What darkweb vendors were recently arrested or busted
Executive summary
A major multinational enforcement campaign in 2025—Operation RapTor—resulted in the arrests of roughly 270 darknet vendors, buyers, and administrators across multiple continents, alongside seizures of cash, cryptocurrencies, and large quantities of drugs and weapons [1] [2] [3]. In parallel, targeted investigations produced high-profile arrests of specific marketplace operators and alleged administrators, including the alleged owner of Incognito Market, Rui‑Siang Lin, and separate actions against marketplace administrators and a CSAM network operator [4] [5] [6] [7].
1. Operation RapTor: the sweep that netted hundreds and reshaped the supply chain
Operation RapTor was a coordinated international effort led by JCODE, Europol and partner agencies that identified and arrested about 270 individuals tied to dark web markets—vendors, buyers, and administrators—in at least ten countries and seized more than €184 million in cash and crypto, over two tonnes of drugs, firearms and other contraband, a haul officials described as a significant disruption to criminal supply chains [1] [2] [3] [8]. Law enforcement framed RapTor as intelligence-driven, leveraging prior marketplace seizures (Nemesis, Tor2Door, Bohemia and Kingdom) to trace vendor activity; prosecutors also highlighted prolific individual vendors who collectively fulfilled thousands of orders and shipped drugs across borders [8] [2].
2. High-profile operator arrests: Incognito Market and the rise of attribution by following crypto flows
One of the clearest single‑actor successes publicized was the arrest of Rui‑Siang Lin, alleged owner of Incognito Market and known online as “Pharoah” or “Faro,” arrested in New York after authorities tracked cryptocurrency flows; U.S. prosecutors say the platform facilitated millions—allegedly more than $100 million—of narcotics sales and that Lin oversaw marketplace operations and vendor relationships [4] [5]. Authorities emphasized cryptocurrency analysis and international cooperation in building cases, underscoring the investigative shift from anonymized storefronts to real‑world identities through financial tracing [4] [5].
3. Individual vendor prosecutions and named suspects in wider operations
Beyond marketplace owners, court filings and agency summaries name individual vendor operators allegedly responsible for very large volumes of sales: prosecutors cited Joshua and Joseph Vasquez as running prolific vendor accounts NuveoDeluxe and AllStateRx and Gregory Castillo‑Rosario as another major seller arrested earlier—illustrating that RapTor targeted both platform administrators and top sellers with thousands of transactions attributed to them [2]. The Department of Justice and Europol reported these names as part of broader indictments describing fulfillment of over 13,000 orders and the conversion of crypto proceeds into real‑world assets [2].
4. Other takedowns: CSAM networks and foreign marketplace admins
Separate but related enforcement lines targeted non‑drug marketplaces and criminal networks: an international probe dismantled a long‑running CSAM distribution network, resulting in the seizure of infrastructure and the arrest of an alleged administrator, a Peruvian national in Brazil, after tracing cryptocurrency transactions [7]. Reporting also documented arrests and indictments of Russian marketplace administrators seized in U.S. actions—illustrating that operations span narcotics, CSAM and broader illicit services across jurisdictions [6] [7].
5. What this does — and doesn’t — mean for the dark web economy
Officials portray these arrests as a major blow to darknet commerce and a message that anonymity can be pierced through cross‑border cooperation and crypto tracing, but analysts warn ecosystem resilience: marketplaces fragment, vendors migrate, and exit scams or rebrands rapidly absorb displaced actors, so arrests of hundreds do not eliminate illicit trade but shift its contours [9] [10]. Open reporting and law enforcement statements list aggregated arrest numbers and several named operators, but publicly available sources do not provide a comprehensive roster of every vendor arrested; the emphasis in official releases is on aggregate impacts, notable defendants, and seizures rather than exhaustive vendor-by-vendor catalogs [1] [2] [3].
6. Motives, messaging and potential agendas in public reporting
Law enforcement releases underscore cooperation and technical prowess—narratives that justify continued funding for cyber and narcotics units—while independent outlets highlight the scale and material seizures as operational wins; cybersecurity commentators, conversely, point to marketplace churn and the likelihood of rapid reconstitution under new identities as caveats to claims of lasting disruption [3] [9] [10]. Reporting therefore blends factual tallies (arrest counts, seizures, named defendants) with strategic messaging from agencies and analysts’ caveats about displacement effects and the limits of enforcement alone [2] [9].