United States v. RUI-SIANG LIN, Southern District of New York (May 20, 2024) — Complaint

Warning: TT: undefined function: 3


AUSA: Ryan Finkel 
UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 
UNITED STATES OF AMERICA 
v. 
RUI-SI
ANG LIN, 
     a/k/a “林睿庠,” 
Def
endant. 
      SEALED COMPLAINT 
      Violations of 18 U.S.C. §§ 371, 1956, and 
      2; and 21 U.S.C. §§ 846, 848 
      COUNTY OF OFFENSE: 
      NEW YORK 
SOUTHERN DISTRICT OF NEW YORK, ss.: 
Ma
rk Rubins, being duly sworn, deposes and says that he is a Task Force Officer with the 
Federal Bureau of Investigation (“FBI”), and charges as follows: 
COUNT ONE 
(Continuing Criminal Enterprise) 
1.From
 at least in or about October 2020, up to and including on or about the date of
the filing of this Complaint, in the Southern District of New York, and elsewhere, RUI-SIANG 
LIN, 
a/k/a “林睿庠,” the defendant, engaged in a continuing criminal enterprise (the “Continuing 
Criminal Enterprise”), in that LIN knowingly and intentionally participated in a continuing series 
of violations of Title 21, United States Code, Chapter 13, Subchapters I and II, including, among 
others, Violations One through Four set forth below, undertaken by LIN in concert with at least 
five  other  persons  with  respect  to  whom  LIN  occupied  a  position  of  principal  administrator, 
organizer, a supervisory position, and leader of the Continuing Criminal Enterprise, and  (a) from 
which continuing  series  of  violations LIN and  the  Continuing  Criminal  Enterprise  obtained 
substantial income and resources, in excess of $10 million and more in gross receipts during a 12-
month period of its existence for the manufacture, importation, and distribution of cocaine, heroin, 
LSD, and methamphetamine; and (b) which continuing series of violations involved at least 300 
times the quantity of mixtures and substances containing a detectable amount of cocaine, lysergic 
acid  diethylamide  (“LSD”)  ,  and  methamphetamine,  its  salts,  isomers,  or  salts  of  its  isomers, 
described in Title 21, United States Code, Section 841(b)(1)(B). 
Violation One 
2.From at least in or about October 2020, up to and including on or about the date of
the filing of this Complaint, in the Southern District of New York, and elsewhere, RUI-SIANG 
LIN, a/k/a “林睿庠,” the defendant, and others known and unknown, intentionally, and knowingly 
did  combine,  conspire,  confederate,  and  agree  together  and  with  each  other  to  distribute  and  
possess  with  intent  to  distribute  were  (i)  five  kilograms  and  more  of  mixtures  and  substances  
containing a detectable amount of cocaine, in violation of Title 21, United States Code, Section 
841(b)(1)(A);  (ii)  one  kilogram  and  more  of  mixtures  and  substances  containing  a  detectable  
24
 MAG 351

2 
 
amount  of  heroin,  in  violation  of  Title  21,  United  States  Code,  Section  841(b)(1)(A);  (iii)  500  
grams and more of mixtures and substances containing a detectable amount of methamphetamine, 
its  salts,  isomers,  or  salts  of  its  isomers,  in  violation  of  Title  21,  United  States  Code,  Section  
841(b)(1)(A); (iv) 10 grams and more of mixtures and substances containing a detectable amount 
of  lysergic  acid  diethylamide  (LSD),  in  violation  of  Title  21,  United  States  Code,  Section  
841(b)(1)(A); (v) 100 kilograms or more of a mixture or substance containing a detectable amount 
of marihuana in violation of Title 21, United States Code, Section 841(b)(1)(B); (vi) mixtures and 
substances containing a detectable amount of Oxycodone, in violation of Title 21, United States 
Code,  Section  841(b)(1)(C);  (vii)  mixtures  and  substances  containing  a  detectable  amount  of  
ketamine, in violation of Title 21, United States Code, Section 841(b)(1)(C); (viii) mixtures and 
substances containing a detectable amount of Methylenedioxymethamphetamine (“MDMA”), in 
violation  of  Title  21,  United  States  Code,  Section  841(b)(1)(C));  (ix)  mixtures  and  substances  
containing  a  detectable  amount  of  amphetamine,  in  violation  of  Title  21,  United  States  Code,  
Section 841(b)(1)(C); (x) mixtures and substances containing a detectable amount of fentanyl, in 
violation of Title 21, United States Code, Section 841(b)(1)(C), and 846. 
 
Violation Two 
 
3. From at least in or about October 2020, up to and including on or about the date of 
the filing of this Complaint, in the Southern District of New York, and elsewhere, RUI-SIANG 
LIN, a/k/a “林睿庠,” the defendant, and others known and unknown, intentionally, and knowingly 
did  combine,  conspire,  confederate,  and  agree  together  and  with  each  other  to  (i)  import  a  
controlled substance into the United States and into the customs territory of the United States from 
a  place  outside  thereof,  (ii)  manufacture,  distribute,  and  possess  with  intent  to  distribute  a  
controlled  substance,  intending,  knowing,  and  having  reasonable  cause  to  believe  that  such  
substance would be unlawfully imported into the United States and into waters within a distance 
of  12  miles  of  the  coast  of  the  United  States,  which  controlled  substances  were  mixtures  and  
substances    containing    a    detectable    amount    of    heroin, cocaine,    methamphetamine, 
Methylenedioxymethamphetamine (“MDMA”),  and  LSD  in  violation  of  Title  21,  United  States 
Code, Sections 952(a), 959(a), 960(a)(1), 960(a)(3), 960(b)(3), and 963.   
 
Violation Three 
  
4. On or about February 7, 2023, in the Southern District of New York, and elsewhere, 
RUI-SIANG  LIN,  a/k/a  “林睿庠,”  the  defendant,  knowingly  and  intentionally  distributed  and  
possessed  with  intent  to  distribute  a  controlled  substance,  to  wit,  mixtures  and  substances  
containing a detectable amount of fentanyl, in violation of Title 21, United States Code, Sections 
841(a)(1) and 841(b)(1)(C), and Title 18, United States Code, Section 2. 
 
Violation Four 
 
5. From at least in or about October 2020, up to and including on or about the date of 
the filing of this Complaint, in the Southern District of New York, and elsewhere, RUI-SIANG 
LIN, a/k/a “林睿庠,” the defendant, delivered, distributed, and dispensed controlled substances by 
means of the Internet, in a manner not authorized by law, and aided and abetted such activity, in 
violation  of  Title  21,  United  States  Code,  Sections  841(h)
 ,  and  Title  18,  United  States  Code,  
Section 2. 

3 
6.T
he  controlled  substances  that  RUI-SIANG  LIN,  a/k/a  “林睿庠,”  the  defendant,
delivered, distributed, and dispensed by mean of the Internet, were (i) five kilograms and more of 
mixtures and substances containing a detectable amount of cocaine, in violation of Title 21, United 
States  Code,  Section  841(b)(1)(A);  (ii)  one  kilogram  and  more  of  mixtures  and  substances  
containing  a  detectable  amount  of  heroin,  in  violation  of  Title  21,  United  States  Code,  Section  
841(b)(1)(A); (iii) 500 grams and more of mixtures and substances containing a detectable amount 
of  methamphetamine,  its  salts,  isomers,  or  salts  of  its  isomers,  in  violation  of  Title  21,  United  
States Code, Section 841(b)(1)(A); (iv) 10 grams and more of mixtures and substances containing 
a detectable amount of lysergic acid diethylamide (LSD), in violation of Title 21, United States 
Code,  Section  841(b)(1)(A);  (v)  100  kilograms  or  more  of  a  mixture  or  substance  containing  a  
detectable amount of marihuana in violation of Title 21, United States Code, Section 841(b)(1)(B); 
(vi) mixtures and substances containing a detectable amount of Oxycodone, in violation of Title
21,  United  States  Code,  Section  841(b)(1)(C);  (vii)  mixtures  and  substances  containing  a
detectable amount of ketamine, in violation of Title 21, United States Code, Section 841(b)(1)(C);
(viii) mixtures and substances containing a detectable amount of MDMA, in violation of Title 21,
United States Code, Section 841(b)(1)(C)); (ix) mixtures and substances containing a detectable
amount of amphetamine, in violation of Title 21, United States Code, Section 841(b)(1)(C); (x)
mixtures and substances containing a detectable amount of fentanyl, in violation of Title 21, United
States Code, Section 841(b)(1)(C).
(Title 21, United States Code, Section 848(a), 848(b), 848(c).) 
COUNT TWO 
(Narcotics Conspiracy) 
7.From at least in or about October 2020, up to and including on or about the date of
the filing of this Complaint, in the Southern District of New York, and elsewhere, RUI-SIANG 
LIN, a/k/a “林睿庠,” the defendant, and others known and unknown, intentionally, and knowingly 
did combine, conspire, confederate, and agree together and with each other to violate the narcotics 
laws of the United States. 
8.It was a part and an object of the conspiracy that RUI-SIANG LIN, a/k/a “林睿庠
,” the defendant, and others known and unknown, would and did distribute and possess with intent 
to distribute a controlled substance, in violation of Title 21, United States Code, Section 841(a)(1). 
9.T
he  controlled  substances  that  RUI-SIANG  LIN,  a/k/a  “林睿庠,”  the  defendant,
conspired to distribute and possess with intent to distribute were (i) five kilograms and more of 
mixtures and substances containing a detectable amount of cocaine, in violation of Title 21, United 
States  Code,  Section  841(b)(1)(A);  (ii)  one  kilogram  and  more  of  mixtures  and  substances  
containing  a  detectable  amount  of  heroin,  in  violation  of  Title  21,  United  States  Code,  Section  
841(b)(1)(A); (iii) 500 grams and more of mixtures and substances containing a detectable amount 
of methamphetamine,  its  salts,  isomers,  or  salts  of  its  isomers,  in  violation  of  Title  21,  United  
States Code, Section 841(b)(1)(A); (iv) 10 grams and more of mixtures and substances containing 
a detectable amount of lysergic acid diethylamide (LSD), in violation of Title 21, United States 
Code,  Section  841(b)(1)(A);  (v)  100  kilograms  or  more  of  a  mixture  or  substance  containing  a  
detectable amount of marihuana in violation of Title 21, United States Code, Section 841(b)(1)(B); 

4 
 
(vi) mixtures and substances containing a detectable amount of Oxycodone, in violation of Title 
21,  United  States  Code,  Section  841(b)(1)(C);  (vii) mixtures  and  substances  containing  a  
detectable amount of ketamine, in violation of Title 21, United States Code, Section 841(b)(1)(C); 
(viii)        mixtures        and        substances        containing        a        detectable        amount        of        
Methylenedioxymethamphetamine  (“MDMA”),  in  violation  of  Title  21,  United  States  Code,  
Section   841(b)(1)(C));   (ix)   mixtures   and   substances   containing   a   detectable   amount   of   
amphetamine, in violation of Title 21, United States Code, Section 841(b)(1)(C); (x) mixtures and 
substances containing a detectable amount of fentanyl, in violation of Title 21, United States Code, 
Section 841(b)(1)(C).   
 
(Title 21, United States Code, Section 846) 
 
COUNT THREE 
(Money Laundering - Concealment) 
 
10. From at least in or about October 2020, up to and including on or about the date of 
the filing of this Complaint, in the Southern District of New York, and elsewhere, RUI-SIANG 
LIN, a/k/a “林睿庠,” the defendant, knowing that the property involved in a financial transaction 
represented the proceeds of some form of unlawful activity, would and did conduct and attempt to 
conduct such a financial transaction, which transaction affected interstate and foreign commerce 
and involved the use of a financial institution which was engaged in, and the activities of which 
affected  interstate  and  foreign  commerce,  and  which  in  fact  involved  the  proceeds  of  specified  
unlawful activity, to wit, narcotics trafficking, and conspiracy to commit narcotics trafficking, in 
violation  of  Title  21,  United  States  Code,  Sections  841 and  846,  respectively,  knowing  that  the  
transaction was designed in whole and in part to conceal and disguise the nature, the location, the 
source, the ownership, and the control of the proceeds of specified unlawful activity.  
 
