Rui-Siang Lin: The Double Life of a Darknet Kingpin and IT Specialist

The US police have arrested the operator of the Darknet market Incognito at an airport in New York. Rui-Siang Lin, who operated under the alias „Pharaoh,“ led an unusual and astonishingly busy double life.

US police have arrested the operator of the Darknet market Incognito at an airport in New York. The 23-year-old Taiwanese national, operating under the alias “Pharaoh,” had been running the marketplace since the end of 2020, through which drugs worth approximately $100 million had been sold, including hundreds of kilograms of cocaine and methamphetamine.

Despite earning substantial amounts from the Incognito market – six-figure sums per month last year – Rui-Siang continued to work by day as an IT specialist at the Embassy of St. Lucia in Taipei. In this role, he also trained police officers from the Caribbean country on “Cyber Crime and Cryptocurrency.”

During the four-day training, government officials comically mentioned in a retrospective press release, 30 police officers acquired in-depth knowledge about cryptocurrencies and their use on the Darknet. The course leader, Rui-Siang Lin, “leveraged his professional background and qualifications” to enhance the police officers' ability to combat cybercrime.

Indeed, Lin, who is evidently highly talented, likely possessed such qualifications. Around the same time, he founded the web service Antinalysis, a tool for on-chain transaction analysis. However, it was explicitly not intended to detect money laundering but rather to help avoid detection.

“Our goal is not to aid the surveillance autocracy of government intelligence agencies,” he wrote as Pharaoh in a Darknet forum. “This service is dedicated to individuals who have a need for complete privacy on a blockchain.”

This included the users of his marketplace Incognito. Under expert scrutiny, it was known for its high-security standards. Anyone wishing to conduct transactions had to complete an OPSEC quiz (“Operational Security”) and demonstrate proficiency with the encryption protocol PGP. Payments were allowed in Bitcoin and Monero, the user interface was clear, and only drugs were traded, excluding the notorious fentanyl.

In the summer of 2023, Incognito became increasingly popular, with trading volume reaching five million dollars per month. However, in March this year, Rui-Siang shut down the site.

The Taiwanese did not settle for the classic exit scam of taking the Bitcoin and Monero from the platform. He went a step further, blackmailing users by claiming he had stored their messages and transactions. Those who did not “unlock” themselves by the end for a fee of $20,000 would have their information leaked online.

“YES, THIS IS EXTORTION!!!“

Rui-Siang evidently attempted to cash out before exiting the Darknet entirely to focus on his legitimate career with well-filled wallets. Just a week before his arrest, he boasted on LinkedIn about receiving certification for Reactor Analysis from the blockchain analyst firm Chainalysis.

Despite all his efforts, Lin failed to maintain his anonymity. Perhaps his double life became too demanding, or it was the hubris of a brilliant mind – by the time he started blackmailing his former users and taking courses at Chainalysis, the noose around his neck had already tightened.

The FBI had gained access to one of the Incognito servers in January, discovering a Bitcoin wallet Lin had used – unbelievably – to purchase four additional domains via Namecheap, registered under his real name.

The Taiwanese did attempt to swap his Bitcoins for Monero, but due to the timing and amount, the FBI could track the transactions to an exchange. There, Lin had an account under his real name. His balance there had grown to about five million dollars over the course of 2023.

Now, he faces a potential life sentence for various drug and cybercrime-related offenses.