Nemesis Market Drug Vendor Sentenced to 26 Years After Dark Web Trafficking Case
Darren Hughes of San Jose, California, was sentenced to more than 26 years in federal prison for trafficking fentanyl and methamphetamine through Nemesis Market, a major dark web marketplace. Prosecutors said Hughes operated a vendor store on the site, sold narcotics in exchange for cryptocurrency, sent free methamphetamine samples, and completed multiple sales to an undercover law enforcement agent before his June 2023 arrest.
When Redwood City police arrested Hughes after arranging another sale, officers found about 672 grams of methamphetamine and a loaded unserialized 9mm ghost gun in his vehicle. The case was part of a broader international crackdown on Nemesis Market, which launched in 2021, grew to more than 150,000 user accounts and over 400,000 orders, and was dismantled in March 2024 by German and U.S. authorities with support from the FBI, DEA, IRS-CI, and European partners.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
7 events from the most recent confirmed update back to the earliest known activity.
Darren Hughes convicted on federal drug trafficking charges
Hughes was convicted in November 2025 for trafficking fentanyl and methamphetamine through Nemesis Market. Investigators said he operated a vendor store on the marketplace and sold drugs, including to an undercover agent, for cryptocurrency.
German and U.S. authorities dismantle Nemesis Market
In March 2024, German and American authorities dismantled Nemesis Market following an international investigation. The operation involved U.S. and European law enforcement agencies including the FBI, DEA, IRS-CI, and German partners.
Nemesis Market launches on the dark web
Nemesis Market launched in 2021 and later grew into one of the largest illegal online marketplaces, with more than 150,000 user accounts and over 400,000 orders processed at its peak.
California man sentenced to over 26 years in Nemesis case
On 2026-06-05, Darren Hughes of San Jose was reported sentenced to more than 26 years in federal prison for trafficking fentanyl and methamphetamine through Nemesis Market. The sentence followed his conviction for operating a dark web vendor store and conducting sales, including to an undercover agent.
NSA declines to confirm Mythos reporting
On 2026-06-05, the NSA declined to confirm or deny reports about its use of Anthropic's Mythos model, and Anthropic did not comment. The response followed reporting that Anthropic engineers were embedded with the agency.
Reports say NSA is preparing Anthropic Mythos for cyber use
Reporting published on 2026-06-05 said Anthropic had deployed roughly six engineers to the NSA to support use of its Mythos cybersecurity model. The reports said the NSA was preparing or using Mythos for cyber-related applications, though direct offensive use was not confirmed.
Darren Hughes arrested after arranging another drug sale
On 2023-06-28, Redwood City Police arrested Darren Hughes after he arranged another narcotics sale tied to his Nemesis Market activity. Officers found about 672 grams of methamphetamine and a loaded unserialized 9mm ghost gun in his vehicle.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
4 references tracked. Mallory keeps watching after this page renders.
California man sentenced to over 26 years for dark web drug trafficking | brief | SC Media
scworld.com
Open sourceNSA using Claude Mythos for 'offensive cyber operations,' report claims - says 'half-a-dozen' Anthropic engineers embedded inside the agency | Tom's Hardware
tomshardware.com
Open sourceNSA said to be readying Anthropic's Mythos for use in cyber operations | TechCrunch
techcrunch.com
Open sourceDark web Nemesis Market vendor gets 26 years for selling drugs
bleepingcomputer.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sentencing in Darknet Drug Trafficking and Marketplace Operations
US federal courts issued prison sentences tied to **darknet-enabled drug trafficking**. In Los Angeles, **Davit Avalyan** received a **57-month** sentence after pleading guilty to conspiracy to distribute narcotics as part of a multi-year operation that used numerous darknet vendor accounts/storefronts (e.g., *JoyInc*, *PlanetHollywood*, *LaFarmacia*) to sell cocaine, methamphetamine, MDMA, and ketamine nationwide, taking payment in cryptocurrency including **Bitcoin** and **Monero**, and shipping parcels via **USPS**. Separately, reporting on the **Incognito** darknet market case describes sentencing filings alleging that an **FBI-controlled informant/asset** helped administer the marketplace while opioid and fentanyl-tainted products were sold, including claims the informant ignored internal alerts and user complaints about suspected fentanyl-laced pills. A third item—about a Ukrainian national sentenced for facilitating **North Korean remote IT worker infiltration** using stolen identities and US-based “laptop farms”—is a different national-security/cyber-enabled fraud matter and not part of the darknet drug-market sentencing story.
Mar 21, 2026
Incognito Market Operator Sentenced to 30 Years for Darknet Drug Trafficking and Money Laundering
A U.S. federal court sentenced **Rui-Siang Lin** (24), a Taiwanese national accused of operating the dark web narcotics marketplace **Incognito Market**, to **30 years in prison** for conspiring to distribute narcotics, **money laundering**, and conspiring to sell **adulterated/misbranded medication**. Prosecutors said Lin ran the marketplace under the alias **“Pharaoh”** and oversaw more than **$105 million** in narcotics sales, including large quantities of cocaine and methamphetamine and pills purported to be oxycodone, some allegedly **laced with fentanyl**; the sentence also included **five years of supervised release** and forfeiture of **more than $105 million**. Authorities described Incognito Market as a large-scale, “polished” online drug marketplace that supported cryptocurrency payments (including an internal payment mechanism described as **“Incognito Bank”**) and charged vendors a **5% commission**. Reporting cited platform scale estimates of roughly **1,800 vendors**, **400,000+ customer accounts**, and **~640,000 transactions**, with Lin exercising ultimate control over operations while living abroad (including in **St. Lucia**) and shutting the site down in **March 2024**; Lin was arrested in **May 2024** after arriving at **JFK Airport** en route to Singapore and pleaded guilty in **December 2024**. Investigators also obtained warrants (reported as in **2022** and **2023**) to access servers supporting marketplace operations, including transaction data, DDoS protection, and cryptocurrency processing.
Mar 21, 2026
Kingdom Market administrator sentenced for running darknet drug and cybercrime bazaar
Alan Bill, a 33-year-old Slovak national, was sentenced in the United States to 200 months in federal prison for helping operate **Kingdom Market**, a major darknet marketplace that sold illegal drugs and cybercrime-related goods. Bill pleaded guilty to conspiracy to distribute controlled substances after admitting he provided web administration, managed cryptocurrency tied to the site, and promoted the marketplace on Reddit, Dread, and other social platforms. Prosecutors said Kingdom Market operated from March 2021 through December 2023 and facilitated thousands of transactions involving narcotics, stolen financial data, fake identity documents, counterfeit currency, and malware. Investigators said undercover purchases on the platform included fentanyl, methamphetamine, and a fake U.S. passport, while seized server records showed trafficking in heroin and purported Oxycodone cut with fentanyl. Bill was arrested at Newark Liberty International Airport on December 15, 2023, shortly before German authorities seized the marketplace’s servers and shut it down in a multinational operation involving the United States, Germany, Switzerland, Moldova, and Ukraine. The court rejected Bill’s effort to downplay his role, finding he acted as a leader in the conspiracy, and ordered the forfeiture of multiple cryptocurrency assets and the domains `Kingdommarket[.]live` and `Kingdommarket[.]so`.
May 15, 2026