The marketplace was closed in March 2024 when Rui-Siang Lin, under his online pseudonym “Pharoah” or “Faro,” allegedly committed an exit scam. This allowed US law enforcement to trace cryptocurrency transfers to a digital wallet linked to Lin, leading to his identification and arrest. According to the indictment, between 2022 and 2023, law enforcement agents executed search warrants to gain access to three servers used to operate the marketplace and containing marketplace data. The indictment alleges the illegal sale of more than $100 million in illicit narcotics and misbranded prescription drugs, including heroin, cocaine, LSD, MDMA, oxycodone, methamphetamines, ketamine, and alprazolam.
Fentanyl Sales In Darknet Markets
The discontinued Helix Bitcoin tumbler offered direct anonymized marketplace payment integrations. Many sites use Bitcoin multisig transactions to improve security and reduce dependency on the site's escrow. Transactions typically use Bitcoin for payment, sometimes combined with tumblers for added anonymity and PGP to secure communications between buyers and vendors from being stored on the site itself. Due to the decentralized nature of these markets, phishing and scam sites are often maliciously or accidentally referenced. Dark web news and review sites such as the former DeepDotWeb, and All Things Vice provide exclusive interviews and commentary into the dynamic markets.
Prosecutors wrote in a sentencing memorandum, “The five victims of defendants’ crimes ranged in age from 19 to 51. Both defendants further admitted to distributing fentanyl-laced pills to two additional victims, both of whom suffered fatal drug overdoses shortly after they received the pills from Ta and Srinivasan. For example, in November 2023, while operating in an undercover capacity on Incognito Market, a law enforcement agent purchased and received several tablets purported to be oxycodone. The impact of Operation RapTor can be attributed to the tireless work of U.S. and international law enforcement partners.
The Justice Department established the FBI-led JCODE team to lead and coordinate government efforts to detect, disrupt, and dismantle major criminal enterprises reliant on the darknet for trafficking opioids and other illicit narcotics, along with identifying and dismantling their supply chains. From at least April 2021 until May 2023, McDonald and others conspired to sell fentanyl and cocaine via multiple darknet marketplaces. In a fourth example, a San Fernando Valley man, Brian McDonald, 23, was sentenced to more than 20 years in federal prison in the Central District of California for using darknet marketplaces to sell hundreds of thousands of dollars’ worth of fentanyl-laced pills and cocaine to buyers nationwide.
The dedicated market search engine Grams (closed December 2017) allowed the searching of multiple markets directly without login or registration. The majority of the marketplaces are in English, but some have opened in Chinese, Russian, and Ukrainian. On March 21, 2018, Reddit administrators shut down the popular subreddit /r/DarkNetMarkets citing new changes to their content policy that forbids the sale of "Drugs, including alcohol and tobacco, or any controlled substances". In August 2021, AlphaBay was relaunched after the return of one of the original security administrators DeSnake. The seizures brought in lots of traffic to other markets making TradeRoute and Dream Market the most popular markets at the time.
Incognito Link
For example, the site became known for listings of high-purity narcotics (like Afghan heroin and premium cocaine) and had vendors shipping globally – indicating that major drug suppliers saw Incognito as a profitable channel. In retrospect, several critical vulnerabilities and operational security (OpSec) mistakes led to the market’s downfall. In fact, Lin had meticulously planned the marketplace’s design – even emailing himself a hand-drawn diagram of the site’s workflow in March 2020, months before launch. Incognito Market operated as a hidden service on the Tor network, accessible only to users who knew its “.onion” address and used the Tor browser. Pharaoh threatened to release the identities and private messages of all Incognito vendors and buyers to law enforcement unless he was paid off – essentially holding his own user base hostage. Prominent voices in the darknet community, including Dread’s own administrator “Hugbunter,” grew suspicious.
Market Features
Access to these services is consistently reliable through a network of official links and mirrors, minimizing downtime and user disruption. Platforms like the Nexus market have set the industry standard, providing a secure and efficient environment for commercial transactions. The darknet commerce ecosystem in 2025 demonstrates remarkable resilience and operational maturity. They utilize a system of escrow, where funds are held by the market until the buyer confirms satisfactory receipt of the goods. Its pseudonymous nature allows buyers and vendors to interact without directly linking financial accounts to their identities. The use of Bitcoin remains the financial backbone of darknet commerce, providing a layer of transactional security that is difficult to compromise.
Incognito Market Onion Products
The integration of PGP/GPG encryption is mandatory for reputable users, adding an essential layer of identity verification and secure messaging. The darknet marketplace ecosystem in 2025 is defined by advanced platforms like Nexus Darknet, which provides a secure and efficient environment for trade. “The FDA is committed to continuing its work to disrupt and dismantle the illegal sales of drugs on the dark web, where such sales far too often have tragic consequences,” said Chad Menster, Deputy Director of the Food and Drug Administration’s Office of Criminal Investigations (FDA OCI). In addition, the United States and international law enforcement partners made 270 arrests of dark web vendors, buyers, and administrators in Austria, Brazil, France, Germany, Netherlands, South Korea, Spain, Switzerland, United Kingdom, and the United States.
