Arrested earlier this year, McCann allegedly shipped over 10 2kilograms of fentanyl and over 300,000 counterfeit Xanax pills every month. One particularly revealing moment came in February 2024, when Incognito users reported that BTC withdrawals were disabled—likely part of a deliberate “exit scam.” Lin, or others acting on his behalf, threatened to leak vendor identities to law enforcement unless paid. That extortion threat, combined with increased tracing and investigative pressure, led many users to flee the platform, dramatically reducing deposits and facilitating law enforcement’s final takedown. Described by Attorney General Pam Bondi as a historic blow to the digital drug trade, the operation targeted individuals in the United States, Austria, Brazil, France, Germany, the Netherlands, South Korea, Spain, Switzerland, and the United Kingdom. It marks the most significant JCODE operation to date, building on years of enforcement actions and marketplace takedowns, including Kingdom Market, Tor2Door, Bohemia, and Nemesis.
Defy Security Appoints Esteemed Cybersecurity Leader Gary Warzala To Its Board Of Directors
The admin arrested by the Dutch police earlier this year has appeared before the Rotterdam court today, but the litigation process is still in its early pre-trial phases. At its peak, in September 2023, Bohemia/Cannabia generated over 12 million Euros ($13.1M) in revenue. The marketplace reportedly added 82,000 advertisements daily and facilitated 67,000 transactions every month. He recommends verifying market employees carefully, and to weed out law enforcement infiltration through barium meal tests. It seized 50.8 million euros ($53.4 million) in cash and virtual currencies, 850 kilograms of drugs, and 117 firearms were seized in a series of raids in several countries. This operation is considered to be even more successful than previous ones codenamed DisrupTor (2020) and Dark HunTor (2021), with 179 and 150 arrests, respectively.
US Department Of The Treasury
But with blockchain intelligence advancing and global partnerships strengthening, law enforcement is better positioned than ever to detect, disrupt, and dismantle these operations. In an extraordinary twist, Lin had previously worked for Taiwan’s Ministry of Foreign Affairs, where he trained law enforcement officials on the very blockchain analytics techniques used to take down platforms like his own. Domains for Archetyp have since been replaced with a seizure notice, which indicates law enforcement groups across Europe, in addition to the FBI and US Homeland Security, participated in the investigation. The alleged administrator of the marketplace, a 30-year-old German national, was also arrested in Spain.
Justice Department Seizes Major Cybercrime Spot RaidForums
While Monero obscures transaction details, Bitcoin’s traceable blockchain provided law enforcement with critical leads, particularly at the point of off-ramp—when vendors converted crypto into fiat or moved assets through centralized exchanges. That revenue went to fund the site’s operations, including servers and what the DOJ described as “employee” salaries. All transactions were conducted in cryptocurrency—primarily Bitcoin and Monero—allowing customers and vendors to move funds without using traditional financial rails. Monero’s privacy features in particular obscured sender, receiver, and transaction amounts, posing challenges to investigators tracing flows. According to Europol, the resulting takedown took place between June 11 and 13, with the goal of “targeting the platform’s administrator, moderators, key vendors, and technical infrastructure” across the European continent.
In stepped Empire Market which appeared in February 2018 (about 6-7 months after the demise of AlphaBay/Hansa) and soon became the leader of the Western darknet market ecosystem. The fact that its graphical user interface was built to resemble that of AlphaBay was purposely done to instill a sense of familiarity for users who had become accustomed to AlphaBay. In furtherance of Operation RapTOR and in their first action as a JCODE member agency, the Office of Foreign Assets Control (OFAC) additionally sanctioned Behrouz Parsarad, an Iranian national, for his role as the founder and operator of Nemesis Market following seizure of the market. Adding another layer of pressure, the Office of Foreign Assets Control (OFAC) also slapped sanctions on Iranian national Behrouz Parsarad, identified as the operator of the Nemesis marketplace.
