Incognito Market's extortion exit: how the FBI caught Pharoah after the leak threats
When Incognito Market went dark in March 2024, its users braced for a routine exit scam. Instead, the darknet drug bazaar resurfaced with a threat: pay us, or your entire purchase history goes public. Federal prosecutors would eventually trace that ultimatum to a 23-year-old student in Taiwan.
A marketplace built on anonymity
Incognito Market launched in October 2020 and grew into one of the largest narcotics bazaars on the Tor network, facilitating more than $100 million in illegal drug sales over roughly 41 months. According to the Justice Department, servers examined during the probe held data on about 255,000 customer accounts, more than 1,300 vendors, and some 224,000 completed transactions. The site mimicked legitimate e-commerce, down to an escrow wallet system users knew as the Incognito Bank. It collected a 5 percent commission on every sale, which prosecutors say earned owner Rui-Siang Lin at least $4.1 million in personal profit. By summer 2023, monthly sales were approaching $5 million.The exit scam becomes a shakedown
Trouble began in February 2024, when users reported they could no longer withdraw funds. Administrators blamed server updates, but the money was already gone. Days later, the homepage returned with a blackmail message that KrebsOnSecurity documented in full."We have accumulated a list of private messages, transaction info and order details over the years," the message read. "Your messages and transaction IDs were never actually deleted after the 'expiry'....SURPRISE SURPRISE!!! And yes, this is an extortion!!!!"Vendors were told to pay $100 to $20,000, tiered by seller level, for a place on a whitelist portal promising to purge their records. Refusers were warned their data would appear in a dump of 557,000 orders and 862,000 cryptocurrency transaction IDs scheduled for the end of May. Buyers were promised access to the portal weeks later, at doubled prices.
How the FBI unmasked Pharoah
Lin ran the market under the alias Pharoah, sometimes shortened to faro. His undoing, as Andy Greenberg reported for Wired, rested less on blockchain wizardry than on ordinary operational security failures. In January 2024, the FBI obtained a warrant for one of Incognito's central servers. That server held a bitcoin wallet which, investigators allege, Lin had also used to pay registrar Namecheap for four websites, including one that tracked which darknet markets were online. Those domains were registered under his real name. Correlations between subsequent bitcoin-to-monero swaps then pointed agents to a crypto exchange account, likewise opened under his own identity. Court records show Lin admitted after his arrest that he had operated as Pharoah and acknowledged running the $100 million enterprise. Strangely, the alleged kingpin had spent his final months rebranding as a blockchain forensics professional, even announcing a Chainalysis Reactor certification on LinkedIn days before agents closed in.Arrest at the airport gate
Agents arrested Lin at New York's John F. Kennedy Airport on May 18, 2024, as he arrived on a flight from St. Lucia, where he had worked as an IT staffer at Taiwan's technical mission. He carried a ticket onward to Singapore via Taipei. Manhattan prosecutors charged him with operating a continuing criminal enterprise, narcotics conspiracy, and money laundering. Attorney General Merrick Garland described Lin as the architect of a $100 million dark web drug operation, per the Homeland Security Investigations release. Lin pleaded guilty in December 2024. In early 2026 a federal judge sentenced him to 30 years in prison and ordered forfeiture exceeding $105 million.Why the extortion exit matters
Darknet markets collapse constantly, and most die as simple exit scams, draining user wallets before vanishing. Incognito added a second act: weaponizing years of order histories, private messages, and transaction IDs against the customers who trusted its protections. Many victims had relied on the site's auto-encrypt feature, apparently unaware the operator retained decryption keys.- Marketplace auto-encrypt tools are only as trustworthy as the operator holding the keys.
- An exit scam can escalate into data extortion once a market has stockpiled years of logs.
- Registrar records, reused wallets, and exchange paperwork routinely unravel darknet identities.