Empire Market Co-Founder Pleads Guilty to Federal Drug Conspiracy Charges
Empire Market co-creator Raheim Hamilton (aka “Sydney”/“Zero Angel”) pleaded guilty in U.S. federal court in Chicago to a drug conspiracy charge tied to operating the dark web marketplace from 2018–2020. Prosecutors said the Tor-hidden service facilitated over 4 million transactions totaling more than $430 million, primarily illegal drug sales (~$375 million), and also enabled sales of stolen credentials, personal data, counterfeit currency, and hacking tools; Hamilton admitted the platform was designed to evade law enforcement and launder proceeds via cryptocurrency-only payments.
Hamilton and co-defendant Thomas Pavey (aka “Dopenugget”) were previously charged for running the market and allegedly had earlier involvement selling counterfeit currency on AlphaBay before launching Empire Market. Reporting indicates law enforcement conducted undercover purchases (including heroin and methamphetamine), and the investigation resulted in significant cryptocurrency seizures (reported at ~$75 million) and forfeiture commitments including Bitcoin, Ether, and property; Hamilton faces a mandatory minimum of 10 years and up to life in prison, with sentencing scheduled for June 17, 2026.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Hamilton sentencing scheduled for June 2026
Following his guilty plea, Raheim Hamilton's sentencing was set for June 17, 2026. The charge carries a mandatory minimum sentence of 10 years and a maximum of life in prison.
Raheim Hamilton pleads guilty in Empire Market case
Raheim Hamilton, identified as a co-founder and operator of Empire Market, pleaded guilty in Chicago to a federal drug conspiracy charge. He admitted the marketplace was designed to evade law enforcement and launder proceeds through cryptocurrency, and agreed to forfeit significant cryptocurrency holdings and properties.
Federal charges filed against alleged Empire Market operators
U.S. prosecutors filed federal charges in June 2024 against Raheim Hamilton and Thomas Pavey for their alleged roles in creating and operating Empire Market. The case centered on a drug conspiracy tied to facilitating large-scale illicit commerce on the marketplace.
U.S. investigators conduct undercover purchases and seize assets
During the federal investigation into Empire Market, U.S. authorities made undercover purchases on the platform and seized substantial criminal proceeds. Reported seizures included about $75 million in cryptocurrency at the time of seizure, as well as cash and precious metals.
Empire Market operates as a major dark web marketplace
Empire Market operated from 2018 to 2020 as a Tor-hidden dark web marketplace and allegedly processed more than four million transactions worth over $430 million. Most sales involved illegal drugs, though the site also offered stolen credentials, personal data, counterfeit currency, and hacking tools.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Law enforcement actions against darknet marketplaces and cybercrime forums
US and international law enforcement continued disrupting illicit online marketplaces and forums used to trade **ransomware services, malware, stolen data, and drugs**. The FBI seized the dark web and clear web domains for **RAMP**, a long-running, predominantly Russian-language cybercrime forum that marketed itself as the “only place ransomware allowed,” and which hosted vetted users, tutorials, and a marketplace for malware and criminal services; the seizure was coordinated with the US Attorney’s Office for the Southern District of Florida and DOJ’s Computer Crime and Intellectual Property Section. Separately, US prosecutors announced guilty pleas tied to major darknet markets that also sold **cybercrime tools and stolen information** alongside narcotics. A Virginia man, **Raheim Hamilton** (aka `Sydney`/`ZeroAngel`), co-creator of **Empire Market**, pleaded guilty to federal drug conspiracy charges related to facilitating roughly **$430M** in transactions (2018–2020) and designing the market to evade law enforcement using cryptocurrency. A Slovakian national, **Alan Bill** (aka `Vend0r`/`KingdomOfficial`), pleaded guilty for helping operate **Kingdom Market** (2021–2023), which authorities previously seized in December 2023; investigators linked him to the operation after his arrest with devices and a crypto hardware wallet allegedly containing evidence tying him to the marketplace.
Mar 21, 2026
US Law Enforcement Actions Targeting Crypto-Enabled Crime and Illicit Marketplaces
US authorities reported multiple enforcement actions tied to **crypto-enabled crime**. In the Empire Market case, prosecutors said co-creators **Raheim Hamilton** and **Thomas Pavey** designed the dark web marketplace to help users evade law enforcement and launder proceeds; the market allegedly facilitated about **$430M** in transactions (drugs, stolen payment data, counterfeit currency) before disappearing in 2020 in what investigators described as an exit scam that stole an estimated **$30M** in bitcoin. Hamilton pleaded guilty to federal drug conspiracy charges and agreed to forfeit roughly **1,230 BTC** plus **24.4 ETH** and real estate; Pavey previously pleaded guilty and agreed to forfeit about **1,584 BTC** and other assets. Separately, reporting highlighted alleged misuse and laundering of digital assets in other contexts. On-chain investigator **ZachXBT** traced movements from wallets associated with **US-seized crypto** (held under U.S. Marshals Service custodianship) to wallets allegedly linked to **John Daghita**, the son of a federal contractor executive, with claims of roughly **$23M** in diverted cryptocurrency and another wallet holding about **$36M** in Ethereum; ZachXBT said he alerted the **U.S. Marshals Service**. In another DOJ case, **Jingliang Su** (a Chinese national) was sentenced to **46 months** for laundering proceeds from a cryptocurrency investment fraud that authorities said victimized **174** people for **$36.9M**, using social engineering via social media/dating platforms and counterfeit trading sites, with **$26.9M** restitution ordered and multiple US agencies involved in tracing funds and dismantling the network.
Mar 21, 2026
Incognito Market Operator Sentenced to 30 Years for Darknet Drug Trafficking and Money Laundering
A U.S. federal court sentenced **Rui-Siang Lin** (24), a Taiwanese national accused of operating the dark web narcotics marketplace **Incognito Market**, to **30 years in prison** for conspiring to distribute narcotics, **money laundering**, and conspiring to sell **adulterated/misbranded medication**. Prosecutors said Lin ran the marketplace under the alias **“Pharaoh”** and oversaw more than **$105 million** in narcotics sales, including large quantities of cocaine and methamphetamine and pills purported to be oxycodone, some allegedly **laced with fentanyl**; the sentence also included **five years of supervised release** and forfeiture of **more than $105 million**. Authorities described Incognito Market as a large-scale, “polished” online drug marketplace that supported cryptocurrency payments (including an internal payment mechanism described as **“Incognito Bank”**) and charged vendors a **5% commission**. Reporting cited platform scale estimates of roughly **1,800 vendors**, **400,000+ customer accounts**, and **~640,000 transactions**, with Lin exercising ultimate control over operations while living abroad (including in **St. Lucia**) and shutting the site down in **March 2024**; Lin was arrested in **May 2024** after arriving at **JFK Airport** en route to Singapore and pleaded guilty in **December 2024**. Investigators also obtained warrants (reported as in **2022** and **2023**) to access servers supporting marketplace operations, including transaction data, DDoS protection, and cryptocurrency processing.
Mar 21, 2026