Salesforce Breach Hits Over 200 Victims
From late 2013 through to 2014, new markets started launching with regularity, such as the Silk Road 2.0, run by the former Silk Road site administrators, as well as the Agora marketplace. By the end of the 1980s, newsgroups like alt.drugs would become online centres of drug discussion and information; however, any related deals were arranged entirely off-site directly between individuals. Following on from the model developed by Silk Road, contemporary markets are characterized by their use of darknet anonymized access (typically Tor), Bitcoin or Monero payment with escrow services, and eBay-like vendor feedback systems. Classic darknet markets sell diverse illegal goods; data stores focus on leaked or stolen data like credentials, databases, and ID records. Apart from the dark web markets that are operating online today, some raided platforms influenced many markets. These platforms sell everything from drugs and fake IDs to weapons and hacking tools, resembling a digital black-market bazaar.
Without vendors, darknet marketplaces cannot operate or generate profits, making them a more strategic enforcement target. While law enforcement typically continues to target the largest darknet marketplaces like Archetyp, it has moved away from multi-DNM takedowns such as 2014’s Operation Onymous. Following the 2022 shutdown of Hydra Market, TRM identified new Russian-language darknet markets emerging that by 2024 accounted for more than 97% of global darknet drug revenues.
The Aftermath Of Lin’s Arrest
This investment directly translates to consistent uptime, ensuring that buyers and sellers can access the platform reliably without frequent interruptions. This method eliminates the need for random searches, which significantly reduces the risk of encountering phishing sites designed to steal user credentials. This model has proven to be a stable foundation for the darknet economy, encouraging innovation in secure trade practices.
WIRED reached out to Chainalysis to ask about Lin's Reactor certification and what sort of safeguards prevent criminals from using the company's software, but the company declined to comment. “There’s a larger issue here about bad actors accessing blockchain analytics tools,” says Robinson. It's not clear whether Lin obtained his Chainalysis certification to bolster a new career training law enforcement in blockchain analysis or, if US prosecutors are to be believed, to advance his previous alleged career as a dark-web criminal. “Stay posted and fuck LE," Pharoah wrote, using the abbreviation LE to mean “law enforcement.” Antinalysis eventually returned, however, and pivoted last year to acting instead as a service for swapping bitcoin for monero and vice versa. But if you've lulled people into a sense of security, I guess it's easier to extort them.” Then in March of this year, the site suddenly dropped offline, taking all the funds stored in buyers' and sellers' wallets with it.
The stability of these darknet sites underscores their role within the broader darknet economy. Today, Attorney General Pam Bondi toured the Port of Tampa Bay – the largest port in Florida – and received a briefing from the Port’s CEO, Paul Anderson. The information here may be outdated and links may no longer function. Highly trained specialists take reports from both the public and law enforcement agencies on more than 400 laws enforced by ICE. It also uses global law enforcement networks, like Europol, to combat cybercrime threats.
In 2022, it ranked as the fourth largest Bitcoin-supporting Western DNM with 10% of market share, rising to 17% in 2023. Since its inception, Abacus Market has gradually increased its market share in the Western DNM ecosystem. Unlike competitors, such as Archetyp, DrugHub, ASAP Market, and Incognito Market, Abacus operated as a central deposit wallet, multisignature DNM that supported both Bitcoin and Monero. Between June 1 and June 27, 2025 average daily deposits to Abacus were USD 230,000 across 1,400 transactions. This was reflected in the sharp decline in deposit volumes to Abacus between June and July, 2025.
The seizures, to which ICE Homeland Security Investigations significantly contributed, include more than $200 million in currency and digital assets, over two metric tons of drugs, comprised of 144 kilograms of fentanyl or fentanyl-laced narcotics, and over 180 firearms. Incognito Market ranks vendors according to the frequency of transactions within the market, etc., and 'Level 1' vendors are paid $100 (about 15,000 yen), and 'Level 5' vendors are paid $20,000. Otherwise he will snitch + post their personal info – including order details – online for police to see.
He recruited a small staff (“employees” in the DOJ filings) to handle tasks like site maintenance, customer support, and possibly dispute resolution. A press release from the St. Lucia government praised the course and noted how Lin had taught 30 police officers the “nuances of the dark web” and crypto-tracking techniques. At the exchange, Lin had again used his real identity to register the account, so when law enforcement subpoenaed the exchange, they obtained his passport and personal details, email, and phone number on file. However, agents were able to correlate the amounts and timing of transactions from the identified wallet to deposits at a certain exchange, effectively following the money despite the detour into Monero.
- No matter where criminals hide, we will find them, dismantle their operations, and bring them to justice.
- The takedown of Incognito Market in particular demonstrated that investigators have become adept at following the money in cryptocurrency and coordinating globally to apprehend suspects.
- Incognito Market sold illegal narcotics and misbranded prescription medication, including, heroin, cocaine, LSD, MDMA, oxycodone, methamphetamines, ketamine and alprazolam.
- Those processes help guard against sophisticated phishing attacks targeted towards darknet marketplace users.
- Otherwise, there’s a good chance of falling victim to a phishing scam like this fake Bitcoin mixer.
“Maybe the whole thing was set up to create a false sense of security,” Ormsby says. According to the FBI, the market took nearly a year to catch on, with virtually no sales during that time. A sketch of a dark-web market's infrastructure that Lin emailed to himself eight months before allegedly creating Incognito Market, according to the DOJ.
