Incognito Market: What You Need to Know

What Was Incognito Market?

Incognito Market was a darknet narcotics marketplace that operated from October 2020 to March 2024. During its operation, it became one of the significant players in the dark web, facilitating over $105 million in narcotics transactions. The marketplace specialized in various illegal drugs, selling more than 1,000 kilograms of cocaine and methamphetamines, along with hundreds of kilograms of other narcotics, including fentanyl-laced oxycodone¹.

The operational timeline of Incognito Market began in October 2020, when it was established by Rui-Siang Lin, also known as Pharoah. Lin led the marketplace until its closure in March 2024, marking a period of rapid growth and significant criminal activity¹. The market's scale was notable, with over 1 ton of narcotics sold, reflecting its extensive reach within the darknet community.

Incognito Market employed an escrow system to facilitate transactions and enhance user trust. However, it also engaged in extortion by charging vendors and buyers fees ranging from $100 to $20,000. Users who refused to comply faced threats of having their cryptocurrency transaction and chat records published²³. By the time it collapsed, the marketplace had accumulated a considerable amount of cryptocurrency, with significant deposits in Bitcoin and Monero, which are known for their privacy features⁴.

The market's operations came to an abrupt end in March 2024 when Lin executed an exit scam, stealing at least $1 million in user deposits¹. Law enforcement efforts had already targeted Incognito Market multiple times, with search warrants executed in 2022 and 2023, indicating ongoing investigations into its activities⁵. This marketplace's rise and fall highlight the complexities and risks associated with darknet markets.

How Incognito Market Operated

Incognito Market operated on the Tor network, ensuring user anonymity through its unique technical infrastructure. The Tor network allows users to access hidden services while masking their IP addresses. This setup is crucial for maintaining privacy in the darknet environment.

The marketplace featured various product categories, primarily focusing on narcotics. Vendors offered a wide range of illegal drugs, including cocaine and methamphetamines. Each vendor was required to pay a 5% commission on sales, which supported the marketplace's operational costs, including server maintenance and employee salaries³. User reputation was built through feedback systems, helping buyers choose reliable vendors.

Cryptocurrency was the primary payment method on Incognito Market, with Bitcoin and Monero as the main currencies. Monero's strong privacy features made it particularly popular among users, with 55.88% of the marketplace's deposit value held in Monero⁴. The market utilized an escrow system to protect transactions. Funds were held in escrow until both parties confirmed successful delivery, reducing the risk of fraud.

However, Incognito Market also engaged in extortion tactics. It charged vendors and buyers fees ranging from $100 to $20,000, threatening to publish transaction records of those who resisted payment². This practice created an environment of fear and compliance among users.

Security measures were heavily advertised, aiming to attract more users. The marketplace emphasized its commitment to user anonymity and transaction security. Despite these claims, users reported issues with withdrawing funds as the market neared its closure, raising suspicions of an exit scam⁶. Overall, Incognito Market's operational structure combined elements of anonymity, extortion, and transaction security, reflecting the complex dynamics of darknet marketplaces.

The March 2024 Exit Scam

The exit scam of Incognito Market began in February 2024, leading to significant user losses. Reports of withdrawal issues surfaced around March 5, 2024, when users could not access their Bitcoin and Monero funds. This situation raised alarms within the community, as fears of an exit scam grew⁶.

In March 2024, Rui-Siang Lin executed the exit scam, absconding with at least $1 million in user deposits. This theft was part of a broader scheme where Lin had already been extorting vendors and buyers with fees ranging from $100 to $20,000. Users who refused to pay these fees faced threats of having their transaction and chat records published¹². The marketplace abruptly shut down shortly thereafter, leaving users unable to recover their funds.

The estimated total losses to users remain unclear, but the impact was significant. Incognito Market had facilitated over $105 million in narcotics sales, indicating a large user base that could have been affected by the exit scam¹. The closure of the marketplace marked the end of a significant player in the darknet narcotics bazaar, which had operated for nearly four years.

Community reaction to the exit scam was one of anger and disbelief. Users shared their experiences on various forums, highlighting the warning signs they had overlooked. Many noted the escalating fees and withdrawal issues as red flags that should have indicated potential trouble. The market's sudden collapse served as a reminder of the inherent risks in darknet marketplaces.

This incident underscores the importance of vigilance when engaging in online transactions, particularly in unregulated environments like the dark web. Users should always be cautious and consider the potential for scams, especially when dealing with large sums of cryptocurrency.

Law Enforcement Investigation and Arrest

Law enforcement agencies conducted a thorough investigation into Incognito Market, leading to significant actions against its operator. The investigation involved multiple agencies, including the U.S. Department of Justice, U.S. Immigration and Customs Enforcement (ICE), and local law enforcement. These agencies collaborated to dismantle the operations of the marketplace, which had facilitated over $105 million in narcotics sales¹.

Blockchain intelligence and cryptocurrency tracing methods played a crucial role in the investigation. Authorities traced transactions involving Bitcoin and Monero, which were the primary currencies used on the platform. Seized servers revealed substantial amounts of cryptocurrency, including 1,316 BTC valued at approximately $36.9 million and 296,094 XMR worth around $46.7 million⁴. This financial attribution helped law enforcement connect transactions to Rui-Siang Lin, the marketplace's operator.

