LIVE
TRACECHAIN™FORENSICS
FRAUD INTELLIGENCE · CASE FILES · GLOBAL SCOREBOARD
REPORT FRAUD Find your country and who to contact ▸🔍 Search cases, companies, countries, agencies
INTEL
PIG BUTCHERING: now the #1 loss category in the US by estimated volume / HUSHPUPPI: the Instagram that became the evidence -- Case 001 open / BEC: one spoofed email, one wire, seven figures -- see the methodology / ROSS ULBRICHT: full pardon January 21 2025 after 11+ years -- Case 013 open / ALL FIGURES LABELED: estimate vs conviction vs market collapse -- see Methodology / UNODC 2023: $5.4B estimated annually from SE Asia pig-butchering compounds [UNVERIFIED] / PIG BUTCHERING: now the #1 loss category in the US by estimated volume / HUSHPUPPI: the Instagram that became the evidence -- Case 001 open / BEC: one spoofed email, one wire, seven figures -- see the methodology / ROSS ULBRICHT: full pardon January 21 2025 after 11+ years -- Case 013 open / ALL FIGURES LABELED: estimate vs conviction vs market collapse -- see Methodology / UNODC 2023: $5.4B estimated annually from SE Asia pig-butchering compounds [UNVERIFIED]
Rui-Siang Lin$105M+
NO WANTED POSTERarrested at JFK May 2024; never a fugitive; no poster
#64 OF 102

Rui-Siang Lin

COMPANY IN THIS CASE
Incognito Market$105M+▸
INDIVIDUALBORN IN 🇹🇼 TAIWAN ▸
CASE 039 · DARK WEBCONVICTED
“Pharaoh” · Incognito Market · 30 years
$105M+
WHAT WAS TAKEN
Drugs sold on his darknet market; he took ~$6M, then kept $1M+ of users' deposits.
HOW
Ran Incognito Market with a 5% cut, then shut it down, kept the deposits and extorted users.
AT A GLANCE
Born
~2001
Status
Convicted
Court
US District Court, Southern District of New York
Charges
Narcotics conspiracy · Money laundering · Conspiracy to sell adulterated and misbranded medication
Plea
Dec 16, 2024 · narcotics conspiracy, laundering, misbranded medicine
Sentenced
Feb 4, 2026 · 30 years · Judge Colleen McMahon
Story
TAP TO READ FULL NARRATIVE — THE SEVERANCE PACKAGE (800 WORDS)
Sources: DOJ/SDNY press release February 4, 2026 (primary) · Guilty plea December 16, 2024 before Judge Colleen McMahon · Arrest May 18, 2024, JFK Airport · Bitdefender / SecurityAffairs / Decrypt citing DOJ. METRIC DISCIPLINE: >$105M = platform sales volume. Lin's actual profit = >$6M (5% commission). These are different numbers. Forfeiture order: $105,045,109.67. Judge McMahon: 'the most serious drug crime I have ever been confronted with in 27.5 years.' One confirmed death: 27-year-old Arkansas man, fentanyl-laced pills from the platform.
· PROLOGUE ·
A Business

Incognito Market was not an ideology. It was a business.

Rui-Siang Lin, 24 years old at the time of sentencing, a Taiwanese national, built Incognito Market and operated it from October 2020 to March 2024 under the alias 'Pharaoh' — from locations including St. Lucia, where he had concurrently established himself as a resource for local law enforcement on cybercrime and cryptocurrency. He provided training to Caribbean police on blockchain and cyber investigations while operating a major narcotics darknet marketplace. [SOURCE: DOJ press release; SecurityAffairs]

The platform: over 400,000 buyers, 1,800+ vendors, 640,000+ completed transactions. $105 million in narcotics sales — cocaine, methamphetamine, heroin, MDMA, counterfeit prescription drugs including fentanyl-laced pills sold as oxycodone. [SOURCE: DOJ February 4, 2026]