(Title 18, United States Code, Section 1956(a)(1)(B)(i), and 2) 
 
COUNT FOUR 
(Money Laundering - Promotional) 
 
11. From at least in or about October 2020, up to and including on or about the date of 
the filing of this Complaint, in the Southern District of New York, and elsewhere, RUI-SIANG 
LIN, a/k/a “林睿庠,” the defendant, would and did transport, transmit, and transfer, and attempt 
to transport, transmit, and transfer, a monetary instrument and funds from a place in the United 
States to and through a place outside the United States and to a place in the United States from and 
through a place outside the United States, with the intent to promote the carrying on of specified 
unlawful activity, to wit, narcotics trafficking, and conspiracy to commit narcotics trafficking, in 
violation of Title 21, United States Code, Sections 841 and 846, respectively. 
 
(Title 18, United States Code, Section 1956(a)(2)(A), and 2) 
 

5 
 
COUNT FIVE 
(Money Laundering Conspiracy) 
 
12.  From at least in or about October 2020, up to and including on or about the date of 
the filing of this Complaint, in the Southern District of New York, and elsewhere, RUI-SIANG 
LIN,  a/k/a  “林睿庠,”  the  defendant,  and  others  known  and  unknown,  willfully  and  knowingly 
combined,  conspired,  confederated,  and  agreed  together  and  with  each  other  to  commit  money  
laundering,   in   violation   of   Title   18,   United   States   Code,   Sections   1956(a)(1)(B)(i),   and   
1956(a)(2)(A). 
 
13. It was a part and an object of the conspiracy that RUI-SIANG LIN, a/k/a “林睿庠
,” the defendant, and others known and unknown, knowing that the property involved in a financial 
transaction  represented  the  proceeds  of  some  form  of  unlawful  activity,  would  and  did  conduct  
and  attempt  to  conduct  such  a  financial  transaction,  which  transaction  affected  interstate  and  
foreign commerce and involved the use of a financial institution which was engaged in, and the 
activities  of  which  affected,  interstate  and  foreign  commerce,  and  which  in  fact  involved  the  
proceeds  of  specified  unlawful  activity,  to  wit, narcotics  trafficking, and  conspiracy  to  commit  
narcotics  trafficking,  in  violation  of  Title  21,  United  States  Code,  Sections  841 and  846,  
respectively,  knowing  that  the  transaction  was  designed  in  whole  and  in  part  to  conceal  and  
disguise  the  nature,  the  location,  the  source,  the  ownership,  and  the  control  of  the  proceeds  of  
specified unlawful activity in violation of Title 18, United States Code, Sections 1956(a)(1)(B)(i). 
 
14. It was further a part and an object of the conspiracy that RUI-SIANG LIN, a/k/a “
林睿庠,” the defendant, and others known and unknown, would and did transport, transmit, and 
transfer, and attempt to transport, transmit, and transfer, a monetary instrument and funds from a 
place in the United States to and through a place outside the United States and to a place in the 
United States from and through a place outside the United States, with the intent to promote the 
carrying on of specified unlawful activity, to wit, narcotics trafficking, and conspiracy to commit 
narcotics  trafficking,  in  violation  of  Title  21,  United  States  Code,  Sections  841 and  846,  
respectively, in violation of Title 18, United States Code, Section 1956(a)(2)(A). 
 
(Title 18, United States Code, Section 1956(h).) 
 
COUNT SIX 
(Conspiracy to Sell Adulterated and Misbranded Medication) 
 
15. From at least in or about October 2020, up to and including on or about the date of 
the filing of this Complaint, in the Southern District of New York, and elsewhere, RUI-SIANG 
LIN,  a/k/a  “林睿庠,”  the  defendant,  and  others  known  and  unknown  willfully  and  knowingly 
combined, conspired, confederated, and agreed together and with each other to commit offenses 
against the United States, to wit, selling adulterated and misbranded drugs in violation of Title 21, 
United States Code, Sections 331, 333(a)(2). 
 
16. It was a part and an object of the conspiracy that RUI-SIANG LIN, a/k/a “林睿,” 
the defendant, and others known and unknown with the intent to defraud and mislead, would and 
did introduce and deliver for introduction into interstate commerce, and attempt to do the same, 
and would and did cause the introduction and delivery for introduction into interstate commerce, 

6 
 
and  attempt  to  do  the  same,  of  adulterated  and  misbranded  drugs,  as  defined  by  21  U.S.C.  §§  
351(a)(1), 351(a)(3), 352(a), 352(b), 352(f), and 352(o), in violation of 21 U.S.C. §§ 331(a) and 
333(a)(2),  333(i) to  wit,  LIN  and  others  known  and  unknown  sold  misbranded  and  counterfeit 
medication over the internet.  
 
Overt Acts 
 
17. In furtherance of the conspiracy and to effect its illegal objects, RUI-SIANG LIN, 
a/k/a “林睿,” the defendant, and others known and unknown, committed the following overt acts, 
among others, in the Southern District of New York and elsewhere: 
 
a. On  or  about  December  5,  2023, in  the  Southern  District  of  New  York,  law 
enforcement  officers  received  five  tablets,  which  were  purchased  on an online  narcotics  
marketplace operated by LIN and shipped by the seller on the online narcotics marketplace to an 
address  in  the  Southern  District  of  New  York.    Those  five  tablets  bore  the  mark  of  a  particular  
licensed  pharmaceutical  manufacturer,  but  those  five  tablets  were  not,  in  fact,  produced  by that 
licensed manufacturer.   
 
(Title 18, United States Code, Section 371.) 
 
The bases for my knowledge and for the foregoing charges are, in part, as follows: 
 
Overview 
 
18. Based  on  my  involvement  in  this  investigation,  my  training  and  experience,  my 
review  of  documents  and  other  materials,  as  well  as  my  conversations  with  law  enforcement  
officers and others, I have learned the following, among other things:   
 
a. RUI-SIANG LIN, a/k/a “林睿庠,” the defendant, is the principal administrator and 
operator of one of the largest illegal narcotics marketplaces on the internet (“Marketplace-1”).   LIN 
oversees  the  day-to-day  operation  of  Marketplace-1,  which  has  sold tens  of  millions  of  dollars’  
worth of heroin, cocaine, methamphetamine, LSD, and other illegal narcotics.  As the principal 
administrator of Marketplace-1, LIN has ultimate control over more than one thousand vendors 
(those  who  sell  narcotics  on  Marketplace-1), more  than  200,000 customers  (those  who  buy  
narcotics on Marketplace-1), and at least one other employee who assists LIN in the management 
of the site.     
 
b. Marketplace-1 launched  in  or  about  October  2020.    Since  that  time,  and  through  
the date of this Complaint, Marketplace-1 can be accessed via the Internet using widely available 
encrypted and anonymous internet browsing software known as the “Tor” web browser.
1
  Using 
 
1
  A  Tor  web  browser  allows  individuals  to  access  the  Onion  Router  (“Tor”)  network  
sometimes known as the “darkweb” or “darknet.”   Tor allows individuals to obscure their true IP 
addresses and their Internet traffic, by encrypting both the content of their internet traffic and the 
signaling  information,  and  by directing  that  internet  traffic  to  and  from  web  sites  on  the  Tor  
network through a series of intermediary relays.  Although the Tor network has legitimate uses, 
based on my training and experience, I have learned that the Tor network is often used for criminal 

7 
 
that  software,  Marketplace-1  can  be  accessed  from  anywhere  in  the  world,  including  from  the  
Southern District of New York.   
 
c. Marketplace-1 does not sell narcotics directly to customers.  Instead, Marketplace-1 
is an e-commerce platform that enables its “customers” to purchase narcotics from “vendors,” who 
advertise narcotics on Marketplace-1.   Each “vendor” is required to register with Marketplace-1.  
If approved by Marketplace-1 employees, each vendor can list for sale virtually any illegal narcotic 
they wish, for any price they choose.  “Customers” also must register with Marketplace-1.  After 
registering, customers can select which narcotics to purchase from which vendor and can pay for 
those narcotics using cryptocurrency, in transactions facilitated by Marketplace-1’s “bank.”  Both 
vendors and customers use Marketplace-1’s bank to conduct narcotic transactions, which means 
both  vendors  and  customers  deposit  money  with  Marketplace-1 and  use  Marketplace-1  to  
exchange money, as outlined in greater detail below.  In exchange for its services, Marketplace-1 
earns approximately 5% of the purchase price of every narcotic sold on Marketplace-1.   
 
d. As  the  principal  administrator  of  Marketplace-1,  LIN  profits    the  most  from  
Marketplace-1’s activities.  LIN also implements policies for the site, and ultimately determines 
whether a particular vendor is permitted to sell narcotics on Marketplace-1.  LIN also directs the 
activities  of  at  least  one  other  employee,  who (at  LIN’s  ultimate  direction)  assists    in  the  
management  of  the  day-to-day  operations  of  Marketplace-1.    (The  number  of  employees  has  
fluctuated since the launch of Marketplace-1.)       
 
e. Based on evidence uncovered through this investigation, in its more than three years 
of  operations,  Marketplace-1  has  transacted  approximately  $80,000,000  in  cryptocurrency  and  
sold  more  than  one  thousand  kilograms  of  narcotics,  misbranded  prescription  medication,  and  
other   illicit   products—including   at   least   364   kilograms   of   cocaine,   295   kilograms   of   
methamphetamine, and 92 kilograms of MDMA.  LIN has earned millions   in personal profits for 
his work as the principal administrator of Marketplace-1. 
 
Marketplace-1’s Operations 
 
19. Based  on  my  involvement  in  this  investigation,  my  training  and  experience,  my  
review of documents and other materials, including my personal review of Marketplace-1, as well 
as my conversations with law enforcement officers and others, I have learned the following, among 
other things: 
 
a. Marketplace-1 has several established rules (which are posted on Marketplace-1) 
an individual must comply with before he or she is approved as a vendor on the site.  Among other 
things, vendors must “apply” to the administrators, describe their prior experience as a vendor on 
the darknet, identify whether they were (or are) a vendor at any other darknet markets, and pay a 
non-refundable fee of $750 to Marketplace-1.  By applying to the site, vendors acknowledge that 
5% of their gross revenue will be paid to Marketplace-1.   
 
 
activity, including to sell, and purchase, illegal products.  Indeed, there are a number of darknet 
narcotics markets available on Tor, although Marketplace-1 appears to be one of the largest. 

