotics marketplace that processed more than USD 100 million in illicit drug sales using cryptocurrency. The sentence follows a multi-year investigation into the platform’s role in facilitating global drug trafficking through anonymizing technology and digital assets.

Lin, who operated under the online alias “Pharaoh,” exercised ultimate authority over Incognito Market from its launch in October 2020 until its dismantling in March 2024. The court ordered Lin to forfeit more than USD 105 million, representing proceeds generated through the marketplace’s operations.

Operation of Incognito Market

Incognito Market functioned as a full-service illicit e-commerce platform hosted on the Tor network. It was designed to resemble legitimate online marketplaces, complete with branded interfaces, search functionality, vendor profiles, and customer support mechanisms. After logging in with a username and password, users could browse thousands of listings for controlled substances, including cocaine, methamphetamines, heroin, MDMA, LSD, ketamine, alprazolam, and purported prescription opioids.

‍

According to court filings, nearly 1,800 vendors sold narcotics to hundreds of thousands of buyers worldwide. Vendors paid an admission fee and a five percent commission on each transaction, which funded platform operations, employee payments, and server infrastructure. Customers and vendors relied exclusively on cryptocurrency to transact, allowing Incognito Market to operate across jurisdictions without traditional financial intermediaries.

Use of cryptocurrency and internal payment infrastructure

At the core of Incognito Market’s operation was an internal payment system known as “Incognito Bank,” created and controlled by Lin. This system managed customer deposits, escrow services, vendor withdrawals, and commission collection. Funds flowed through marketplace-controlled wallets before being distributed to vendors or consolidated by administrators.

Although Incognito Market promoted anonymity and security, the use of cryptocurrency created an immutable financial record. Each transaction — deposits, escrow movements, withdrawals, and internal transfers — was permanently recorded on public blockchains. This financial footprint became central to the investigation.

Financial tracing and attribution

Investigators conducted undercover purchases on Incognito Market and traced the movement of government funds through the platform’s wallets. By analyzing transaction flows, investigators identified commingling patterns, laundering behaviors, and consolidation points linked to marketplace administration. These on-chain findings were correlated with off-chain infrastructure, operational timing, and communications tied to the “Pharaoh” persona.

‍

Financial analysis enabled investigators to connect Incognito Market’s cryptocurrency activity to Lin’s real-world identity and establish his control over the platform’s wallets and payment systems. This tracing supported not only narcotics trafficking charges but also money laundering and forfeiture theories that were critical to the prosecution.

Exit scam and marketplace collapse

In early 2024, Incognito Market began experiencing withdrawal failures, with vendors reporting that BTC deposits could not be withdrawn. Deposits declined sharply, though activity continued. In mid-March 2024, administrators announced an exit scam, threatening to release vendor identities and private communications to law enforcement unless additional payments were made.

Although Lin later claimed the announcement was a joke, vendors had already begun migrating to other platforms. These events provided further evidence of Lin’s authority over marketplace operations and supported the government’s case regarding intent, control, and criminal enterprise management.

Interagency investigation and prosecution

This case was pursued as an Organized Crime Drug Enforcement Task Forces (OCDETF) operation, reflecting extensive coordination across US law enforcement. The investigation involved the Federal Bureau of Investigation, Homeland Security Investigations, the Drug Enforcement Administration, the Food and Drug Administration Office of Criminal Investigations, and the New York City Police Department. The case was prosecuted by the U.S. Attorney’s Office for the Southern District of New York.

TRM Labs is proud to support law enforcement all over the world in their fight against cryptocurrency-based narcotics trafficking.

Implications for darknet market enforcement

The sentencing of the Incognito Market operator underscores a core reality of modern darknet investigations: anonymizing networks and cryptocurrency do not place criminal activity beyond the reach of law enforcement. As investigative techniques continue to evolve, financial analysis of blockchain activity has become a central pillar in identifying operators, disrupting infrastructure, and holding architects of large-scale online drug markets accountable.

This case demonstrates how sustained financial tracing, combined with traditional investigative methods and interagency collaboration, can dismantle complex crypto-enabled criminal enterprises operating at global scale.

‍

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What was Incognito Market?

Incognito Market was a major darknet marketplace operating on the Tor network that facilitated the sale of illicit drugs to buyers worldwide using cryptocurrency as its exclusive payment method.

2. Who operated Incognito Market?

The platform was operated by Rui-Siang Lin, who used the online alias “Pharaoh” and exercised ultimate authority over marketplace operations, finances, and infrastructure from 2020 until 2024.

3. How did law enforcement identify the operator despite anonymizing technology in the Incognito Market investigation?

Investigators traced cryptocurrency transactions through Incognito Market’s internal payment system, analyzed on-chain fund flows, and correlated them with off-chain activity, infrastructure, and operational behavior linked to Lin.

4. What role did cryptocurrency play in the Incognito Market investigation?

While cryptocurrency enabled cross-border transactions without traditional intermediaries, its transparent and immutable ledger allowed investigators to follow funds, identify consolidation points, and establish control over marketplace wallets.

5. What does the Incognito Market case mean for the future of darknet market enforcement?

The sentencing highlights that darknet markets are increasingly vulnerable to financial analysis. As blockchain intelligence and investigative techniques advance, operators face growing risk of identification, disruption, and long-term criminal liability.