Vendors paid a 5 percent commission on each sale. Lin also operated an internal cryptocurrency 'bank' through which he collected payments and held escrowed funds. His total operating profit: approximately $6 million. The $105 million in sales is the platform volume, not his take. [SOURCE: Decrypt citing DOJ]

In January 2022, Lin explicitly allowed the sale of opiates on the platform. This led to counterfeit prescription drug listings. In September 2022, a 27-year-old man in Arkansas died after taking pills he had purchased on Incognito Market that contained fentanyl disguised as oxycodone. The DOJ described Lin as responsible for at least one death. [SOURCE: DOJ press release]

· PART ONE ·
The Exit — Stealing From His Own Customers

In March 2024, Lin abruptly shut down Incognito Market without warning. He stole at least $1 million in user deposits from the platform's internal escrow bank — funds that vendors and buyers had deposited with the expectation they would be returned or applied to transactions.

He then posted a message on the site. The message threatened to publish the transaction histories and cryptocurrency addresses of users unless they paid. It stated, in his own words: 'YES, THIS IS AN EXTORTION!!!' [SOURCE: Bitdefender citing DOJ; SecurityAffairs]

The users he was extorting were criminals — vendors who had sold narcotics on the platform and buyers who had purchased them. They could not file a police report about the theft of their escrow funds or the threat to expose their darknet market activity. They had no recourse. Lin's leverage was precisely their own criminality.

This is the moral inversion unique to this case in the series: every other case involves a fraudster and a victim outside the scheme. Incognito's victims, in the exit scam, were the scheme's own participants. The piece states this factually. It does not frame them as sympathetic; it does not excuse Lin.

· PART TWO ·
Arrest, Plea, and Sentence

Lin was arrested on May 18, 2024 when he flew into New York's JFK Airport en route from the Caribbean to Singapore. He was taken into custody by US authorities. [SOURCE: DOJ; Cyberinsider]

He pleaded guilty on December 16, 2024 before US District Judge Colleen McMahon in the Southern District of New York, to conspiracy to distribute narcotics, money laundering, and conspiring to sell adulterated and misbranded medication.

He was sentenced on February 4, 2026 to 30 years in federal prison. Judge McMahon described Incognito Market as 'a business that made [Lin] a drug kingpin' and called it 'the most serious drug crime I have ever been confronted with in 27.5 years.' [SOURCE: Bitdefender citing DOJ] He was also ordered to forfeit $105,045,109.67 — the platform's total sales volume. He received five years of supervised release to follow his prison term.

US Attorney Jay Clayton stated: 'Rui-Siang Lin was one of the world's most prolific drug traffickers, using the internet to sell more than $105 million of illegal drugs throughout this country and across the globe. While Lin made millions, his offenses had devastating consequences. He is responsible for at least one tragic death.' [SOURCE: DOJ press release February 4, 2026]

VERIFIED SOURCES
[1] DOJ/SDNY press release, February 4, 2026 — full sentencing details, forfeiture order, US Attorney Clayton statement, platform statistics. PRIMARY SOURCE for all figures.
[2] DOJ — guilty plea December 16, 2024, before Judge Colleen McMahon.
[3] Bitdefender citing DOJ — Judge McMahon's quotes; the 'YES, THIS IS AN EXTORTION!!!' message text; the St. Lucia/Caribbean cybercrime training detail.
[4] SecurityAffairs / Decrypt — arrest at JFK May 18, 2024; platform operation details; $6M operator profit figure (5% commission).
TO VERIFY Birth date (approximate 2001-2002) · Exact arrest date (May 18, 2024 widely reported) · Whether the extortion attempt produced any payments · Co-founder status (Lin co-founded with another individual per some reports — verify)
Bio
BIO

IDENTITY

NAME
Rui-Siang Lin (林睿庠)
ALIAS
Pharaoh
FROM
Taiwan · ~24 at sentencing
BASED
St. Lucia, per the DOJ and press

