Incognito Market: Exit Scam, Extortion, Trial
Incognito ran from 2020 to March 2024, then the admin stole balances and threatened to leak user data. SDNY: $105M, a 2024 plea, 30 years in February 2026.
Most exit scams end with silence: withdrawals die, the onion dies, the money is gone. Incognito Market added a second act. After the operator kept user balances in March 2024, he demanded more money and threatened to publish order histories and wallet addresses. The US Attorney's Office for the Southern District of New York later described a drug market with more than $105 million in sales, a guilty plea, and — on 3 February 2026 — a 30-year sentence. The case is useful because it is documented, not because it is a template you should imitate.
Key facts (from SDNY and contemporaneous reporting)
| Lifespan | October 2020 – March 2024 |
| Alleged operator | Rui-Siang Lin, Taiwan; handle "Pharaoh" / "Pharoah" in coverage |
| Scale (prosecution figures) | 400,000+ buyer accounts, 1,800+ vendors, 640,000+ transactions, $105M+ in narcotics sales |
| Collapse | Exit with retained balances (prosecutors: at least $1M) plus extortion of users |
| Arrest | May 2024, JFK Airport, New York |
| Plea | 16 December 2024 |
| Sentence | 3 February 2026 — 30 years; forfeiture around the $105M figure |
Lin, per the government, took over running the market around January 2022 and opened the door to opioid listings. Undercover buys of tablets sold as oxycodone came back as fentanyl. Prosecutors tied a US death to one of those purchases. Those are charging facts, not a chemical survey of the catalog.
The market, briefly
Incognito was an English-language drug market on Tor, in the same ecological slot as the shops in our markets overview. It used custodial balances — the design escrow exists to police, and that wallet-less shops exist to avoid. If the operator can move the pot, the pot is the exit. That is Empire in 2020. Incognito's twist was to weaponize the database after the pot was empty.
Exit, then extortion
In March 2024 the service went down and balances did not come back. Users then received a threat that is easy to understand if you have ever thought about what a market stores: every order, every shipping note, every refund chat, every withdrawal address. Pay, or those rows go public.
That is a different risk from a phishing clone. The data was collected in the ordinary course of running the shop. Anyone who later holds the disk — the operator, a hacker, or a seizing agency — can run the same play. Scam-pattern taxonomies should have a line for it; most still file Incognito under "exit" and miss the extra squeeze.
How identification happened
Public court and press accounts describe a boring OPSEC failure: a domain payment tied to a wallet at a KYC exchange in the operator's real identity. Graph plus subpoena, not a break of Tor. The same class of mistake shows up in the OPSEC case file (Cazes, Ulbricht). Bitcoin's public ledger made the join easier; see what that chain reveals.
The arrest at JFK in May 2024 put a person in the dock. The December plea removed the need for a trial on guilt. The February 2026 sentence is the part most English-language write-ups still have not caught up to if they were frozen in 2024.
What the case changes in the timeline
Market takedowns are usually seizures: Operation Bayonet, Hydra, DarkMarket. The state takes the servers. Incognito is closer to Empire (operator-led theft) with a prosecution that actually landed. It also shows why "I have nothing to hide on a market account" is a weak story: the account is the dossier.
After the collapse, buyers and vendors did what they always do — they moved. Abacus, which ate some of that traffic, had its own messy end in 2025; that is a different profile. The lesson that travels is about custody and data, not about a particular onion.
For researchers the sentencing memo is the primary source, not forum lore. SDNY's February 2026 press release is public, names the counts, and gives the $105 million forfeiture figure. Secondary write-ups (The Record, Security Affairs) mostly repeat that release. Where they disagree with 2024-era blogs — especially on whether anyone was arrested — believe the court. The older "admins vanished and that was the end" version is incomplete.
Compared with Hydra or DarkMarket, there is no large public story here about police running the shop as a honeypot. The harm to users was operator-led: first the balances, then the threat to publish. That is why the case sits next to Empire in our exit-scam file and next to the takedown timeline only for the arrest, not for a server seizure in March 2024.
Frequently Asked Questions
What was Incognito Market?
An English-language Tor drug market that ran from October 2020 until March 2024. US prosecutors described more than $105 million in sales and charged its operator with running a continuing criminal enterprise and related narcotics and money-laundering counts.
How was this exit different from Empire's?
Empire's admins disappeared with the escrow pot. Incognito's operator, after taking balances, also tried to extort users with their own order data. The theft is familiar; the ransom on the database is the extra move.
Who is Rui-Siang Lin?
The man SDNY named as the Incognito administrator, known online as Pharaoh. Arrested at JFK in May 2024, pleaded guilty in December 2024, sentenced to 30 years in February 2026. Details of the investigation sit in the government's press releases and the sentencing coverage.
Did users get money back?
There is no general restitution story in the public materials that resembles a refund. Forfeiture in these cases goes to the government, not back into market balances. That matches older seizures more than it matches a consumer chargeback.