Darkweb vendors arrested on the last 3 months
Executive summary
Over the past three months of available reporting there is no single, consolidated public list of dark‑web vendors arrested; reporting instead highlights specific prosecutions and lingering effects from large multinational operations earlier in 2025 while noting continued law‑enforcement momentum into 2026 [1] [2] [3]. The most concrete named arrest within the supplied material is the alleged operator of the Incognito Market, while broader international sweeps such as Operation RapTor — which arrested hundreds in mid‑2025 — remain the dominant recent enforcement narrative [4] [1].
1. A named arrest that made headlines: the alleged Incognito Market operator
A cybercrime trade article reported the arrest of a 23‑year‑old identified as Rui‑Siang Lin, alleged to operate the Incognito Market and known online as “Pharoah” or “faro,” saying he was arrested at New York’s JFK Airport and appeared in Manhattan federal court [4]. That report framed the arrest as the Justice Department dealing a “blow” to a dark‑web drugs platform that connected customers with vendors rather than selling narcotics directly [4]. The article attributes the disruption to tracking of cryptocurrency payments, a common investigative technique emphasized across other technical writeups and tracing analyses [4] [5].
2. Big multinational sweeps remain the baseline for “who was arrested”
The clearest indicator of scale in recent enforcement comes from Operation RapTor, an international action that the DOJ, Europol and partners said led to 270 arrests of dark‑web vendors, buyers and administrators and millions of euros in seizures — but that operation’s public announcements date to mid‑2025 rather than the immediate three‑month window in early 2026 [1] [2] [3]. Multiple agency statements describe suspects from the U.S., Germany, the U.K., France, South Korea and other countries, and the operation remains a touchstone for how law enforcement characterizes recent activity and outcomes [2] [3].
3. Ongoing prosecutions and CSAM/child‑exploitation knockdowns
Law enforcement press releases point to continued casework and sentencing tied to prior investigations, including prosecutions tied to child sexual abuse material networks and lengthy sentences for managers of a dark‑web site dedicated to CSAM; the DOJ’s Operation Grayskull materials document convictions and international cooperation that produced arrests and domain seizures [6]. Separately, investigative tracing of cryptocurrency has been highlighted in takedowns of CSAM distribution networks involving arrests and infrastructure seizures in multiple countries [5]. These examples show that arrests of specific vendors or administrators often surface embedded within larger, multi‑year investigations rather than as isolated, contemporaneous press events [6] [5].
4. Why reports aren’t a tidy “three‑month arrests” list
Public reporting in the supplied sources does not produce a complete, time‑bounded inventory of vendor arrests specifically in the past three months; instead the record is patchwork: discrete named arrests (Incognito Market) and carryover public accounts of large operations (RapTor) and prosecutions (Grayskull) that span months or years [4] [1] [6]. Cybersecurity analysts note the dark‑web ecosystem’s rapid churn and vendor migration after takedowns, which complicates real‑time tallies: vendors disperse to smaller single‑vendor shops or new markets, and investigators pursue follow‑on arrests over long timelines [7] [8].
5. The reporting gaps and what they imply
Because the provided sources emphasize major coordinated actions and a few high‑profile arrests rather than a rolling public docket of every vendor arrest in a three‑month window, it is not possible from these materials alone to enumerate all dark‑web vendor arrests in the last three months; available reporting signals continued enforcement and the occasional named arrest but leaves open numerous unreported or still‑sealed cases [4] [1] [2]. To produce a full list would require access to contemporaneous indictments, local court filings, or aggregated law‑enforcement press releases beyond the supplied items.