8 
b.Even  if  they  are  accepted,  vendors  can  be  removed  from  Marketplace-1 for
engaging  in  scams,  generating  a  high  volume  of  negative  feedback  from  customers,  refusing  to  
answer inquiries from Marketplace-1 administrators, and/or posting their own feedback to boost 
their  own  sales.    The  decision  to  remove  a  vendor  from  Marketplace-1  solely rests  with  the  
administrators and, in particular, with the primary administrator of the site (“Administrator-1”)—
who, as explained in greater detail below, is RUI-SIANG LIN, a/k/a “林睿庠,” the defendant.  
c.Vendors  are  ranked  on  Marketplace-1 by  positive  customer  reviews  and  sales
volume.  Marketplace-1 even trumpets the highest ranked vendors in top-ten lists available on the 
site. 
d.Both  vendors  and  customers  can  submit  “disputes”  to  the  administrators  of
Marketplace-1.  To submit a dispute, a customer or vendor fills out a form containing information 
about the nature of the dispute and transmits it to the administrators.  A customer might submit a 
dispute  if,  for  example,  they  paid  for,  but did  not  receive,  narcotics.    Vendors  might  submit a 
dispute  if  they  believe  a  customer  posted  misleading  negative feedback.    Marketplace-1 
administrators resolve disputes at their discretion.  They can refund sales, remove customers, or 
take any other action they see fit.  Administrator-1 appears to retain the ultimate decision-making 
authority concerning customer and vendor disputes. 
e.   M
arketplace-1 operates its own “bank.”  The “bank” is an important component of
Marketplace-1’s business.  Customers deposit cryptocurrency
2
 such as Bitcoin
3
 or Monero
4
 into 
the Marketplace-1 bank and use deposited funds to make purchases from vendors.  Once a purchase 
is  made,  cryptocurrency  is  transferred  from  a  buyer’s  “bank”  account to  the  vendor’s  “bank”  
account.      Both   vendors   and   buyers   can   withdraw   from   the   “bank”   into   their   personal   
cryptocurrency wallets.
5
  By depositing money into the bank, both customers and vendors evidence 
2
 Cryptocurrency is a digital currency designed to work as a medium of exchange through 
a computer network that is not reliant on any central authority, such as a government or bank, to 
uphold  or  maintain  it.    Asset  records  are  maintained  by  a  digital  ledger  (also  known  as  a  
blockchain), which is a computerized database that tracks cryptocurrency ownership.  The digital 
ledger  is  maintained  by  a  decentralized  network  of  computing  devices  throughout  the  world.  
Cryptocurrencies are highly volatile and can be purchased through a number of methods, including 
through  cryptocurrency  exchanges,  which  are  online  services  that  enable  users  to  exchange  fiat  
currency (e.g. U.S. Dollars) for cryptocurrencies. 
3
 Bitcoin is the world’s most popular cryptocurrency.  It is known in shorthand as “BTC.” 
The Bitcoin digital ledger is publicly available, and its transactions can be analyzed using software 
tools. 
4
 Monero is a cryptocurrency which uses a blockchain with privacy-enhancing technologies 
to attempt to obfuscate transactions and seek to achieve anonymity and fungibility.  In shorthand 
“Monero” is known as “XMR.” 
5
  A  cryptocurrency  wallet  can  be  a  physical  device  or  a  software  program  that  stores  
cryptocurrency passwords and allow users to access their digital currency.  Wallets typically have 
addresses, which are a long string of characters.  That “wallet address” corresponds to entries on 

9 
 
a  substantial  amount of  trust  in  Marketplace-1  and,  specifically, in  its  administrators.    This  is  
because once deposited, customer and vendor money is under the control, and in the possession, 
of Marketplace-1.
6
  The “bank” is also designed to further obscure the locations and identities of 
vendors and customers from each other and from law enforcement by adding a layer of anonymity 
to transactions on the marketplace and keeping the financial information of vendors and buyers 
separate, making it more difficult for any one actor on the marketplace to learn any other actor’s 
true identity.  As further explained below, the bank also offers an “escrow” service enabling both 
buyers and customers to have additional security concerning their narcotics transactions.      
 
f. Marketplace-1  offers  its  users  the  ability  to  transfer  cryptocurrency among  users  
and provides a user-to-user anonymous chat service. 
 
g. Marketplace-1  offers  a  “community  governance”  program  on  its  website.    This  
program permits users (those who meet certain buying or selling thresholds) to vote on rules and 
regulations for Marketpalce-1.      
 
Narcotics Listings on Marketplace-1 
 
20. Based  on  my  involvement  in  this  investigation,  my  training  and  experience,  my  
review  of  documents  and  other  materials,  as  well  as  my  conversations  with  law  enforcement  
officers and others, I have learned the following, among other things: 
 
a. Marketplace-1 has   extensive   advertisements   for   a   broad   array   of   narcotics   
including, but not limited to, heroin, cocaine, methamphetamines, LSD, PCP, and oxycodone.  To 
advertise these drugs, each vendor posts a short description of the narcotics offered for sale and, if 
they choose, a photograph.  Descriptions of narcotics include, by way of example, the following: 
 
i. “Sweet Mama’s China White Synthetic *EXTREMELY POTENT*;” 
 
ii. “x10 OP80 80mg Oxycodone OcyContin/free shipx;” 
 
iii. “0.5G High POTENT White Lion Stamp Heroin .HIGHEST PURITY;” 
 
iv. “[Featured] 1G-28G Pure Colombian Cocaine (88-91%) NDD, HQ TR24;” 
 
v. “Top Quality GHB;” 
 
vi. “[Featured] #PURE AFGHAN HEROIN *uncut* TOP Quality (A*) (NDD 
AVAILABLE);” 
 
the digital ledger or blockchain.  That is, the blockchain will indicate how many digital coins a 
particular wallet owns. 
6
 Several darknet markets have been accused of an “exit scam.”  An exit scam is when a 
marketplace stops transmitting money it holds in escrow while it continues to take deposits.  The 
operators of the marketplace collect as many deposits as they can and then shut down the site and 
steal the deposited money.   
 

10 
vii.“Lucky’s IRANIAN OPIUM;”
viii.“M30 OXYCODONE 30mg x 500;”
i
x.“1G CHINA WHITE HEROIN (WORLDWIDE).”
b.Marketplace-1 also has extensive advertisements for a broad array of narcotics sold
by  vendors  located  in  foreign  countries  who  ship  their  narcotics  into  the  United  States.    For  
example: 
i.A particular vendor who offers for sale “S-ISO Ketamine,” for $4500 per
kilogram ships such narcotics from the United Kingdom to, among other places, the United States. 
ii.A  particular  vendor  who  offers  for  sale  “Ether  Washed  Coke”  for  $110
ships such narcotics from Canada to, among other places, the United States. 
iii.A particular vendor who offers for sale “Coke 94.50% from Colombia,” for
$625.71 for 5 grams, ships such narcotics from Germany to, among other places, the United States. 
iv.A  particular  vendor  who  offers  for  sale  “PURE  PIKO  Methamphetamine
Crystal Meth ICE Shards” for $43.58 ships such narcotics from Poland to, among other places, the 
United States. 
v.A   particular   vendor   who   offers   for   sale   “MDMA   Dutch   MDMA
Champagne mdma 84% pure” for approximately $18.54 per gram ships such narcotics from the 
Netherlands to, among other places, the United States. 
vi.   A  particular  vendor  who  offers  for  sale  “10  tabs  OxyContin  80mg  MR
AUTHENTIC  OXYCODONE”  for  approximately  $227.92  per  ten  tablets  ships  such  narcotics  
from Spain to, among other places, the United States. 
vii.A  particular  vendor  who  offers  for  sale  “LSD  Blotters  Reborn  350  ug
Needlepoint Crystal 99% Labtested UK EU USA AUS WORLD” for approximately $3.45 per ten 
units ships such narcotics from the Netherlands to, among other places, the United States. 
viii.A  particular  vendor  who  offers  for  sale  “Strong  Heroin  #3  +/-   65%”  for
approximately $22.00 per gram ships such narcotics from the Netherlands to, among other places, 
the United States.   
c.T
o  assist  its  customers,  Marketplace-1  organizes  its  narcotics  listings  into  the
following   categories:      anxiolytics,   benzodiazepines,   cannabis,   cannabinoids,   deliriants,   
depressants, dissociatives, empathogens, nootropics, oneirogens, opioids, psychedelics, sedatives, 
steroids, stimulants, synthetics, tobacco, miscellaneous.  Customers can also perform searches for 
narcotics  or  browse  the  listings  through  a  graphical  interface,  similar  to  those available  on  
legitimate e-commerce websites. 

11 
d.Indeed, much like a legitimate e-commerce site, each vendor on Marketplace-1 has
a page which lists, among other things, the number of successful sales for each product and reviews 
from that  vendor’s  customers.    In  this  way,  customers  rate  the  vendors  for  the  quality  of  their  
narcotics,  reliability,  and  delivery  speed.    Based  on  my  review  of  Marketplace-1, there  are  
thousands of reported successful narcotics transactions for, among other things, cocaine, heroin, 
oxycodone, LSD, and methamphetamines.  The reviews corroborate that the sales of narcotics on 
Marketplace-1 are, in fact, narcotics transactions.   
e.To further corroborate that Marketplace-1 sells illegal narcotics, law enforcement
officers made several undercover purchases from vendors on Marketplace-1, including: 
i.On  or  about  April  6,  2022,  while  using  a particular  undercover identity
(“UC-1”) and, using a computer located in Manhattan, New York, I ordered 5 grams of “Crystal 
Meth” from a vendor on Marketplace-1.  I   paid approximately $170, via Bitcoin, by depositing 
Bitcoin into Marketplace-1’s bank.  When purchasing the “crystal meth,” I designated a shipment 
address to a particular mailbox in Manhattan, New York, which is controlled by law enforcement 
officers (“Mailbox-1”).  On or about April 12, 2022, law enforcement officers recovered a package, 
which  contained  a  powdery  substance.    That  substance  was  later  tested  and  assessed  to  be  
approximately 5 grams and tested positive for the presence of methamphetamine hydrochloride. 
ii.On or about February 2, 2023, while using the UC-1 identity and a computer
located  in  Manhattan,  New  York,  I  ordered  “M30  (PRESSED)  $8.99  EACH  60X  STRONGER  
THAN  HEROIN”  from  a  particular  vendor  on  Marketplace-1.    I paid  approximately  $50,  via  
Bitcoin, by   depositing   Bitcoin   into   Marketplace-1’s bank.      When   purchasing   the   “M30   
(PRESSED)  $8.99  EACH  60X  STRONGER  THAN HEROIN,” I   designated  Mailbox-1  as  the  
shipment address.  On or about February 7, 2023, law enforcement officers recovered a package, 
which  contained  approximately  two  pills.    Those  pills  were  later  tested  and  assessed  to  be  
approximately 0.210 grams and tested positive for the presence of fentanyl. 
iii.On or about November 28, 2023, while using another particular undercover
identity (“UC-2”) and a computer located in Manhattan, New York, I ordered “M30 Pressed OXY 
PILLS -HIGH   QUALITY   -USPS”   from   a   particular   vendor   on   Marketplace-1.      I   paid 
approximately  $43.60,  via  Bitcoin,  by  depositing  Bitcoin  into  Marketplace-1’s bank.    When  
purchasing the “M30 Pressed OXY PILLS -HIGH QUALITY -USPS,” I designated Mailbox-1 as 
the  shipment  address.    On  or  about  December  5,  2023,  law  enforcement  officers  recovered  a  
package, which contained approximately five tablets.  Those five tablets had imprinted on them 
an “M.”  Those five tablets were later tested and assessed to be approximately 0.569 and tested 
positive for the presence of fentanyl.
7
 
iv.On  or  about  November  29,  2023,  while  using  the  UC-2 identity  and  a
computer located in Manhattan, New York, I ordered “5MG|OXYCODONE|OXYCONTIN|OC 5| 
7
 Based on my review of documents and conversations with law enforcement officers from 
the  Federal  Drug  Administration,  I  have  learned  that  a  particular  licensed  pharmaceutical  
manufacturer (“Manufacturer-1”), and a company it licenses, are the only two entities authorized 
to manufacture tablets bearing an “M.”  Manufacturer-1 has not authorized tablets bearing an “M” 
to be manufactured containing fentanyl.  Accordingly, these tablets appear to be counterfeit. 