Rui-Siang Lin, also known as Pharoah, was arrested on May 18, 2024, at John F. Kennedy International Airport³. Following his arrest, he faced serious charges, including engaging in a continuing criminal enterprise and narcotics conspiracy³. The evidence presented against him included transaction records, user complaints, and the financial data obtained from the seized servers. Lin ultimately pled guilty to the charges on December 16, 2024, leading to a sentence of 30 years in prison on February 3, 2026¹.

This case highlights the importance of financial attribution in prosecuting individuals involved in darknet marketplaces. By tracing cryptocurrency transactions, law enforcement can build a solid case against operators and hold them accountable for their actions. The investigation into Incognito Market serves as a critical example of how interagency collaboration and advanced tracing techniques can effectively combat illegal online activities.

Legal Proceedings and Sentencing

Rui-Siang Lin, the operator of Incognito Market, faced significant legal consequences for his actions. After his arrest on May 18, 2024, Lin pled guilty to multiple charges on December 16, 2024. These charges included engaging in a continuing criminal enterprise and narcotics conspiracy, which are serious offenses under U.S. law³.

On February 3, 2026, Lin was sentenced to 30 years in prison. This lengthy sentence reflects the severity of his criminal activities, which facilitated over $105 million in narcotics sales during the marketplace's operation¹. The legal framework surrounding his case emphasizes the penalties associated with operating a darknet marketplace, particularly one involved in large-scale drug trafficking.

In addition to his prison sentence, Lin was subject to asset forfeiture. Law enforcement seized significant amounts of cryptocurrency linked to Incognito Market, including 1,316 BTC (valued at approximately $36.9 million) and 296,094 XMR (worth around $46.7 million)⁴. This forfeiture aims to disrupt the financial operations of darknet markets and deter future offenders by ensuring that criminal profits are not retained.

The significance of Lin's sentence extends beyond his individual case. It serves as a warning to other darknet market operators about the potential consequences of illegal activities. The mandatory minimum sentences associated with charges like engaging in a continuing criminal enterprise highlight the legal risks involved in operating on the dark web. This case underscores the ongoing efforts by law enforcement to combat drug trafficking and other illegal activities facilitated by darknet marketplaces.

Trust Mechanisms in Darknet Markets

Incognito Market employed several trust mechanisms to foster confidence among its users despite the inherent anonymity of darknet transactions. A key element was its reputation system, which allowed users to rate vendors based on their experiences. This system enabled buyers to assess the reliability of vendors before making purchases. Positive feedback could enhance a vendor's standing, while negative reviews could deter potential customers.

The escrow system further bolstered trust. In this setup, funds from buyers were held in escrow until both parties confirmed the successful delivery of goods. This process reduced the risk of fraud, as vendors had to ensure that they delivered their products to receive payment. However, it is important to note that this system is not foolproof. Users could still face challenges when attempting to withdraw funds, especially as the market approached its collapse⁶.

Despite these mechanisms, a paradox of trust exists in illegal marketplaces. Users must rely on systems that can be manipulated or exploited. For example, the very same reputation system could be subject to fake reviews or collusion among vendors. This uncertainty contributes to a climate of distrust, even among users who engage in transactions.

Exit scams remain a persistent risk in darknet markets, including Incognito Market. In March 2024, Rui-Siang Lin executed an exit scam, absconding with at least $1 million in user deposits¹. Users reported being unable to withdraw their funds shortly before the market's closure, amplifying fears of fraud⁶. This incident highlights the vulnerabilities present in darknet transactions, where trust is often built on fragile foundations.

Understanding these trust mechanisms is crucial for anyone navigating darknet marketplaces. While systems like reputation ratings and escrow can enhance security, users should remain vigilant about the risks involved.

Cryptocurrency Tracing and Attribution

Law enforcement agencies utilized various blockchain analysis techniques to investigate Incognito Market. These methods helped trace cryptocurrency transactions, despite the marketplace's claims of anonymity.

Incognito Market operated primarily with Bitcoin and Monero, with Monero being favored for its privacy features. Approximately 55.88% of the marketplace's deposit value was held in Monero⁴. Authorities focused on tracking these transactions to build a case against the operators. They identified that Rui-Siang Lin, the marketplace's founder, used instant exchangers to convert Bitcoin to Monero. This Monero was then deposited directly into exchange accounts, a tactic less common in typical darknet market operations⁴.

The investigation revealed vulnerabilities in Incognito Market's internal payment infrastructure. Seized servers contained Bitcoin wallets with 183,722 deposit transactions totaling 1,316 BTC (approximately $36.9 million) and Monero wallets with 181,918 deposit transactions worth 296,094 XMR (around $46.7 million)⁴. These findings highlighted that even in markets promoting anonymity, tracking financial flows is feasible.