CASE RECORD

ARRESTED
May 18, 2024 · JFK Airport
PLEA
Dec 16, 2024 · narcotics conspiracy, laundering, misbranded medicine
SENTENCED
Feb 4, 2026 · 30 years · Judge Colleen McMahon
FORFEIT
$105,045,109.67
BORN
~2001
STATUS
Convicted
CUSTODY
In custody
COURT
US District Court, Southern District of New York
JUDGE
Colleen McMahon
CHARGES
Narcotics conspiracy · Money laundering · Conspiracy to sell adulterated and misbranded medication
PLATFORM
Incognito Market (Oct 2020 – Mar 2024)
Timeline
CASE TIMELINE
Oct 2020
Opens
Incognito Market launches.
SOURCE: DOJ
Jan 2022
Opiates allowed
Fake prescription pills follow.
SOURCE: DOJ
Mar 2024
Exit
Deposits kept; users threatened.
SOURCE: DOJ
May 18, 2024
Arrested
JFK Airport.
SOURCE: DOJ
Dec 16, 2024
Guilty
Three counts.
SOURCE: DOJ
Feb 4, 2026
30 years
Judge McMahon.
SOURCE: DOJ
Receipts
Pictures and video from the story. Every caption gives when, where and why; tap a name to open that person’s report.
"Work Flow (simple)": the hand-drawn darknet-market plan Lin emailed to himself
1. "Work Flow (simple)": the hand-drawn darknet-market plan Lin emailed to himself
12 March 2020 (drawing); complaint filed 26 January 2024 · Lin's personal email account; US v. Lin, 24 MAG 351, S.D.N.Y.
Seven months before Incognito opened: vendor, listing, PGP key, admin review, DB, server. The FBI affidavit called it "a plan for a darknet market" and used it to tie Lin to "Pharaoh".
IN THIS PICTURE Rui-Siang Lin ▸
Court exhibit: US Department of Justice · FBI affidavit in support of the criminal complaint, US v. Rui-Siang Lin, 1:24-mj-00351, S.D.N.Y., filed 26 January 2024, p. 31 (via CourtListener/RECAP)
Still from a video in which Lin introduces himself by name, used by the FBI to match his voice and face to the market's accounts
2. Still from a video in which Lin introduces himself by name, used by the FBI to match his voice and face to the market's accounts
2023 (video located by investigators); complaint 26 January 2024 · Unknown location (online video); US v. Lin, S.D.N.Y.
The double life in one frame: the young Taiwanese "cybersecurity" presenter who was, per the affidavit, running a $100 million drug market at the same time.
IN THIS PICTURE Rui-Siang Lin ▸
Court exhibit: US Department of Justice · FBI affidavit in support of the criminal complaint, US v. Rui-Siang Lin, S.D.N.Y., 26 January 2024, p. 28
"YES, THIS IS AN EXTORTION !!!": the message Incognito posted to its own users
3. "YES, THIS IS AN EXTORTION !!!": the message Incognito posted to its own users
March 2024 (reported 13 March 2024) · Incognito Market homepage (Tor hidden service)
The exit scam. After taking at least $1 million in deposits, the operator threatened to publish 557,000 orders and 862,000 transaction IDs unless vendors paid. Prosecutors quoted the line in the indictment.
Screenshot: Incognito Market homepage via KrebsOnSecurity · Krebs on Security, "Incognito Darknet Market Mass-Extorts Buyers, Sellers", 13 March 2024 (screenshot of the market homepage)
The "Payment Status" board: vendors listed in green if they had paid the extortion, red if not
4. The "Payment Status" board: vendors listed in green if they had paid the extortion, red if not
March 2024 · Incognito Market (Tor hidden service)
How the extortion was run: a public scoreboard shaming vendors who had not paid, with prices scaled to their sales volume.
Screenshot: Incognito Market via KrebsOnSecurity · Krebs on Security, "Incognito Darknet Market Mass-Extorts Buyers, Sellers", 13 March 2024