12 
 
USA  TO  USA|LOW  MIN  ORDER”  from  a  particular  vendor  on  Marketplace-1.    I    paid 
approximately  $44, via  Monero,  by  depositing  Monero into  Marketplace-1’s bank.    When  
purchasing the “5MG|OXYCODONE|OXYCONTIN|OC 5| USA TO USA|LOW MIN ORDER,” 
I  designated Mailbox-1 as the shipment address.  On or about December 6, 2023, law enforcement 
officers recovered a package, which contained approximately five pills.  Those five pills were later 
tested  and  assessed  to  be  approximately  0.663 grams  and  tested  positive  for  the  presence  of 
oxycodone. 
 
v. On  or  about  December  8,  2023,  while  using  the  UC-2 identity  and  a 
computer  located  in  Manhattan,  New  York,  I  ordered  1  gram  of  “JIRAFFE*CHINA  WHITE  
HEROIN MIX*FAST USPS*CHINA WHITE” from a particular vendor on Marketplace-1.  I paid 
approximately  $90,  via  Bitcoin,  by  depositing  Bitcoin  into  Marketplace-1’s bank.    When  
purchasing  the  “JIRAFFE*CHINA  WHITE  HEROIN  MIX*FAST  USPS*CHINA  WHIT,”  I 
designated Mailbox-1 as the shipment address.  On or about December 20, 2023, law enforcement 
officers recovered a package, which contained a powdery substance.  That powdery substance  was 
later tested and assessed to be approximately 0.97 grams and tested positive for the presence of 
fentanyl.  
 
vi. On or about January 4, 2024, while using the UC-2 identity and a computer 
located  in  Manhattan,  New  York,  I  ordered  “one  unit” of “BEST  Cocaine  in  America  FREE  
SHIPPING!” from a particular vendor on Marketplace-1.
8
  I paid approximately $47, via Bitcoin, 
by depositing Bitcoin into Marketplace-1’s bank.  When purchasing one unit of “BEST Cocaine 
in  America  FREE  SHIPPING!,” I   designated  Mailbox-1  as  the  shipment  address.    On  or  about 
January  18,  2024,  law  enforcement  officers  recovered  a  package,  which  contained  a  powdery  
substance,  which,  based  on  the  training  and  experience  of  the law  enforcement  officer  who  
recovered the package, appeared to be a controlled substance.  Testing of the powdery substance 
is pending.   
 
vii. On or about January 11, 2024, while using the UC-2 identity and a computer 
located in Manhattan, New York, I ordered “150mcg LSD Gel Tabs - Stronger and better (5 tabs 
packs)” from a particular vendor on Marketplace-1.  I paid approximately $46.70, via Bitcoin, by 
depositing Bitcoin into Marketplace-1’s bank.  When purchasing one unit of “150mcg LSD Gel 
Tabs - Stronger and better (5 tabs packs)” I designated Mailbox-1 as the shipment address.  On or 
about January 18, 2024, law enforcement officers recovered a package, which contained a package 
of gel  tablets  which,  based  on  the  training  and  experience  of  the law  enforcement  officer  who  
recovered the package, appeared to be a controlled substance.  Testing of the gel tablets substance 
is pending.   
 
Searches of Marketplace-1 Servers 
 
21. Based  on  my  involvement  in  this  investigation,  my  training  and  experience,  my  
review  of  documents  and  other  materials,  as  well  as  my  conversations  with  law  enforcement  
officers and others, I have learned the following, among other things: 
 
 
8
 The listing did not specify the weight of cocaine associated with “one unit.” 
 

13 
a.Law enforcement officers executed a search warrant  on   or about July 20, 2022 and
a  second  search  warrant  on  or  about  August  2,  2023,  on  several  servers   that  host  data  for  
Marketplace-1—including “Server-1” and “ Server-2.”  Law enforcement officers executed search 
warrants  on  or  about  August  16,  2022  and  on  or  about  January  5,  2024,  on  additional  servers  
including “Server-3.”  As explained herein, Server-1 appears to be a DDoS prevention system for 
Marketplace-1.
9
  Server-2 appears to host the back-end Marketplace-1 data, including a history of 
all   completed   narcotics   transactions.      Server-3   appears   to   be   the   server   responsible   for 
Marketplace-1’s bank, including  its  cryptocurrency  transactions.    Law  enforcement  officers  
corroborated  that  Server-1,  Server-2, and  Server-3  are  Marketplace-1  servers  based  on,  among  
other things, the following:    
i.Server-1 is leased to a particular company (“Company-1”). Company-1 is a
“server reseller.” That is, Company-1 stands between an end client who leases server space from 
Company-1 and a server provider, another company, from whom Company-1 leases server space. 
This structure is common in illegal activities on the internet because it helps the end client hide 
their identity from a server provider. Indeed, here, Company-1 is a foreign company that advertises 
itself as an entity which offers servers for darknet marketplaces.  A particular end-client (“End-
Client-1”) leased Server-1 from Company-1 on or about January 10, 2022.  The day prior, on or 
about  January  9,  2022, End-Client-1 leased  Server-2  from  Company-1.    End-Client-1  told  
Company-1,  in  substance  and  in  part,  to  place  Server-1  in  “the  closest  possible  proximity”  to  
Server-2.
10
        
ii.From on or about January 30, 2023, through on or about May 9, 2023, law
enforcement officers obtained a Pen Register and Trap and Trace order on Server-2 (the “PRTT”).  
The  PRTT had  more  than  approximately  14,000,000  connections  to  Server-1,  which  further 
indicates that Server-1 operated as “filter” for Server-2 to thwart DDoS attacks.  Further, based on 
law  enforcement  officers’   review  of  the  content  of  Server-1,  law  enforcement  officers  have  
assessed that Server-1 is designed to protect Server-2 from DDoS attacks. 
iii.Dur
ing  the  time  that  the  July  19,  2022  search  warrant  was  executed,
Server-1 and  Server-2  were  briefly  taken  offline.    At  the  time  that  Server-1  and Server-2  were  
taken  offline,  I    observed  that  Marketplace-1  went  offline.    When  Server-1  and  Server-2  were  
reconnected to the internet, I  observed that Marketplace-1 went back online.  These observations 
further corroborate that Server-1 and Server-2 are servers that host Marketplace-1’s data. 
i
v.Based on a review of Server-2’s data, law enforcement officers, and others
working with the FBI, observed that Server-2 hosted data necessary to run Marketplace-1.  This 
9
 DDoS attacks, also known as Distributed Denial of Service attacks, are when malicious 
cyber  actors  attempt  to  disrupt  the  normal  traffic  of  a  particular  server,  service, or  network  by  
overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.  Based on 
my training and experience, I have learned that darknet marketplaces are often the target of DDoS 
attacks by rival marketplaces.     
10
 Based on my training and experience, I have learned that placing servers in proximity 
enables  more  efficient  communication  and  is  typically  done  when  servers  are  to  be  in  ongoing  
communication.   

14 
includes,  among  other  things,  databases  pertaining  to  Marketplace-1,  narcotics  transaction  
information (discussed in detail, infra ¶  22), and file folders bearing Marketplace-1’s true name. 
v.Based on a review of Server-2, law enforcement officers further observed
that Server-2 was connected to another server, Server-3, via “SSH Tunnels.”  SSH Tunneling is a 
way two computers (or servers) connect over a secure encrypted connection.  Based on my training 
an experience, generally, when two computing devices are connected via SSH tunnel, it indicates 
those computing devices share information, data, and are generally trusted by each system.  I have 
also  learned  it  is  common  for  market  administrator(s)  to  create  SSH  tunnels  among  several 
compartmentalized servers to allow them to be more easily accessed by all the other servers, and 
to route data in an encrypted state. 
vi.   Based  on  a  review  of  Server-3, it  contains,  among  other  things,  data
corresponding  to  cryptocurrency  transactions.    Specifically,  law  enforcement  officers  observed  
Bitcoin wallets and Monero wallets stored in Server-3 (discussed in detail, infra ¶ 22).  Based on 
review  of  this  information,  law  enforcement  officers  observed  Bitcoin  transaction  hashes  and  a  
Monero transaction hash pertaining to each of the undercover narcotics purchases through on or 
about January 5, 2024 that I had made using the identities of UC-1 and UC-2 , which are described 
above.
11
    (Supra  ¶ 20.e.)    This  further  corroborates  that  Server-3 (and  Server-2  to  which  it  is  
connected) maintains data for Marketplace-1.    
b.Accordingly,  I  believe  that  Server-1,  Server-2,  and  Server-3  are  servers  used  to
operate Marketplace-1 and contain data from Marketplace-1.  
Volume of Narcotics Sales on Marketplace-1 
22.Based  on  my  involvement  in  this  investigation,  my  training  and  experience,  my
review  of  documents  and  other  materials,  as  well  as  my  conversations  with  law  enforcement  
officers and others, I have learned the following, among other things: 
a.As  described  above,  Server-2 appears  to  contain  the  “back-end”  data  used  to
operate  Marketplace-1.    Law  enforcement  officers  identified  database  files  in  a  folder  titled 
“[Marketplace-1].”    Within are  approximately  dozens  of  database  files  that  bear  unique  names 
including:  “vendors,”  “users,”  and  “orders.”    Each  of  those  database  files  were  analyzed  and  
converted into tables with data arranged in both rows and columns. 
b.The “vendors” table    contains    approximately    1,312    vendor    usernames.
Accordingly, based on the data in Server-2, Marketplace-1 appears to have 1,312 vendor accounts 
as of on or about August 2, 2023.  Based on the vendors table, as of on or about August 2, 2023, 
approximately 756 vendors are listed as vendors who are located abroad and ship narcotics into 
the United States.  The vendors table further indicates that those approximately 756 vendors offer 
shipments  of  narcotics  including,  among  others,  cocaine,  heroin,  ketamine,  LSD,  MDMA,  
marijuana, methamphetamine, amphetamine, and oxycodone into the United States. 
11
 Each Bitcoin and Monero transaction is associated with a unique hash value.  The hash 
value is a unique long string of computer-generated characters used to identify a transaction on a 
blockchain. 

15 
 
 
 
c. The “users” table contains approximately 255,519 usernames (including username 
identities used by UC-1).  Accordingly, based on the data in Server-2, Marketplace-1 appears to 
have 255,519 customer accounts as of on or about August 2, 2023. 
 
d. The  “orders”  table  appears  to  list  every  Marketplace-1  transaction.    There  are 
approximately 224,791 transactions based on the number of rows of data in the “orders” table—
i.e., each  row  indicates  a  different  transaction.    Further  corroborating  that  this  is  Marketplace-1 
data, within the “orders” table is a row corresponding to the April 6, 2022 UC-1 transaction and a 
row corresponding to the February 8, 2023 UC-1 transaction.  (See supra ¶¶ 20.e.i, ii.)   
 
e. There  are  multiple  columns  in  the  “orders”  table,  which  appear  to  list  particular  
information for each transaction including:  “buyer” (i.e. the username of the buyer),  “vendor” (i.e. 
the username of the vendor),  “listing_name” (i.e., the title of the sales listing) “usd_total” (i.e., the 
United States dollar value of the transaction),  “btc_total” (i.e.,  the Bitcoin value of the transaction), 
“xmr_total” (i.e., the Monero value of the transaction), “  timestamp” (i.e., the date and time of the 
transaction), “  status” (i.e.,  whether the transaction was “finalized,” “cancelled,” “refunded,” etc.), 
“currency” (i.e., the currency used for the transaction, e.g. BTC or XMR), and “quantity” (i.e.,  the 
amount of narcotics in each transaction). 
 
f. The investigative team analyzed the “orders” table and used the information in the 
“listing_name,” “timestamp,” “quantity,”  and “status” fields to assess the approximate total weight 
of narcotics sold on Marketplace-1,   according to the data in Server-2.  To make this assessment, a 
computer program analyzed the “listing_name” column to group each transaction by the type of 
narcotic sold.
  12 
  Thereafter,  the  information  in  the  “quantity”  column was  assessed  for  each  
 
12
 As described above, many listing names use slang terms for narcotics.  To analyze the 
data, the following slang terms were used to identify various narcotics, which, based on my training 
and experience are common slang terms for the corresponding narcotic: 
 
(1) Alprazolam: “alprazolam”, “xanax”; 
(2) Amphetamine: “amphetamine”, “bennies”, “uppers”, “methadate”;  
(3) Cocaine: “cocaine,” “coke”;  
(4) Heroin: “heroin”, “china white”;  
(5) Ketamine: “ketamine”, “special k”, “k2”, “vitamin k”, “kit kat”; 
(6) LSD: “lsd”, “acid”, “blotter”, “dots”, “sugar cubes”; 
(7) Marijuana: “marijuana”, “pot”, “weed”, “skunk”, “hash”, “herb”, “bud”, “grass”, “mary 
jane”, “reefer”, “trees”, “flower”, “thc”, “haze”;  
(8) MDMA: “mdma”, “ecstasy”, “molly”, “mda”;  
(9) Methamphetamine: “methamphetamine”, “meth”, “blue”, “ice”, “crystal”; and 
(10) Oxycodone: “oxycodone”, “oxycontin”, “percocet”, “o.c.”, “oc”, “oxy”, “oxycet”, 
“oxycotton”, “ozone”, “roxy”; “M30”; “M60”. 
  