Law enforcement executed multiple search warrants on Incognito Market's servers, which aided in gathering crucial evidence⁵. The analysis of transaction records and user complaints demonstrated the extent of the marketplace's operations and helped establish a financial attribution to Lin³.

This case illustrates significant lessons for darknet market enforcement. Effective collaboration among agencies, combined with advanced blockchain intelligence, can disrupt illegal activities. The ability to trace cryptocurrency transactions underscores the importance of financial attribution in prosecuting darknet market operators. This approach can deter future offenders and reinforce the risks associated with engaging in illegal online marketplaces.

Impact on Darknet Market Ecosystem

The shutdown of Incognito Market has significantly altered the darknet market landscape. Vendors and users have begun migrating to other platforms, seeking alternatives for their illicit activities. This shift has implications for the overall dynamics of darknet marketplaces.

The immediate aftermath of Incognito's closure saw a noticeable increase in traffic to existing markets. Some vendors attempted to establish themselves on smaller, less regulated platforms. Others chose to return to previously abandoned markets, hoping to capitalize on the influx of users seeking new opportunities. This migration can destabilize established markets as they adjust to the sudden influx of new vendors and users.

Incognito Market's operations had generated over $105 million in narcotics sales, indicating a substantial user base¹. The loss of such a significant player raises questions about the sustainability of remaining markets. Some may struggle to accommodate the sudden increase in demand, potentially leading to inflated prices and a surge in competition among vendors.

Law enforcement's capabilities have evolved as well, particularly in response to the collapse of Incognito Market. The successful investigation and subsequent arrest of Rui-Siang Lin demonstrate the effectiveness of advanced blockchain tracing methods³. Authorities have become more adept at tracking cryptocurrency transactions, which aids in identifying and prosecuting operators of darknet marketplaces. This evolution in law enforcement techniques can deter future market operators from engaging in illegal activities.

As interagency investigations continue, the threat of increased scrutiny looms over other active markets. The closure of Incognito Market may prompt law enforcement to intensify efforts against other platforms, particularly those with similar operational structures. The fallout from this case serves as a reminder of the risks associated with operating in the darknet ecosystem, where the potential for arrest and asset seizure is ever-present.

Common Misconceptions and Mistakes

"Monero Transactions Are Completely Untraceable"

Many users believed Incognito Market's reliance on Monero guaranteed absolute anonymity. The marketplace held 55.88% of its deposit value in Monero specifically for its privacy features⁴. However, law enforcement successfully traced Rui-Siang Lin's financial activity by analyzing his conversion patterns and exchange deposits⁴. Monero adds layers of privacy, but operational security failures—like using identifiable exchange accounts—can still expose users.

"Exit Scams Are Obvious Before They Happen"

Users often assume they will recognize warning signs before a marketplace executes an exit scam. Incognito Market operated for over three years and built substantial trust through its escrow system and vendor ratings¹. When Lin closed the market in March 2024, users only reported withdrawal issues on March 5, just days before the complete shutdown⁶. The theft of at least $1 million in user deposits happened rapidly, with minimal advance notice¹. Trust mechanisms can mask impending fraud until it is too late.

"Darknet Market Operators Are Beyond Law Enforcement Reach"

Some believe operating a darknet marketplace from outside the United States provides immunity from prosecution. Rui-Siang Lin managed Incognito Market while conducting cybercrime training for St. Lucian police officers, suggesting confidence in his anonymity¹. He was arrested at John F. Kennedy International Airport on May 18, 2024, and sentenced to 30 years in prison³¹. International travel and digital footprints create vulnerabilities that law enforcement can exploit regardless of operational location.

"Paying Extortion Fees Protects Your Identity"

After closing Incognito Market, Lin extorted vendors and buyers with fees ranging from $100 to $20,000, threatening to publish transaction and chat records². Users who paid believed this would secure their anonymity. However, law enforcement already possessed extensive transaction data from seized servers, including 183,722 Bitcoin deposits and 181,918 Monero deposits⁴. Paying extortion only enriched the operator without providing genuine protection, as authorities had independent access to user records through multiple server seizures conducted in 2022, 2023, and 2024⁵.

Key Takeaways

• Monero does not guarantee complete anonymity. Incognito Market held 55.88% of deposits in Monero, yet law enforcement traced Rui-Siang Lin through his exchange account usage and conversion patterns⁴.
• Exit scams happen with minimal warning. Despite three years of operation and trust-building mechanisms, users only reported withdrawal issues on March 5, 2024, days before Lin stole at least $1 million¹⁶.
• International operations do not prevent prosecution. Lin managed the marketplace while training St. Lucian police on cybercrime, but was arrested at JFK Airport and sentenced to 30 years in prison³¹.
• Paying extortion fees provides no real protection. Lin extorted users for up to $20,000 per person, yet authorities already possessed transaction records from multiple server seizures²⁴⁵.
• Blockchain tracing has advanced significantly. Seized servers revealed 183,722 Bitcoin and 181,918 Monero deposit transactions, demonstrating law enforcement's ability to analyze cryptocurrency flows even in privacy-focused markets⁴.

To understand how similar marketplaces operate and what risks they present, review our Darknet Market Tutorial for New Users.