
A Taiwanese man who ran one of the world's largest dark web drugs marketplaces has been sentenced to 30 years in a US federal prison, in what the judge described as "the most serious drug crime I have ever been confronted with in 27.5 years."
24-year-old Rui-Siang Lin operated Incognito Market under the alias "Pharaoh" from October 2020 until March 2024, facilitating over $105 million in illegal drug sales to more than 400,000 customers across the globe.
The dark web marketplace, accessible via the Tor browser, hosted more than 1,800 vendors and processed over 640,000 transactions, selling cocaine, methamphetamine, heroin, MDMA, and counterfeit prescription medications.
Lin had overall control over the Incognito Market's operations, managing vendors, customers, and employees while taking a 5% commission for himself on every sale.
The site operated its own cryptocurrency payment system, dubbed "Incognito Bank", promising that users could "buy whatever you desire with the best security, friendly interface and streamlined user experience there is."
However, for all his technical prowess, Lin made a fundamental error in his own security that led to his downfall. Imvestigators were able to trace the site's domain registration back to Lin after he - astonishingly - used his real name, phone number, and address.

What is perhaps most remarkable, however, is that - as The Record reports - while managing Incognito Market from St Lucia, Lin ran a four-day training session for local police on "Cybercrime and Cryptocurrency" - even bragging about it on Facebook.
Things turned deadly in January 2022 when Lin allowed the sale of opiates on Incognito Market. Fake prescription pills started to be listed on the site - some of which were actually fentanyl disguised as oxycodone. In September 2022, a 27-year-old man from Arkansas died after taking pills he had bought from the site. Prosecutors said Lin's marketplace was directly responsible for the man's death.
In March 2024, Lin abruptly shut down Incognito Market without warning, stealing at least US $1 million in user deposits. He then attempted to extort users by threatening to publish their transaction histories and cryptocurrency addresses, writing "YES, THIS IS AN EXTORTION!!!" on the site.

In May 2024, Lin was arrested when he flew into New York's JFK Airport en route to Singapore, and subsequently pleaded guilty to drugs-related charges and money laundering.
US District Judge Colleen McMahon has now given Lin a 30-year prison sentence, describing Incognito Market as "a business that made [Lin] a drug kingpin." In addition to the prison term, Lin was sentenced to five years of supervised release and ordered to forfeit US $105,045,109.67.
According to US Attorney Jay Clayton, Lin was "responsible for at least one tragic death, and he exacerbated the opioid crisis and caused misery for more than 470,000 narcotics users and their families."
Lin has three decades in a US federal prison to ponder whether training the police in cybercrime while simultaneously running a massive drug marketplace was perhaps not the wisest decision of his life.
tags
Graham Cluley is an award-winning security blogger, researcher and public speaker. He has been working in the computer security industry since the early 1990s.
View all posts