16 
 
transaction.
13
   Orders with a “cancelled” status were omitted.  The result of the   analysis yields the 
following  approximate  narcotics  weight  for  the  time  period  from  on  or  about  October  2,  2021 
through on or about August 2, 2023:      
 
Narcotic Weight (kg) 
Amphetamine 112.34 
Cocaine 364.20 
Heroin 10.50 
Ketamine 108.65 
LSD 0.51 
MDMA 92.19 
Marijuana 402.37 
Methamphetamine 295.41 
Oxycodone 1.03 
 
g. The  investigative  team  analyzed  the  “orders”  table  and  used  the  information  in  
“listing_name,”  “timestamp”  and  “usd_total”  columns  to  assess  the  approximate  total  United 
States  dollar  value  of  narcotics  sold  on  Marketplace-1  according  to  this  dataset.    A  computer  
program analyzed the “listing_name” column to sort the transactions by type of narcotic using the 
same parameters as the weight assessment described in footnote 12.
 
 Thereafter, the information 
in  the  usd_total  field  was  assessed  for  each  transaction.
14
    The  result  of  that  analysis  yields  the  
following approximate total value of narcotics sold for the time period from on or about October 
2, 2021 through on or about August 2, 2023: 
 
Narcotic “usd_total” 
Amphetamine $446,094.72 
Cocaine $7,851,009.85 
Heroin $819,687.57 
Ketamine $2,896,264.23 
LSD $965,158.61 
MDMA $1,946,423.63 
Marijuana $2,793,636.69 
 
13
  Generally,  quantity  contains  information  in  the  following  format:  “X*Y(unit  of  
measure)”—e.g. “1*5g.”  An asterisk is a common signal for a multiplication operator in software 
coding.  To confirm that the * indicates multiplication, investigative personnel compared rows in 
the “orders” table to listings on Marketplace-1 and also examined the row corresponding to UC-1’s 
April  6,  2022  transaction.    In  the April  6,  2022  transaction  UC-1  purchased  5  grams, and  the 
“quantity” information  in  the  “orders”  table  for  that  transaction is  “1*5g,”  which further 
corroborates the asterisk is a multiplication operator.  Where the “quantity” column did not list a 
unit of measure, for example “1*2 pills,” the row was excluded from the weight calculation unless 
the title listing indicated the weight.  If weight information was missing in the quantity tab, for 
example,  1*gram,  the  assessed  weight  was  “1”  which  was  consistent  based  on  a  comparison  to  
Marketplace-1 listings on the public website. 
   
14
 It appears that the usd_total information was converted from the value of 
cryptocurrency transacted.  

17 
 
Narcotic “usd_total” 
Methamphetamine $3,453,924.50 
Oxycodone $2,061,173.93 
 
h. With respect to the time period from on or about July 3, 2022 through on or about 
August 2, 2023, the data in Server-2 indicates that vendors on Marketplace-1 sold approximately 
$6.5  million of  cocaine,  $724,000 of  Heroin,  $847,7000 of  LSD,  and  $3.06  million of 
Methamphetamine—approximately $11,198,000 in total. 
 
i. A review of the “orders” table further indicates that Marketplace-1’s sales volume 
has increased over time.  The below chart plots the approximate monthly gross sales volume on 
Marketplace-1, inclusive of all substances and products sold based on the data in Server-2: 
 
 
 
Administrator-1 
 
23. Based  on  my  involvement  in  this  investigation,  my  training  and  experience,  my  
review  of  documents  and  other  materials,  as  well  as  my  conversations  with  law  enforcement  
officers and others, I have learned the following, among other things:   
 
a. Presently,  including  Administrator-1,  at  least  two  employees  manage  the  day-to-
day  operations  of  Marketplace-1.    Each  employee uses  a  particular pseudonym  to  identify  
themselves  in  Marketplace-1  and  across other  internet  platforms  such  as,  for  example,  forums 
including  “Forum-1.”
  15
    In  so  doing,  the  employees  generate  notoriety,  which  serves  as  an  
advertisement  for  the  marketplace,  and  establish credibility  within  the  broader darknet  market  
community.  Based on my involvement in this investigation including my review of darknet market 
forums, and of Marketplace-1, from the launch of Marketplace-1 in or about October 2020 through 
 
15
 Forum-1 is a popular darknet online forum in which users discuss issues pertaining to 
darknet   markets.      Many   illegal   darknet   marketplaces,   including   Marketplace-1,   promote 
themselves  on  Forum-1.   Adminstrator-1  frequently  posts  on  Forum-1  about  Marketplace-1, 
cryptocurrency, and other issues related to the darknet. 
 $-
 $500,000.00
 $1,000,000.00
 $1,500,000.00
 $2,000,000.00
 $2,500,000.00
 $3,000,000.00
 $3,500,000.00
 $4,000,000.00
 $4,500,000.00
 $5,000,000.00
Oct-21
Nov-21
Dec-21
Jan-22
Feb-22
Mar-22
Apr-22
May-22
Jun-22
Jul-22
Aug-22
Sep-22
Oct-22
Nov-22
Dec-22
Jan-23
Feb-23
Mar-23
Apr-23
May-23
Jun-23
Jul-23
Monthly Total  USD
USD for All Orders from October 2021 to July 2023

18 
in or about February 2022, a particular individual (“Administrator-2”) appeared to the principal 
administrator  of  Marketplace-1.    During  that  time  Administrator-1  worked,  in  a  management  
capacity,  at  Marketplace-1.    As  of  in  or  about  February  2022,  I  believe  that  Administrator-1 
became (and still is) the principal administrator of Marketplace-1.   
b.   For
um-1 operates several “sub-forums,” each of which is dedicated to a particular
subject.    For  example,  many  large  darknet  markets  have  their  own  sub-forum  on  Forum-1.  
Forum-1 also maintains sub-forums on topics such as “op-sec,” “darknet markets,” “monero,” and 
“hacking”.    On  or  about  October  19,  2020,  Forum-1  opened  a  sub-forum  dedicated  to  
Marketplace-1 (“Marketplace-1 sub-forum”).  The Marketplace-1 subforum was opened to assist 
in the launch of Marketplace-1.   
c.On   or   about   November   9,   2020,   Administrator-2   authored   a   post   in   the
Marketplace-1 sub-forum “announcing” Marketplace-1’s “Beta Launch.”  The post indicated that 
vendors and buyers would initially be capped “to prevent against unsustainable growth.” 
d.On   or   about   November   11,   2020,   Administrator-2   authored   a   post   in   the
Marketplace-1  sub-forum, which  responded  to  feedback  from  the  Beta  Launch,  and  stated,  in 
substance  and  in  part,  that  Marketplace-1  would  not  sell  opiates,  that  its  administrators  were  
recruiting  vendors,  and  that “employment”  opportunities  with  Marketplace-1  might  be  open  to  
those interested in the future.  
e.On  or  about  May  22,  2021,  Administrator-1  authored  a  post  on  Forum-1  titled
“[Marketplace-1] is now fully developed with wonderful new features!”  The post further stated, 
in substance and in part, that Marketplace-1 would now offer a chat feature and a referral program, 
had an improved user layout, and accepted both Bitcoin and Monero.  This post appears to mark 
the official (i.e., non-Beta) launch of Marketplace-1.   
f.On or about December 6, 2021, Administrator-1 authored a post on Forum-1 titled
“[Marketplace-1] Welcome Buyers and Vendors.” The post stated, in substance and in part, that 
“we are a small but dedicated team that focuses on giving you the best market experience.”  The 
post continued by listing various Marketplace-1 features including “a casino.” 
g.On  or  about  December  19,  2021,  a  user  of  Forum-1  posted  a  question  regarding
darknet markets in which the user queried, in substance and in part, “I often see the terms ‘Canary’ 
and  ‘Mirror’  when  I  enter  a  market,  could  anyone  tell  me  what  I  should  do?”    Administrator-1 
responded, in substance and in part, “Canary is a PGP signed message that usually comes with a 
last updated date and crypto block has to prove that the site owner is still alive.  Mirror is a list of 
official mirrors the is PGP signed.”
 16
 
16
  PGP  keys,  which  is  short  for  “Pretty  Good  Privacy”  keys,  are  cryptographically  
complicated  string  of  letters  and  numbers  that  are  used  to,  among  other  things,  create  a  digital  
signature so the public can identify that a particular post is written by a particular individual. 

19 
h.On   or   about   December   30,   2021,   Administrator-1 authored   a   post   in   the
Marketplace-1  subforum  on  Forum-1,  which  stated,  in  substance  and  in  part,  “[Marketplace-1] 
originally launched during the holidays last year.  We’ve managed to maintain good continuous 
uptime  
during  the  year.    Our  small  but  dedicated  team  focuses  on  giving  you  the  best  market  
experience.  If  you’ve  had  some  past  experience  with  our feedback  thread,  you’ll  definitely  be  
amazed  at  how  fast  we implement  your  suggestions  in  a  rolling  update.”    The  post  also listed 
several features of Marketplace-1 F
   or example, the post stated, in substance and in part, “Vendor 
History.    Not  sure  about  whether  or  not  to  purchase  from  a  vendor?    No  worries,  we  got you 
covered.”  
i.O
n or about January 27, 2022, Administrator-2 responded to a question about “why
opiods [sic] are not allowed” on Marketplace-1.  Adminstrator-2 responded, in substance and in 
part “Because we can. . . .  To that end, we can pick and choose whatever we wish to host or not 
host on our anonymous corporation. . . .  [A]t this point in time (we may or may not change in the 
future, but for now), we disallow the sale of opioids and opiates.” 
j.O
n   or   about   February   23,   2022,   Administrator-1   authored   a   post   in   the
Marketplace-1  subforum  on  Forum-1,  which  stated,  in  substance  and  in  part,  “Blank  Ban  on  
Opioids Lifted.  Dear all, The ban on opioid products is now lifted.  However, fentanyl and related 
chemicals  remain  banned.    Cheers.”    Thereafter,  Adminstrator-2’s stopped  posting  on  Forum-1 
and  elsewhere.    Indeed,  at 
or  about  this  time,  the  attribution  signature  for  Administrator-2’s 
previous  posts on  Forum-1 were  changed  from  “Administrator-2” to  “deleted,”  which  signaled  
that Adminstrator-2 was no longer publicly involved in Marketplace-1.   
k.Based on the foregoing, I believe that Administrator-1 served as an administrator,
working with Administrator-2 for approximately one year until in or about February 2022, after 
w
hich  Administrator-1  took  over  from  Administrator  -2  as  the  principal  administrator  of 
Marketplace-1.   
l.On  other  occasions,  Administrator-1  has  announced  Marketplace-1  software
upgrades,  
changes,  and  other  announcements  on  Forum-1.    These  posts  further  evidence  
Administrator-1’s control over the operations of Marketplace-1.  For example: 
i.On  or  about  February  23,  2022, Administrator-1 posted,  in  response  to  a
user    question, which asked whether heroin was permitted on Marketplace-1, “Only fent and related 
che
micals are banned.” 
ii.On  or  about  February  27,  2022,  Administrator-1  authored  a  post  in  the
Marketplace-1  subforum  on  Forum-1,  which  was  titled  “Explanation  Unexpected  Downtime  – 
Back Online.” 
 The post stated, in substance and in part, “One of our servers in the cluster crashed, 
leading the site to enter a precaution state.  Currently, we have an automatic security system in 
place  that  detects  system  anomalies  and  will  suspend  the  system  or  even  migrate  the  entire  
i
nfrastructure while wiping out the old cluster according to the severity.  This is to prevent LE [law 
enforcement] takeover or hijacking of the servers. . . .  We sincerely apologize for the downtime. 
And  rest  assured  we’ll  do  our  best  to  not  let  it  happen  again.    P.S.  We’re  pushing  a  new  major  
update today or tomorrow.” 

