Loading story…
A U.S. federal court sentenced Rui-Siang Lin (24), a Taiwanese national accused of operating the dark web narcotics marketplace Incognito Market, to 30 years in prison for conspiring to distribute narcotics, money laundering, and conspiring to sell adulterated/misbranded medication. Prosecutors said Lin ran the marketplace under the alias “Pharaoh” and oversaw more than $105 million in narcotics sales, including large quantities of cocaine and methamphetamine and pills purported to be oxycodone, some allegedly laced with fentanyl; the sentence also included five years of supervised release and forfeiture of more than $105 million.
Authorities described Incognito Market as a large-scale, “polished” online drug marketplace that supported cryptocurrency payments (including an internal payment mechanism described as “Incognito Bank”) and charged vendors a 5% commission. Reporting cited platform scale estimates of roughly 1,800 vendors, 400,000+ customer accounts, and ~640,000 transactions, with Lin exercising ultimate control over operations while living abroad (including in St. Lucia) and shutting the site down in March 2024; Lin was arrested in May 2024 after arriving at JFK Airport en route to Singapore and pleaded guilty in December 2024. Investigators also obtained warrants (reported as in 2022 and 2023) to access servers supporting marketplace operations, including transaction data, DDoS protection, and cryptocurrency processing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On February 4, 2026, Lin was sentenced to 30 years in federal prison for operating Incognito Market and ordered to forfeit roughly $105 million. The court also imposed five years of supervised release, and the judge described the case as among the most serious drug crimes she had seen.
In December 2024, Lin pleaded guilty in U.S. federal court to narcotics distribution conspiracy, money laundering, and conspiracy to sell adulterated and misbranded medication. The case involved sales of fentanyl-laced pills marketed as oxycodone and other narcotics sold through Incognito Market.
In March 2024, Incognito Market was shut down after facilitating more than $105 million in drug sales. Prosecutors said Lin then stole at least $1 million from buyers and attempted to extort vendors and customers by threatening to release transaction histories and cryptocurrency addresses.
In 2023, law enforcement obtained warrants to access servers used to host Incognito Market, mitigate DDoS attacks, and process cryptocurrency transactions. These investigative steps helped authorities gather evidence on the marketplace’s operations.
The FBI began investigating Incognito Market in 2022, including undercover drug purchases on the site. Investigators later used operational security mistakes involving cryptocurrency wallets and domain records to attribute administration of the market to Lin.
U.S. prosecutors said Rui-Siang Lin, using the alias “Pharaoh,” operated the Incognito Market darknet narcotics marketplace beginning in October 2020. The platform later grew to thousands of vendors and hundreds of thousands of customer accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US federal courts issued prison sentences tied to **darknet-enabled drug trafficking**. In Los Angeles, **Davit Avalyan** received a **57-month** sentence after pleading guilty to conspiracy to distribute narcotics as part of a multi-year operation that used numerous darknet vendor accounts/storefronts (e.g., *JoyInc*, *PlanetHollywood*, *LaFarmacia*) to sell cocaine, methamphetamine, MDMA, and ketamine nationwide, taking payment in cryptocurrency including **Bitcoin** and **Monero**, and shipping parcels via **USPS**. Separately, reporting on the **Incognito** darknet market case describes sentencing filings alleging that an **FBI-controlled informant/asset** helped administer the marketplace while opioid and fentanyl-tainted products were sold, including claims the informant ignored internal alerts and user complaints about suspected fentanyl-laced pills. A third item—about a Ukrainian national sentenced for facilitating **North Korean remote IT worker infiltration** using stolen identities and US-based “laptop farms”—is a different national-security/cyber-enabled fraud matter and not part of the darknet drug-market sentencing story.
Jun 29, 2026
Alan Bill, a 33-year-old Slovak national, was sentenced in the United States to 200 months in federal prison for helping operate **Kingdom Market**, a major darknet marketplace that sold illegal drugs and cybercrime-related goods. Bill pleaded guilty to conspiracy to distribute controlled substances after admitting he provided web administration, managed cryptocurrency tied to the site, and promoted the marketplace on Reddit, Dread, and other social platforms. Prosecutors said Kingdom Market operated from March 2021 through December 2023 and facilitated thousands of transactions involving narcotics, stolen financial data, fake identity documents, counterfeit currency, and malware. Investigators said undercover purchases on the platform included fentanyl, methamphetamine, and a fake U.S. passport, while seized server records showed trafficking in heroin and purported Oxycodone cut with fentanyl. Bill was arrested at Newark Liberty International Airport on December 15, 2023, shortly before German authorities seized the marketplace’s servers and shut it down in a multinational operation involving the United States, Germany, Switzerland, Moldova, and Ukraine. The court rejected Bill’s effort to downplay his role, finding he acted as a leader in the conspiracy, and ordered the forfeiture of multiple cryptocurrency assets and the domains `Kingdommarket[.]live` and `Kingdommarket[.]so`.
Jun 29, 2026
**Empire Market** co-creator **Raheim Hamilton** (aka “Sydney”/“Zero Angel”) pleaded guilty in U.S. federal court in Chicago to a **drug conspiracy** charge tied to operating the dark web marketplace from 2018–2020. Prosecutors said the Tor-hidden service facilitated **over 4 million transactions** totaling **more than $430 million**, primarily **illegal drug sales (~$375 million)**, and also enabled sales of **stolen credentials, personal data, counterfeit currency, and hacking tools**; Hamilton admitted the platform was designed to evade law enforcement and launder proceeds via **cryptocurrency-only** payments. Hamilton and co-defendant **Thomas Pavey** (aka “Dopenugget”) were previously charged for running the market and allegedly had earlier involvement selling counterfeit currency on **AlphaBay** before launching Empire Market. Reporting indicates law enforcement conducted **undercover purchases** (including heroin and methamphetamine), and the investigation resulted in significant cryptocurrency seizures (reported at **~$75 million**) and forfeiture commitments including **Bitcoin, Ether, and property**; Hamilton faces a **mandatory minimum of 10 years** and up to **life** in prison, with sentencing scheduled for **June 17, 2026**.
Jun 29, 2026