TaiwanPlus: "US court gives Taiwanese man 30 years for running dark web drug site"▶ WATCH
5. TaiwanPlus: "US court gives Taiwanese man 30 years for running dark web drug site"
February 2026 (sentenced 4 February 2026) · Taipei, Taiwan (broadcast); sentence in S.D.N.Y., New York
Taiwan's English-language broadcaster on the sentence; the thumbnail shows Lin at a Taiwan-flagged event, the public persona he kept while operating Incognito from St Lucia.
IN THIS PICTURE Rui-Siang Lin ▸
▶ Watch the video · TaiwanPlus News, YouTube, February 2026
Video: TaiwanPlus; still via YouTube · TaiwanPlus News, "US Court Gives Taiwanese Man 30 Years for Running Dark Web Drug Site", YouTube, February 2026
Operations
Where they were physically based, what they did in each place and when, and the methods they used. Tap a country or a method for its page.
THE MAP
Born in amber; operated from cyan. Tap a marker for the country page.
🇹🇼 Taiwan — born here
🇱🇨 Saint Lucia — operated here
METHODS IN THIS CASE: #7 Money Laundering — Ran an in-site crypto "bank" · #30 Embezzlement — Kept users' deposits at the exit
WHAT THEY DID HERE: 2020–2024 — Runs Incognito Market from Saint Lucia, according to the DOJ and press; the market moves ~$100M in narcotics. · Mar 2024 — Exit scam: keeps users' deposits and threatens to publish their data.
🇺🇸 United States — operated here
METHODS IN THIS CASE: #7 Money Laundering — Ran an in-site crypto "bank" · #30 Embezzlement — Kept users' deposits at the exit
WHAT THEY DID HERE: 18 May 2024 — Arrested at JFK Airport.
OPERATED FROM
Where they were physically based or worked. Tap a country for its page.
🇱🇨 Saint Lucia ▸
2020–2024Runs Incognito Market from Saint Lucia, according to the DOJ and press; the market moves ~$100M in narcotics.SOURCE: DOJ SDNY
Mar 2024Exit scam: keeps users' deposits and threatens to publish their data.SOURCE: DOJ SDNY
🇺🇸 New York, United States ▸
18 May 2024Arrested at JFK Airport.SOURCE: DOJ
METHODS USED
Tap a method to see where it came from and everyone who used it.
Money LaunderingRan an in-site crypto "bank" ▸EmbezzlementKept users' deposits at the exit ▸
Sources
SOURCES
[1] PRIMARY — US Attorney SDNY: sentenced to 30 years (Feb 4, 2026)
[2] SECONDARY — Decrypt / Bitdefender / SecurityAffairs
More
KEY FACTS
RUI-SIANG LIN
THE SEVERANCE PACKAGE · "PHARAOH" · INCOGNITO MARKET · CASE 039 · DARK WEB · 30 YEARS 2026
SALES
$105M+ of drugs sold on the site
HIS TAKE
~$6M in commissions
EXIT
$1M+ of users’ deposits kept
SENTENCE
30 years · Feb 4, 2026
BUYERS
400,000+ · 1,800 vendors
DEATH
At least one, per the DOJ
SALES VS TAKE: $105M is what sold through the market; his own cut was about $6M. The forfeiture was set at $105M.
THE DARKNET TRILOGY
THE EXITMARCH 2024
“YES, THIS IS AN EXTORTION”
His message to users
Kept deposits and demanded payment not to publish users’ records.
SOURCE: DOJ
HOW IT WORKED

HOW INCOGNITO WORKED — DEFENSIVE LEVEL

01
The shop: Vendors listed drugs; buyers paid in crypto
02
The bank: An in-site wallet held everyone’s money
03
The cut: 5% commission on each sale
04
The exit: The operator kept the deposits and threatened users
HOW MONEY MOVED
Buyer’s crypto
-->
In-site “bank”
-->
Vendor paid, 5% kept
-->
Deposits taken at exit

WHAT THIS CASE ESTABLISHED

A darknet market’s own users are the easiest people to rob.
Blockchain tracing and one domain record were enough to find him.
Series link: Case 013 (Silk Road) and Case 035 (Hydra).
🏠 HOME📁 CASES🚨 WANTED🎮 PLAY🌍 WORLD