20 
iii.On  or  about  February  27,  2022,  Administrator-1  authored  a  post  in  the
Marketplace-1  subforum,  which,  among  other  things,  announced  the  end  of  operations  of  the 
Marketplace-1 casino. 
iv.On  or  about  March  1,  2022,  Administrator-1  authored  a  post  in  the
Marketplace-1 subforum, which, among other things, announced, in substance and in part, a new 
user interface and “Punk Avatars. . . .  Added punk avatars: randomly generated icons that represent 
you.”   
v.On or about December 10, 2023, Administrator-1 posted, in substance and
in part, “All services are restored and once again functional. . . .  As you all witnessed (and a reason 
for  the  panic  today),  [Marketplace-1]  has  maintained  a  near  flawless  uptime  for  the  past  three  
years.  Even with all those DDoS attacks going on last year, [a DDoS prevention software designed 
by Administrator-1] has kept the site stable. . . .  We sincerely apologize for any inconvenience we 
have caused, and thank you all for believing in us!”
17
 
vi.   On or about December 23, 2023, Administrator-1 posted, in substance and
in part, “Merry Christmas . . . We’re organizing a list of features and updates on our end, we’re 
listening to all your feedback. Promise I’ll get it all sorted out asap, after I deal with current issues 
at hand.  Thank y’all for three years of support. . . . Sincerely [Administrator-1].” 
m.On  other  occasions,  Administrator-1 has  posted  about  ways  in  which  individuals
can  keep  their  illegal  activities  on  the  internet  protected  from  law  enforcement.    Specifically, 
Administrator-1 posted about darknet marketplace operational security, speculated about efforts 
law  enforcement  takes  to  stop  darknet  markets,  and  offered  tips  to  others.    For  example,    on  or  
about June 2021, Administrator-1 posted about “op-sec” (i.e. operational security) and speculated, 
in substance and in part, that a government would not seek to overtake the Tor network because it 
is not cost effective while they could, instead, “catch a bunch of low hanging fruit with bad opsec 
[i.e. darknet operators who do not provide sufficient operational security].”   
n.   E
very fourteen or thirty days, the administrators of Marketplace-1 post a “canary”
with their unique PGP key.  The “canary,” as explained by Administrator-1’s December 19, 2021 
post, supra ¶ 23.g, confirms  to  Marketplace-1  users  that  the  site  is  operational and  none  of  the  
administrators have been compromised.  As of on or about December 18, 2023, the “canary” post 
named Administrator-1 as  one  of  the  Marketplace-1  administrators  along  with  two  other  
administrators who manage the day-to-day operations of Marketplace-1.     
Bank Wallet-1 and Administrator Wallet-1 
24.B
ased  on  my  involvement  in  this  investigation,  my  training  and  experience,  my
review  of  documents  and  other  materials,  as  well  as  my  conversations  with  law  enforcement  
officers and others, I have learned the following, among other things: 
a.A
ll transactions on Marketplace-1 must use Marketplace-1’s bank.  As explained
above, Marketplace-1’s “bank” enables Marketplace-1 to retail and distribute narcotics securely 
17
 The reference to successful DDoS attack prevention may be a reference to the purpose 
of Server-1. 

21 
between  users  (e.g.,  buyers)  and  sellers  (e.g.,  vendors).    Through  the  bank,  customers  deposit  
cryptocurrency (Bitcoin or Monero) into the customer’s Marketplace-1 bank account—essentially 
a  cryptocurrency  wallet.    Once  deposited,  each  user’s  marketplace  wallet  is  controlled  by  
Marketplace-1.    Then,  after  a  buyer  purchases  a  product  from  a  vendor  (e.g., narcotics) 
Marketplace-1  releases  funds  to  the  vendor’s  Marketplace-1  bank  account.    In  this  way,  
Marketplace-1 serves as a financial link between vendors and customers and in so doing provides 
both parties a level of comfort that the transaction will be consummated, while also allowing the 
parties to maintain distance and anonymity between each other.  Marketplace-1’s bank also offers 
an escrow service, which provides sellers and buyers further protections.  The escrow service can 
be set such that a buyer’s money will be released to a seller only after specified actions occur, for 
example, the shipment of narcotics.  With the escrow service,  s  ellers know they will be paid for 
their illegal narcotics and buyers know their payments will be released to sellers after specified 
events occur. Although not every transaction on Marketplace-1 uses the bank’s “escrow” services, 
many do.  
b.Law enforcement officers identified the cryptocurrency wallets   that Marketplace-1
uses for its bank (collectively, “Bank Wallet-1”) and uses to funnel proceeds from Marketplace-1 
to Administrator-1 (“Administrator Wallet-1”): 
i.Pursuant   to   the   January   2024   judicially   authorized   warrant,   law
enforcement  officers  searched  Server-3.    In  Server-3,  law  enforcement  officers  identified  the 
following directories    (i.e.    computer    folder)    “/root/.bitcoin/wallets/[Marketplace-1]    1/”; 
/root/.bitcoin/wallets/[Marketplace-1]     2/”;     “/root/.bitcoin/wallets/[Marketplace-1] 3;     and     
/root/.bitcoin/wallets/[name of a cryptocurrency tracking software promoted by Administrator-1].  
Each of these computer folders contains a Bitcoin wallet file.  A Bitcoin wallet file is a database 
that contains public and private Bitcoin keys to a particular Bitcoin wallet.
 18
  Because each of these 
Bitcoin wallet files were found on Server-3 and are named [Marketplace-1] or the cryptocurrency 
tracking  software  promoted  by  Adminstraotr-1,  they  appear  to  contain  Marketplace-1  assets—
specifically  deposits  made  by  customers  and  vendors  into  Bank-1.
19
    For  simplicity,  these  four  
wallets are defined herein as “BTC Bank Wallet-1.”   
18
  Every  cryptocurrency  wallet  comes  with  a  corresponding  pair  of  cryptographically  
generated PGP keys—one public and one private. Public keys identify particular cryptocurrency 
wallets and can be shared with anyone to identify a particular wallet.  Private keys, on the other 
hand, are typically maintained securely as they allow anyone to control the funds inside a particular 
cryptocurrency    wallet.    For  example,  if  Person  A  wants  to  provide  Person  B  an  address  where  
Cryptocurrency should be sent, Person A will provide Person B their public key, which serves as 
a cryptocurrency wallet to which Person B will direct a transfer.  In order to transfer cryptocurrency 
from a wallet to another the user must use their private key, which provides them control over the 
wallet.     
19
   At   the   time   of   the   search,   wallets   [Marketplace-1]   1,   [Marketplace-1]   2,   
[Marketplace-1] 3, contained most proceeds, a total of approximately 1315.6 BTC ($36.8 million) 
in deposits.  The wallet identified as a [name of a cryptocurrency tracking software promoted by 
Administrator-1] contained approximately 0.41 BTC ($11,921) in deposits.    

22 
ii.A review of BTC Bank Wallet-1 indicates that from on or about November
9,  2020 through  on  or  about  January  9,  2024,  there  were  approximately  244,483  Bitcoin 
transactions in and out of BTC Bank Wallet-1, consisting of approximately 183,772 deposits and 
approximately 60,711   withdrawals.
 
The   total   Bitcoin   deposited   represents   approximately 
1,316.038719 BTC ($36,895,586.12), and the total Bitcoin withdrawn represents approximately 
1,303.126267 BTC ($36,431,574.05).
20
   
iii.S
erver-3 also housed a Monero wallet (“XMR Bank Wallet-1”).  Based on
a review of XMR Bank Wallet-1, from on or about November 9, 2020, through on or about January 
9,  2024,  there  were  approximately  265,375 Monero  transactions  consisting  of  181,918  deposits 
and  83,457  withdrawals.  The  total  XMR  deposited  represents  approximately  296,094 XMR 
($46,728,991), and   the   total   Monero   withdrawn   represents   approximately   294,634 XMR 
($46,482,976).     
i
v.Combining BTC Bank Wallet-1 and XMR Wallet-1—“Bank Wallet-1”—
indicates that from its inception to on or about January 9, 2024, Marketplace-1 generated at least 
approximately $83,624,577 in revenue, which yielded at least approximately $4,181,228 from its 
5%  commission.    A  review  of  Bank  Wallet-1  further  indicates  that  Marketplace-1  activity  
increased  year  over  year.    For  example,  in  2022,  Bank  Wallet-1  received  approximately  $14.8  
million in deposits.  In 2023, Bank Wallet-1 received approximately $65.5 million in deposits. 
c.Using  software  tools,  law  enforcement  officers  reviewed  the  publicly  available
Bitcoin  digital  ledger  and  traced  transactions  involving BTC Bank  Wallet-1.    In  so  doing,  law  
enforcement officers identified a series of wallets that received the majority of funds from BTC 
Bank Wallet-1—i.e., that received the proceeds of Marketplace-1.  One such particular wallet—
“Administrator Wallet-1”—received the most funds from Bank Wallet-1, over approximately 58 
deposits from in or about October 2021 through in or about September 2023. 
i.During   that   time   period,   of   the   approximately   58   deposits   into
Administrator Wallet-1 from BTC Bank Wallet-1, approximately 24 were whole value transfers 
(e.g. 1 BTC or 5 BTC as opposed to 1.789 BTC.)  Based on my training and experience, the transfer 
of whole amounts is indicative of transferring proceeds (i.e. the proceeds derived from the 5% fee) 
from to an administrator as a profit.  This is because when transferring funds, with the purpose of 
moving them, individuals tend use simple whole numbers.  On the other hand, when transferring 
funds, with the purpose of purchasing items, the amounts tend to not be in whole numbers because 
prices of items are pegged to fiat currencies and cryptocurrency is highly volatile. 
ii.Further, during that time period, the vast majority of Administrator Wallet-
1’s funds—approximately 123.14 BTC ($3,351,343)—came from BTC Bank Wallet-1.  That is, 
the cryptocurrency flowing into Administrator Wallet-1 is from Markerplace-1.  After receiving 
Marketplace-1  cryptocurrency,  Administrator  Wallet-1  transferred  it  elsewhere.    Specifically, 
from on or about March 25, 2020 through on or about October 1, 2023, Administrator Wallet-1 
received  approximately  77  deposits  of  Bitcoin, totaling  approximately  126.0026 BTC,  and  then  
transferred all of it to other wallets. 
20
 Due to the volatility of cryptocurrencies, as to all United States Dollar converted amounts 
herein are approximate and based on the floating exchange rate near the time of the transaction. 