Operation RapTor Smashes Global Darknet Drug Rings, Nabs 270 Suspects In Major Fentanyl Sting
The operation targeted Archetyp Market, a platform with over 600,000 users and transactions totaling at least 250 million euros, underscoring the scale and ongoing challenge of illicit drug sales facilitated by anonymizing technologies. Authorities from multiple countries, including Germany, the Netherlands, Spain, Sweden and the United States, worked together to investigate and take down a major online criminal marketplace, demonstrating the need for cross-border efforts to combat cyber-enabled crime. The alleged administrators of the infamous Bohemia and Cannabia dark web marketplaces have been arrested after apparently shuttering the sites and trying to flee with their earnings. A second administrator of Bohemia/Cannabia was arrested in Ireland in the context of the same operation, which leveraged data from the joint international investigation. One of the central76 discussion forums was Reddit’s /r/DarkNetMarkets/,777879 which has been the subject of legal investigation, as well as the Tor-based discussion forum, The Hub. For the first time, FBI agents from all the bureau’s field offices also visited buyers to tell them about the overdose danger of pills sold online, which are often disguised to look like prescription drugs.
Some health professionals such as “DoctorX” provide information, advice and drug-testing services on the darknet.140 The quality of products is attributed to the competition and transparency of darknet markets139 which involve user feedback and reputation features. The seizures, to which ICE Homeland Security Investigations significantly contributed, include more than $200 million in currency and digital assets, over two metric tons of drugs, comprised of 144 kilograms of fentanyl or fentanyl-laced narcotics, and over 180 firearms. In addition, the United States and international law enforcement partners made 270 arrests of dark web vendors, buyers, and administrators in Austria, Brazil, France, Germany, Netherlands, South Korea, Spain, Switzerland, United Kingdom, and the United States. “With this takedown, law enforcement has taken out one of the dark web’s longest-running drug markets, cutting off a major supply line for some of the world’s most dangerous substances,” said Jean-Philippe Lecouffe, Europol’s deputy executive director of operations. Nemesis was established in 2021 and operated as a criminal marketplace on the darknet, an encrypted network within the Internet that can only be accessed with special anonymity-enhancing browsers.
Upon visiting the site via the Tor browser, users were greeted by a graphic interface and prompted to log in with a unique username and password. Inside, buyers could browse thousands of drug listings, many accompanied by reviews and ratings. The platform also featured prescription drug listings falsely marketed as authentic, and some products were outright scams—counterfeit pills advertised as legitimate pharmaceuticals. Earlier this year, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
This hypothesis may sound explainable considering the exit scheme happening in March 2024 with Incognito Marketplace. Therefore, after a month, he began to post images with training provided to some law enforcement agents in order to appear clean on a basic OSINT check or if any traces from Darkweb could lead to him. However, the gambler’s fallacy to conduct an exit scam and extort the loyal members of Incognito may have caused his downfall. Incognito Market had its own “bank,” which allowed its users to deposit cryptocurrency on the site into their accounts. The superseding indictment was announced June 14 by HSI New York Special Agent in Charge Ivan J. Arvelo, acting U.S. Attorney for the Northern District of Illinois Morris Pasqual, FBI Chicago Special Agent in Charge Robert W.
Access Our Coverage Of TRON, Solana And 23 Other Blockchains
Operational security has increased, with mandatory PGP encryption, two-factor authentication, and more frequent use of VPNs and anonymization tools. While this week’s takedown recalls the 2013 shutdown of Silk Road, the evolution of darknet commerce is stark. Silk Road popularized the use of Bitcoin, anonymizing technologies like Tor, and vendor reputation systems.
For over 40 years, PCMag has been a trusted authority on technology, delivering independent, labs-based reviews of the latest products and services. With expert analysis and practical solutions across consumer electronics, software, security, and more, PCMag helps consumers make informed buying decisions and get the most from their tech. From in-depth reviews to the latest news and how-to guides, PCMag is the go-to source for staying ahead in the digital world. Based on a public analysis made by researchers on January 9, 2024, the marketplace had 2,144 users, 237 sellers, 1,102 products, and 1,565 total orders. Lin’s GitHub account describes him as a “backend and blockchain engineer, Monero enthusiast.” This GitHub account has approximately 44 publicly available software coding projects. He has contributed 1,741 times on the platform, and his main projects are related to blockchains, cryptocurrency, and network security.
QUICK LINKS
- The suspected admin of the operations owns property in Hanover and Bucharest too, all of which were searched by domestic law enforcement.
- The alleged administrator of the marketplace, a 30-year-old German national, was also arrested in Spain.
- The Archetyp Market drug marketplace has been targeted by law enforcement in an operation involving takedowns and arrests.
- By preserving and cross-referencing seized data — such as user account details, blockchain forensics, and communications — law enforcement can map wider networks and plan future stings with precision.
