Incognito Market

~ the eulogy ~

Incognito opened in October 2020 and sold drugs on Tor until the spring of 2024. By the end it had taken more than $105 million, across better than 640,000 cryptocurrency transactions, with something over 400,000 buyer accounts registered against roughly 1,800 vendors. Investigators later accounted for more than a thousand kilograms each of cocaine and methamphetamine moving through it.

I have never opened a darknet market and have no reason to. The drugs are the ordinary part of this story and the ending is the part that earns a grave. Silk Road and AlphaBay were both seized, the second of them into a Dutch police trap already running at Hansa for the sellers who fled. Incognito was none of that. Incognito was robbed from the inside by the person who owned it.

Withdrawals started failing in February 2024. Vendors who tried to move their Bitcoin out found the button did nothing, and by 5 March users were saying so in public. The standard reading in that world is an exit scam, where an operator waits until the escrow balances are fat and then simply keeps them. That part was correct, and on its own it would have made Incognito an unremarkable entry in a long list.

Then the administrator did something nobody in the category had tried at that scale. Having already taken the money, he announced that he had kept every order record and every private message, and that he would publish them unless people paid again.

~ the dossier ~

~ incognito bank ~

The mechanism that made the theft possible was built into the market from the start. Lin ran an internal payment layer he called Incognito Bank, and it held the balances. On a market with conventional escrow the coins sit in a multi-signature arrangement and the operator cannot move them alone. Routing everything through a house bank is more convenient for users and completely convenient for whoever controls the house. When he stopped honoring withdrawals, there was no second key anywhere that could have overruled him.

~ the blackmail ~

The extortion notice went up in the middle of March 2024 and it was graded. Buyers and vendors were quoted sums between $100 and $20,000 depending on how much they had traded, with a deadline of 1 April, after which the records would supposedly go to law enforcement. Brian Krebs wrote it up on 11 March. The market was still serving pages while this was happening, which meant the thing threatening to turn its users in was also still displaying their order histories back to them.

On 1 April the administrator posted that the whole extortion had been a joke. Nobody was in a position to find that funny. The deadline he had set for payment was 1 April, and he spent April Fools' Day telling the people he had robbed that the second robbery had been humor. The vendors were already gone. A market is a promise that the escrow will pay out, and he had spent the promise twice in three weeks.

~ the sentence ~

Rui-Siang Lin was arrested in May 2024 as he transited through JFK, which is an unforced error of a kind the category keeps making: the hidden service was competent and the travel was not. He pleaded guilty in December 2024 to narcotics conspiracy and money laundering.

Sentencing came on 4 February 2026 in Manhattan federal court. Judge Colleen McMahon called it the most serious drug crime she had seen in twenty-seven and a half years on the bench, counted the harm against more than 470,000 narcotics users and their families, and gave him thirty years, with forfeiture of more than $105 million. He was not yet twenty-five on the day he was sentenced.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »