This week, the U.S. Department of Justice announced the results of Operation RapTor—an unprecedented international crackdown on darknet narcotics trafficking. Led by the Joint Criminal Opioid and Darknet Enforcement (JCODE) team and supported by global law enforcement partners, including Europol, across four continents, the operation resulted in the arrest of 270 individuals involved in darknet drug sales, the seizure of more than $200 million in cash and cryptocurrency, two metric tons of drugs, 144 kilograms of fentanyl, and over 180 firearms.
Described by Attorney General Pam Bondi as a historic blow to the digital drug trade, the operation targeted individuals in the United States, Austria, Brazil, France, Germany, the Netherlands, South Korea, Spain, Switzerland, and the United Kingdom. It marks the most significant JCODE operation to date, building on years of enforcement actions and marketplace takedowns, including Kingdom Market, Tor2Door, Bohemia, and Nemesis.
The Rise and Fall of Incognito Market
One of the most high-profile targets of Operation RapTor—the largest coordinated global crackdown on darknet drug trafficking to date—was Incognito Market, a dark web narcotics marketplace that operated with remarkable scale, anonymity, and apparent impunity. According to TRM Labs, Incognito launched in October 2020 and remained active until March 2024. In that time, it facilitated more than USD 100 million in drug sales, including hundreds of kilograms of cocaine and methamphetamine, alongside heroin, LSD, MDMA, oxycodone, ketamine, and misbranded prescription drugs.
Designed to resemble a legitimate e-commerce platform, Incognito offered a slick user experience with branding, advertising, and customer support. Upon visiting the site via the Tor browser, users were greeted by a graphic interface and prompted to log in with a unique username and password. Inside, buyers could browse thousands of drug listings, many accompanied by reviews and ratings. The platform also featured prescription drug listings falsely marketed as authentic, and some products were outright scams—counterfeit pills advertised as legitimate pharmaceuticals.
Vendors on Incognito paid a registration fee and a 5% commission on every sale. That revenue went to fund the site’s operations, including servers and what the DOJ described as “employee” salaries. All transactions were conducted in cryptocurrency—primarily Bitcoin and Monero—allowing customers and vendors to move funds without using traditional financial rails. Monero’s privacy features in particular obscured sender, receiver, and transaction amounts, posing challenges to investigators tracing flows.
At the center of this sprawling, crypto-powered operation was Rui-Siang Lin, a 23-year-old Taiwanese national who went by the pseudonym “Pharaoh.” According to both TRM Labs and DOJ records, Lin personally oversaw the marketplace’s operations—monitoring vendor activity, managing staff, handling disputes, and reaping the profits. In an extraordinary twist, Lin had previously worked for Taiwan’s Ministry of Foreign Affairs, where he trained law enforcement officials on the very blockchain analytics techniques used to take down platforms like his own.
Lin’s undoing came in May 2024, when he was arrested while transiting through New York’s JFK Airport. He later pleaded guilty to narcotics conspiracy, money laundering, and conspiracy to sell adulterated and misbranded medications in the Southern District of New York.
According to court records and the TRM Labs investigation, the end of Incognito was foreshadowed by chaos. In early 2024, vendors began reporting issues with BTC withdrawals—an ominous sign of what would become a classic darknet "exit scam." In March, a message appeared on Incognito threatening to leak vendor identities and private messages to law enforcement unless paid in cryptocurrency. Though the platform’s administrator later claimed the extortion threat was a “joke,” the damage had been done. Vendor activity dropped off, and law enforcement efforts intensified.
The downfall of Incognito—and its administrator’s ironic expertise in blockchain forensics—underscores the central tension of modern darknet enforcement: even as criminals lean into privacy coins and encrypted infrastructure, their operations inevitably leave a digital footprint. With the right partnerships, tools, and pressure at key chokepoints—such as when crypto is converted into fiat—law enforcement can still follow the money, identify key actors, and dismantle networks once thought untouchable. Incognito Market’s rise and fall is a case study in the evolving arms race between decentralized crime and global digital forensics.
Crypto’s Role and Law Enforcement’s Leverage
Incognito, like other modern darknet platforms, operated entirely on cryptocurrency—primarily Bitcoin and Monero. Buyers and sellers used wallets controlled either directly or through third-party mixers and exchanges. While Monero obscures transaction details, Bitcoin’s traceable blockchain provided law enforcement with critical leads, particularly at the point of off-ramp—when vendors converted crypto into fiat or moved assets through centralized exchanges.
As described by IRS Criminal Investigation Chief Guy Ficco, investigators “cracked the code of so-called ‘safe spaces’” by targeting these friction points.
One particularly revealing moment came in February 2024, when Incognito users reported that BTC withdrawals were disabled—likely part of a deliberate “exit scam.” Lin, or others acting on his behalf, threatened to leak vendor identities to law enforcement unless paid. That extortion threat, combined with increased tracing and investigative pressure, led many users to flee the platform, dramatically reducing deposits and facilitating law enforcement’s final takedown.
From Silk Road to RapTor: The Evolution of Darknet Markets
While this week’s takedown recalls the 2013 shutdown of Silk Road, the evolution of darknet commerce is stark. Silk Road popularized the use of Bitcoin, anonymizing technologies like Tor, and vendor reputation systems. But today’s markets are more fragmented, more resilient, and harder to track.
Vendors now favor Monero for its privacy features. They often sell across multiple markets or operate standalone storefronts via encrypted apps like Telegram and Signal. Operational security has increased, with mandatory PGP encryption, two-factor authentication, and more frequent use of VPNs and anonymization tools.
Perhaps most critically, today’s vendors divide responsibilities. In one example from the DOJ release, three individuals used monikers like “NuveoDelux” and “AllStateRx” to run a counterfeit Adderall ring. One handled pill pressing, another order logistics, and a third crypto wallets—indicating a more enterprise-like structure. Yet, their operations ultimately fell to the same vulnerability Silk Road faced: exposure during cash-out.
The Use of Blockchain Intelligence
Despite advanced obfuscation, blockchain intelligence remains a potent investigative tool. Law enforcement teams leveraged attribution, mixer analysis, and heuristic linking to associate vendor monikers with wallet activity. Once funds touched centralized exchanges—especially those with compliance programs—subpoenas or voluntary disclosures allowed agents to seize assets or identify account holders.
In the Incognito case, crypto flows revealed how vendors laundered earnings. As DOJ noted, the conspiracy involved laundering darknet proceeds through exchanges and peer-to-peer brokers. TRM has identified structured withdrawals from the market to personal wallets and then to services with less stringent KYC.
Looking Ahead
Operation RapTor’s scale reflects a new era of international coordination. U.S. agencies like the FBI, DEA, IRS-CI, and HSI worked alongside Europol, the U.K.’s NCA, and law enforcement from over a dozen countries. At the same time, financial enforcers like OFAC sanctioned individuals running darknet markets—including Iranian national Behrouz Parsarad of Nemesis—demonstrating how financial tools are being brought into alignment with traditional law enforcement.
Yet the digital nature of these crimes ensures new threats will emerge. Just as Incognito built on the playbook of its predecessors, future markets will learn from RapTor. But with blockchain intelligence advancing and global partnerships strengthening, law enforcement is better positioned than ever to detect, disrupt, and dismantle these operations.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
