Incognito Market
Web3 / compliance
Incognito Market was a Tor-based darknet narcotics marketplace operated from October 2020 until its collapse in March 2024. Unlike a conventional exit scam, the operator first shut down withdrawals and then extorted vendors and customers by threatening to publish unredacted transaction records — names, shipping addresses, and message logs — unless individual payments were made. The episode is the canonical case of administrator extortion in darknet market history.
The operator, Taiwanese national Rui-Siang Lin, who used the handle Pharoah, was arrested at New York's John F. Kennedy International Airport on May 18, 2024 while transiting to Singapore. He pleaded guilty in the Southern District of New York in December 2024 and was sentenced on February 4, 2026 to 30 years in federal prison and ordered to forfeit $105,045,109. US Department of Justice filings documented more than $105 million in narcotics sales across over 640,000 transactions covering more than one metric ton of drugs during the platform's operational life.
Why It Matters
Incognito Market converted the conventional exit-scam threat model into an active deanonymisation attack against the market's own users, demonstrating that administrator-held data is itself a weapon that can be turned against participants. The case strengthened the operational case for end-to-end client-side encryption of order data and for multisig escrow structures that prevent administrators from accumulating either funds or sensitive metadata in a single position.
Definition maintained by Cointegrity. See our editorial policy for review standards on regulatory and compliance terms.
Explore the full Web3 Glossary — 2,085+ expert-curated definitions. Need guidance? Talk to our consultants.