- All transactions were conducted in cryptocurrency—primarily Bitcoin and Monero—allowing customers and vendors to move funds without using traditional financial rails.
Even if one of his posts suggests an affinity with the current regime, HUMINT recruitment operations are only sometimes straightforward. Investigation of crypto transactions that led to the arrest of Riu-Siang Lin shows that threat actors and criminals in the underground forums cannot operate alone and without leaving any traces when switching to real life. “Pharao” created the Incognito marketplace when he was just a student, probably trying to make more money.
Meanwhile, users of Archetyp began noticing the site’s main domains were down last week, causing some to suspect the site was facing trouble. It appears law enforcement then sent a message through the Archetyp administrator’s messaging channel, confirming the takedown. Authorities also moved against one moderator and six of the platform’s top vendors in Germany and Sweden.
New LockBit Ransomware Variant Emerges As Most Dangerous Yet
Whilst a great many products are sold, drugs dominate the numbers of listings, with the drugs including cannabis, MDMA, modafinil,108109110 LSD, cocaine, and designer drugs. The months and years after Silk Road’s closure were marked by a greatly increased number of shorter-lived markets as well as semi-regular law enforcement takedowns, hacks, scams and voluntary closures. In total, law enforcement officers seized 47 smartphones, 45 computers, narcotics, and assets worth €7.8 million from all suspects during Operation Deep Sentinel.
Award Winning Cybersecurity
- One defendant in California led an organization that bought fentanyl in bulk, pressed it with methamphetamine into pills and sold millions of them to thousands of people on the dark web, he said.
- On Monday, Europol announced it had dismantled Archetyp Market, which had been around since 2020, making it one of the “most enduring” dark web drug providers, the agency said.
- Europol dismantles major Dark Web drug hub Archetyp in a coordinated international operation that led to multiple arrests.
- This monumental action, part of a joint initiative codenamed Operation Deep Sentinel, was led by German authorities in collaboration with Europol and Eurojust.
- About 300 officers were involved, arresting the 30-year-old German administrator (known by aliases of YosemiteGhostWrite and BigBossChefOfArchetyp/ASNT) in Barcelona and taking down the marketplace’s infrastructure in the Netherlands.
- While darknet demand may not disappear, making supply lines more fragmented and risky raises costs and slows distribution — both of which reduce harm.
One defendant in California led an organization that bought fentanyl in bulk, pressed it into pills with methamphetamine and sold millions of pills to thousands of people on the dark web, he said. Your donation powers investigations that expose organized crime and corruption worldwide. Operation SpecTor spanned nine countries and brought down the illegal dark web marketplace Monopoly Market. According to US prosecutors, 38-year-old Thomas Pavey, aka “Dopenugget,” of Ormond beach, Florida, and 28-year-old Raheim Hamilton, aka “Sydney” and “Zero Angel,” of Suffolk, Virginia, ran Empire Market between 2018 and 2020. During this period, they allegedly facilitated four million underworld transactions valued at more than $430 million by federal prosecutors.
What People Are Saying
The FBI Cleveland Field Office is investigating the case with assistance from the DEA and IRS-CI in Chicago. The Justice Department’s Office of International Affairs and Cybercrime Liaison Prosecutor to Eurojust provided significant assistance. If convicted, Parsarad faces a mandatory minimum penalty of 10 years in federal prison and a maximum penalty of life. District Court for the Eastern District of New York unsealed a superseding indictment charging Volodymyr Viktorovich Tymoshchuk — also known as deadforz, Boba, msfv, and farnetwork… PCMag.com is a leading authority on technology, delivering lab-based, independent reviews of the latest products and services. Our expert industry analysis and practical solutions help you make better buying decisions and get more from technology.
The identities of its 17 million customer accounts and 19,000 vendor accounts were masked by the Tor encryption network. The platform had processed almost $30 million in drug sales prior to its closure last year, amid a backdrop of rising opioid abuse in the U.S., where deaths from fentanyl almost tripled between 2016 and 2021. In addition to dealing in prohibited materials, the indictment also charges Parsarad with offering money laundering services, with Nemesis used to mix the cryptocurrencies used to pay for goods and services. This effort is part of an Organized Crime Drug Enforcement Task Forces (OCDETF) operation. OCDETF identifies, disrupts, and dismantles the highest-level criminal organizations that threaten the United States using a prosecutor-led, intelligence-drive, multi-agency approach.