23 
iii.Accordingly, Administrator Wallet-1 appears to be a “pass through” wallet
used   to   obscure   the   source   of   funds   (which   is   Marketplace-1),   while   transferring   the   
cryptocurrency to other wallets under the control of Administrator-1. 
d.Administrator-1 Used “Swapping Service-1.”
i.On or about May 23, 2023 at approximately 12:07 UTC, Administrator-1
posted on Forum-1 that he “[g]ot fucked by [Swapping Service-1].”
21
  The post further indicated, 
in  substance  and  in  part,  that  “approximately  one  hour  ago,  1  BTC  was  sent  to  [Swapping  
Service-1] for hot wallet rebalancing.  XMR didn’t come out on the other end, and turned out to 
be  confiscated.    Their  support  replied  with:  ‘We  received  word  from  our  exchange  partner  that  
your crypto were obtained through illegal proceedings.  Please provide proof of funds.’”   
ii.O
n  the  day  that  Administrator-1 posted  the  comment  about  Swapping
Service-1, supra, law enforcement officers observed on the Bitcoin public digital ledger a one (1) 
Bitcoin  transfer  from  Administrator  Wallet-1  to  a  particular  wallet  address  associated  with  
Swapping Service-1 (“Transaction-1”).  Transaction-1 appears to be the transaction mentioned by 
Administrator-1 in the above post.  Indeed, the time of Transaction-1, approximately 11:15 UTC, 
aligns  with  the  timing  of  the  transfer  recounted  by  Administrator-1 who  indicated  in  the  post,  
which was posted at approximately 12:07 UTC, that the transfer occurred “an hour ago.” 
e.A
ccordingly, I believe that Administrator Wallet-1 is controlled and managed by
Administrator-1.  I believe this because, inter alia: (i) Administrator Wallet-1 received the most 
money  from  Bank  Wallet-1,  which  is  the  wallet  used  by  Marketplace-1;  (ii)  Administrator  
Wallet-1 primarily received whole amounts of Bitcoin from Bank Wallet-1; and (iii) Administrator 
Wallet-1 was involved in Transaction-1, which is a transaction that Administrator-1 complained 
about in an online post on Forum-1. 
RUI-SIANG LIN is Administrator-1 
25.Based  on  my  involvement  in  this  investigation,  my  training  and  experience,  my
review  of  documents  and  other  materials,  as  well  as  my  conversations  with  law  enforcement  
officers   and   others,   I   believe   that   RUI-SIANG   LIN,   a/k/a   “林睿庠,”   the   defendant,   is 
Administrator-1.  Thus, LIN is the principal administrator of Marketplace-1 who manages its entire 
operations, leads the activities the other two administrators, ultimately decides whether any of the 
more  than  one  thousand  vendors can  sell  narcotics  on  Marketplace-1,  promotes  Marketplace-1, 
controls Bank Wallet-1, controls Administrator Wallet-1, and profits from Marketplace-1’s illegal 
operations.  I believe this based on, among other things, the following: 
21
  Swapping  Service-1  is  a  particular  online  cryptocurrency  swapping  service.    A  
cryptocurrency swapping service allows its users to convert their cryptocurrency from one type of 
cryptocurrency to another for a fee.  For example, users can “swap” their Bitcoin for Monero or 
vice  versa.    While  it  is  possible  such  swapping  could  have  a  legitimate  purpose,  based  on  my  
training and experience, it is also a way individuals try to conceal the source of their funds to hide 
from law enforcement and others. 

24 
 
a. LIN Used Administrator Wallet-1 to Purchase an Internet Domain.  As described 
below, Administrator Wallet-1 was used to purchase a domain registered to LIN. 
 
i. Based  on  a  review  of  the  Bitcoin  digital  ledger,  law  enforcement  officers  
learned  that  Administrator  Wallet-1  conducted  at  least  four  transactions  with  Namecheap,  an  
online  domain  registrar.    In  particular,  Administrator  Wallet-1  paid for,  or  partially  paid  for,  at  
least  four  internet  domains:    (1) a  domain  which  provides  real-time  status  updates  for  popular  
darknet marketplaces and services, including Marketplace-1; (2) a domain which promoted a now 
defunct  illegal  darknet  market;    (3)  a  domain  for  a  website  associated  with  Marketplace-1—
specifically a site that promotes the “[Marketplace-1] team,” contains a link to Marketplace-1, and 
the  description  that  Marketplace-1  allows  users  to  “[b]uy  whatever  you  desire  with  the  best  
security, friendly interface and streamlined user experience there is. Real free trade starts here.”; 
and (4) an additional particular domain (“Domain-1”).  
 
ii. Specifically, based on Namecheap documents, “Domain-1” was purchased 
on or about March 25, 2022, by a particular Namecheap account (“Namecheap Account-1”) using 
funds from both Administrator Wallet-1 and a particular account hosted by a cryptocurrency digital 
marketplace (“Crypto Account-1”).
  22
  The total price of Domain-1 was approximately $20,000—
the vast majority of which was paid for from Crypto Account-1.  But Administrator Wallet-1 also 
transferred  approximately  .00501  BTC  ($22.09) to  Namecheap  to  complete  the  purchase  of 
Domain-1.   
 
iii. Namecheap   Account-1 appears   to   be   LIN’s   Namecheap   account.      
Namecheap  Account-1 is  registered  to  “RuiSiang  Lin,”using   a  particular  phone  number  with  a  
Taiwanese  country  code  (“Phone  Number-1”),  a  physical  address  in  Taipei,  Taiwan,  and a 
particular email address, which contains in its username the text “ruisiang” (“Lin Personal Email 
Account-1”).
23
 
 
b. LIN’s Crypto Account-1 Received Marketplace-1 proceeds.  As described below, 
Crypto Account-1 appears to have received substantial funds from Marketplace-1.  Using software 
tools, law enforcement officers have reviewed the publicly available Bitcoin digital ledger, as well 
as the transaction history of Crypto Account-1, and learned the following, in substance and in part: 
 
i. On  or  about  July  26,  2021, at  approximately  07:43 UTC,  Administrator  
Wallet-1  transferred  approximately  .04 Bitcoin  to  a particular  swapping  service  (“Swapping 
Service-2”)  (approximate  value  at  the  time  of  transfer  was  $1,528),  where  it  was  swapped  for  
 
22
  A  cryptocurrency  digital  marketplace  enables  users  to  buy  and  sell  cryptocurrencies.    
Users  also  maintain  accounts  with  the  marketplace  where  they  can  hold  cryptocurrencies  over  
time. 
23
 On or about October 4, 2023, “RUISIANG LIN” with the alias “林睿庠” applied for a 
visa to enter the United States.  In the application, LIN provided Phone Number-1 as his phone 
number and Lin Personal Email Account-1 as his email address.  In the application, LIN described 
his  employment  duties  as  “RESEARCH  AND  DEVELOP  BLOCKCHAIN  APPLICATIONS  
AND BACKEND.”  LIN’s application indicates he is from Taiwan and graduated National Taiwan 
University.  Finally, LIN submitted a particular photograph of himself in connection with the visa 
application (“Photograph-1”).     

25 
approximately  6.7681 XMR.    Approximately  21 minutes  after  the  .04 Bitcoin  transfer  from  
Administrator  Wallet-1,  which  was  converted  to  6.7681 XMR,  Crypto  Account-1  received  a  
deposit of 6.7681 XMR (approximate value at the time of transfer was $1,476). 
ii.On  or  about  May  15,  2022, at  approximately  03:18  UTC,  Administrator
Wallet-1 transferred 1 Bitcoin to Swapping Service-1 (approximate value at the time of transfer 
was $29,745), where it was swapped for approximately 193.68 XMR.  Approximately 40 minutes 
after the 1 Bitcoin transfer from Administrator Wallet-1, which was converted to 193.68 XMR, 
Crypto Account-1 received a deposit of 180 XMR (approximate value at the time of transfer was 
$30,978). 
iii.On  or  about  May  17,  2022, at  approximately  09:59  UTC,  Administrator
Wallet-1 transferred 1 Bitcoin to Swapping Service-1 (approximate value at the time of transfer 
was $30,571), where it was swapped for approximately 176.07 XMR.  Approximately 27 minutes 
after the 1 Bitcoin transfer from Administrator Wallet-1, which was converted to 176.07 XMR, 
Crypto Account-1 received a deposit of 180 XMR (approximate value at the time of transfer was 
$31,104). 
i
v.On  or  about  May  31,  2022, at  approximately  08:33  UTC,  Administrator
Wallet-1 transferred 2 Bitcoin to Swapping Service-1 (approximate value at the time of transfer 
was $63,432), where it was swapped for approximately 304.74 XMR.  Approximately 35 minutes 
after  the  2  Bitcoin  transfer  from  Administrator  Wallet-1,  which  was  converted  to  304  XMR,  
Crypto Account-1 received a deposit of 300 XMR (approximate value at the time of transfer was 
$59,580). 
v.These  transfers  appear  to  indicate  that  the  transferor  used  Swapping
Service-1 to obscure the source of the money transferred from Administrator Wallet-1 to Crypto 
Account-1.    That  is,  rather  than  transfer  money  from  Administrator  Wallet-1  directly  to  Crypto  
Account-1,  cryptocurrency  was  first  swapped  through  Swapping  Service-1  and  converted  from  
Bitcoin to Monero, which is a cryptocurrency that is much more difficult to trace.  After the swap, 
the funds were transferred into LIN’s Crypto Account-1.  
vi.   Documents  from  the  provider  of  Crypto  Account-1  indicate  that  its  user
provided Phone  Number-1  as  his mobile  number,  Lin  Personal  Email  Account-1  as  his email 
address,  and  the  below  pictured Taiwanese  Driver’s  License  as  proof  of  identity.    The  below 
Taiwanese Driver’s License, with redactions applied over certain identifying information, lists an 
address in Taipei, Taiwan and the name is “林睿庠,” which is the Mandarin language spelling of 
“Rui-Siang Lin.”  In addition, the Taiwanese Driver’s License listed the driver’s license number 
for “林睿庠,” (“License Number-1”).    

26 
vii.Accordingly,  LIN  appears  to  own  and  control  Crypto  Acccount-1,  which
has received Marketplace-1 proceeds. 
c.LIN’s Cryptocurrency Holdings Increased as Marketplace-1 Business Increased
i.As indicated in the chart above, supra ¶ 22.i, a review of Bank Wallet-1 and
the “orders” in Server-2 reveals that Marketplace-1 business increased from 2021 to 2023. While 
Marketplace-1 grew from 2021 to 2023, LIN’s cryptocurrency holdings also increased.  Monero 
deposits into Crypto Account-1 increased in a similar pattern from 2021 (approximately $63,154 
deposited)  to 2022  (approximately  $1,302,946 deposited)  to  2023  (approximately  $4,196,408 
deposited).    Bitcoin  deposits  into  Crypto  Account-1  also  increased  from  2021  (approximately  
$1,195 deposited) to 2022 (approximately $37,784 deposited) to 2023 (approximately $1,792,096 
deposited).   
ii.Law enforcement also identified another cryptocurrency exchange account
(“Crypto Account-2”) registered to the name “Rui-Siang Lin,” using Lin Personal Email Account-
1 and Phone Number-1.  Crypto Account-2 was created on or about July 25, 2023 and from that 
date to on or about November 21, 2023, it received approximately $4.5 million dollars of crypto 
currency deposits.   
iii.Based  on  a  review  of  Lin  Personal  Email  Account-1,
24
  law  enforcement
officers located a copy of LIN’s resume from in or about November 2023.    Based on that resume, 
LIN’s employment history is not consistent with the large amount of assets in his cryptocurrency 
accounts.  That is, LIN’s past employment does not appear to be the sort of employment for which 
an individual would have been paid or otherwise obtained millions of dollars.  Of the four listed 
“professional  experience[s]” in  LIN’s  resume,  the  first  position  is  an  “intern,”  the  second  is  a  
“student researcher,” the third is a “co-f ounder” of an obscure tech company, and the fourth is an 
“information  technology”  employee  for  a  foreign-government  office.    None  of  these  positions  
suggest  that  LIN  would  have  earned  millions  of  dollars.     Accordingly,  I  believe  that  the  large  
volume of assets in LIN’s cryptocurrency accounts are the result of his work as Administrator-1.  
24
 On or about November 22, 2023, law enforcement officers obtained a judicially 
authorized search warrant on Lin Personal Email Account-1. 

27 
d.L
IN  Has  the  Required  Technical  Knowledge.    Based  on  publicly  available
information, LIN appears to have the requisite technical knowledge and experience to operate and 
manage a complex darknet market such as Marketplace-1. 
i.Law enforcement officers identified a particular GitHub account, which is
registered to Lin Personal Email Account-1.
25
  The name associated with this GitHub account is 
“Ruisiang.”  Accordingly, it appears to be LIN’s GitHub account.  In LIN’s GitHub account, LIN 
describes himself as a “Backend and Blockchain Engineer, Monero Enthusiast.”  LIN’s GitHub 
account  has  approximately  35  publicly  available  software  coding  projects.    Collectively,  these  
coding  projects  indicate  that  LIN  has  significant  technical  computing  knowledge,  including 
knowledge  necessary  to  administer  a  site  like  Marketplace-1.    The  coding  projects  include  
operation of cryptocurrency servers and web applications—such coding knowledge is necessary 
to administer Marketplace-1.  LIN’s GitHub account includes, for example, the following coding 
projects: 
1.“P
oW Shield,” which is a tool to mitigate DDoS attacks.  Notably,
as  mentioned  above,  Marketplace-1  has  trumpeted  its  ability  to  deflect  DDoS  attacks  and  
implements Server-1 for that purpose.  (See supra  ¶¶  21.a, 23.i.v.) 
2.“M
onero  Merchant,”  which  is  a  software tool  that  allows  online
merchants to accept XMR for payment.  
3.“K
oa-typescript-framework,”   which   is   a   webframe   software
program used as a foundation for web applications.  Marketplace-1 is built on Koa and Typescript. 
e.LIN’s YouTube Interview.  Law enforcement officers have identified a particular
publicly  available  YouTube  video  (“Video-1”).    Video-1  contains  an  approximately  15-minute 
interview with LIN regarding “PoW Shield.”  During the interview, LIN explained that there are 
various methods to stop a DDoS attack, including by increasing bandwidth and setting up “edge 
servers.”   Specifically, during the interview “Ruisang” describes, in English, software designed 
to disrupt DDoS attacks.  The interview contains an “About Me” title page in which “Ruisang” is 
identified as “Lin, RuiSiang,” “Backend & Blockchain Dev,” Undergraduate at National Taiwan 
University,”  “Crypto  Enthusiast,”  along  with  a  link  to  LIN’s  GitHub  account.    The  individual  
interviewed appears to be the same individual pictured in the Taiwanese Driver’s License, supra 
¶ 25.b.vi,  and  is  identified  with  the  mandarin  language  name  for  “Rui-Siang  Lin,”  as  pictured  
below:   
25
 GitHub is a social media platform that allows software developers to create, store, and 
manage software codes.  Users can post software code on the site and/or communicate with others 
about software-based issues.  

28 
 
 
 
f. LIN’s Personal Email Account-1 Demonstrates LIN is Adminstrator-1:   
 
i. Lin Personal Email Account-1 is LIN’s email account.  Lin Personal Email 
Account-1 is registered to the name “林睿庠,” which is the same name on the Taiwanese Driver’s 
License  used  to  register  Crypto  Account-1  and the  name  used  in  Video-1.    Lin  Personal  Email  
Account-1 is also registered to Phone Number-1, which is the same phone number associated with 
Crypto Account-1.  Based on a review of the content in Lin Personal Email Account-1, it appears 
to be LIN’s personal email account.  For example: 
 
1. On  or  about  May  4,  2022,  Lin  Personal  Email  Account-1  sent  an 
email in response to a job post, which read, in substance and in part: “My name is RuiSiang Lin, 
and  I’m  currently  a  third  year  at  National  Taiwan  University.  I’ve  developed  blockchain  and  
backend  applications  for  2.5  years  now  as  an  intern  at  [redacted].  Also,  I’ve  had  a  solid  
infrastructure and cybersecurity background.”  Attached to the email was LIN’s English language 
resume which listed Phone Number-1 as LIN’s phone number and Lin Personal Email Account-1 
as LIN’s email address.  The resume listed various computer coding experience including links to 
LIN’s GitHub account.  
 
2. On  or  about  November  22,  2023,  Lin  Personal  Email  Account-1 
received an email from a particular Taiwanese Bank.  Attached to that email was a bank statement, 
which was password protected.  The email from the bank indicated, in substance and in part and 
based  on  machine  translations,  that  the  password  to  decrypt  the  bank  statements  was  LIN’s  
identification number.  Law enforcement officers were able to decrypt the bank statement by using 
License Number-1.  The bank statement indicated that LIN had over $1 million in his accounts.  
 
ii. Lin  Personal  Email  Account-1 Searches  Coincide  with  Administrator-1 
Activities.    As described  above,  law  enforcement  officers  obtained  a  search  warrant  on  Lin 
Personal Email Account-1, which provided law enforcement officers access to the content of that 
account including, among other things, the Google searches that the user of Lin Personal Email 
Account-1 ran, and learned as follows: 
 

29 
1.Pixel Attacks
a.On  or  about  May  7,  2021  at  08:51  UTC,  the  user  of  Lin
Personal Email Account-1 searched Google for “one pixel attack for fooling deep neural networks 
github.”  Thereafter, according to documents obtained from Google, Lin visited a particular url on 
GitHub (“GitHub URL-1”).   
b.On  or  about  May  7,  2021  at  18:40  UTC,  Administrator-1
posted on Forum-1 a post titled “A Proposal for ML-proof improvement on DeCaptcha” within 
that  post,  Administrator-1 wrote,  in  substance  and  in  part,  “One  pixel  attacks  should  deem  the  
spammers/DDoSers  ML  efforts  to  fail.”  The  post  provided  GitHub  URL-1 as  a  link  for  further 
reading on the topic—i.e., the same link Lin Personal Email Account-1 visited earlier that day. 
2.Marketplace-1 Casino
a.On  or  about  September  2,  2021,  the  user  of  Lin  Personal
Email Account-1 searched Google for “provable fair calculator.”  On September 3, 2021, the user 
of Lin  Personal  Email  Account-1  searched  Google  for  “slot  game  terminology.”    On  or  about  
September  4,  2021,  the  user  of  Lin  Personal  Email  Account-1  performed several  searches  that  
appear to be related to animating dice rolling using a particular software coding language.  On or 
about  
September  5,  2021,  the  user  of  Lin  Personal  Email  Account-1  performed  several internet 
searches regarding playing cards, poker, and blackjack.  On or about September 7, 2021, the user 
of Lin Personal Email Account-1 performed several searches regarding animating card flips and 
blackjack mathematics.  
b.
 On   or   about   September   7,   2021,   the   Marketplace-1 
“Changelog” lists the following changes to Marketplace-1 “Integrated online casino [Marketplace-1 
nickname]bets.”
26
   
c. On or about September 15, 2021, Administrator-1 posted on 
Forum-1,  
in  substance  and  in  part,  that  Marketplace-1  offers  “[Marketplace-1  nickname]bets.”  
The  post  contains  the  phrase  “provably  fair  mechanism”—i.e., a  phrase  similar  to  what  LIN  
searched thirteen days earlier. 
3.T
hree-Way Chat Feature
a.On  or  about  September  19,  2021,  the  user  of  Lin  Personal
Email Account-1 searched Google for “three-way conversation.” 
b.O
n or about September 20, 2021, Administrator-1 posted on
Forum-1, in substance and in part, that Marketplace-1 now offers a redesigned dispute system with 
“per-order three-way chats.” 
26
 The Marketplace-1 “Changelog” is a running list of changes made to Marketplace-1.  
Those changes typically indicate software updates, bug fixes, and adding features to the site. 

30 
 
4. Cryptopunk Generator 
 
a. On or about February 7, 2022, the user of Lin Personal Email 
Account-1 searched Google for “cryptopunk generator js,” “array.reduce,” “get random in array,” 
and “js random true false.” 
 
b. On   or   about   February   28,   2022,   the   Marketplace-1 
“Changelog” lists the following changes to Marketplace-1: “Added punk avatars, unique generated 
icons that represent you.”  Similarly, as indicated above, on or about March 1, 2022, Admisntrator-
1 posted that Marketplace-1 “[a]dded punk avatars: randomly generated icons that represent you” 
on Forum-1.   
 
c. Based    on    my    training    and    experience,    the    search    
“cryptopunk”  was  performed to  locate  images  of  a  popular  internet  NFTs  and  memes.    Those  
images  were  then  used  to  create  Marketplace-1  avatars.    The  other  February  7,  2022  searches  
appear  to  be  related  to  randomizing  functions,   thus  enabling  Marketplace-1  to  randomly,  and  
uniquely, assign a “cryptopunk” avatar to each user. 
 
5. Troubleshooting an Offline Server  
 
a. On or about July 19, 2022, pursuant to a judicially authorized 
warrant, the FBI imaged a server, which hosted Marketplace-1.  To execute that search warrant, 
the FBI took the Marketplace-1 sever offline at approximately 23:30 UTC. 
 
b. On  or  about  July  20,  2022, at  approximately  00:18  UTC,  
00:19 UTC, 00:20 UTC, and 00:23 UTC, the user of the Lin Personal Email Account-1 searched 
Google for “pm2 crashed,” “view pm2 daemon logs,” “pm2 daemon logs,” and “pm2 changelog,” 
respectively.   
 
c. Based  on  my  training  and  experience,  I  have  learned  that  
“PM2”  is  process  manager  software  which  helps  its  users  manage  and  maintain  applications  
online.    Thus,  these  July  20,  2022  searches—which were performed  less  than  an  hour  after  
Marketplace-1’s server went offline—appear to be LIN attempting to troubleshot the fact that a 
Marketplace-1 server went offline.  
 

31 
iii.L
IN Emailed Himself a Diagram of a Darknet Marketplace
1.On  or  about  March  12,  2020, the  user  of  Lin  Personal  Email
Account-1 emailed himself a diagram, which is pictured below. 
b.This  d
iagram  appears  to  be  a  plan  for  a  darknet  market.
Notably, the diagram indicated “vendor,” “listing,” “pgp key,” and “admin review,” all of which 
are features of Marketplace-1. 
c.In   addition   to   the   above   mentioned Google   searches
performed by the user of Lin Personal Email Account-1, this diagram is further evidence that LIN 
is Adminstrator-1.   
Surveillance of LIN Matches His Activities on Lin Personal Email Account-1 
26.  Based on my involvement in this investigation, my training and experience, my
review of documents and other materials, as well as my conversations with law enforcement 
officers and others, I have learned that: 
a.On or about October 25, 2023, the user of Lin Personal Email Account-1
searched for, among other things, “What to Pack for Your Trip to St. Lucia (2023).” 
b.   O
n or about November 2, 2023, the user of Lin Personal Email Account-1
searched for, among other things, “Online Check in - EVA Air | Global (English).”
27
   
27
 EVA is a Taiwanese airline. 

32 
c.The next day, the user of Lin Personal Email Account-1 searched for, among
other things, “pearson toronto american express,”
28
 “pearson priority security lane,” “toronto 
airport priority pass,” “toronto midnight bars,” and “Harbor Club St. Lucia.”   
d.O
n  or  about  November  3,  2023,  law  enforcement  officers  observed  a  man  who
appeared to be the same individual in Photograph-1, Video-1, as well as the individual depicted in 
the Taiwanese Driver’s License photograph described above—i.e. RUI-SIANG LIN, a/k/a “林睿
庠,”  the  defendant—walk  through international customs  at  Toronto  Pearson  Airport  in  Canada, 
which indicates that LIN had arrived on an inbound international flight.  LIN was next observed 
at a baggage terminal.  The officers then surveilled LIN leave the airport in a rideshare car and 
arrive at a nearby hotel.  The next day, law enforcement officers observed LIN in Pearson Airport 
board a plane destined for St. Lucia. That is, consistent with the aforementioned Google searches, 
LIN spent an evening in Toronto, and after doing so traveled to  St. Lucia.  
WH
EREFORE, I respectfully request that a warrant be issued for the arrest of RUI-SIANG 
LIN, a/k/a “林睿庠,” the defendant, and that he be arrested, and imprisoned or bailed, as the case 
may be. 
______________________________
 
Mark Rubins 
Task Force Officer 
Federal Bureau of Investigation 
S
worn to me through the transmission of  
this Complaint by reliable electronic  
means (telephone), this ___ day of January, 2024. 
___________________________________
 
THE HONORABLE SARAH NETBURN 
United States Magistrate Judge 
Southern District of New York 
28
 Toronto Pearson International Airport is an international airport located in Toronto, 
Canada.