Kingdom Market administrator sentenced for running darknet drug and cybercrime bazaar
Alan Bill, a 33-year-old Slovak national, was sentenced in the United States to 200 months in federal prison for helping operate Kingdom Market, a major darknet marketplace that sold illegal drugs and cybercrime-related goods. Bill pleaded guilty to conspiracy to distribute controlled substances after admitting he provided web administration, managed cryptocurrency tied to the site, and promoted the marketplace on Reddit, Dread, and other social platforms. Prosecutors said Kingdom Market operated from March 2021 through December 2023 and facilitated thousands of transactions involving narcotics, stolen financial data, fake identity documents, counterfeit currency, and malware.
Investigators said undercover purchases on the platform included fentanyl, methamphetamine, and a fake U.S. passport, while seized server records showed trafficking in heroin and purported Oxycodone cut with fentanyl. Bill was arrested at Newark Liberty International Airport on December 15, 2023, shortly before German authorities seized the marketplace’s servers and shut it down in a multinational operation involving the United States, Germany, Switzerland, Moldova, and Ukraine. The court rejected Bill’s effort to downplay his role, finding he acted as a leader in the conspiracy, and ordered the forfeiture of multiple cryptocurrency assets and the domains Kingdommarket[.]live and Kingdommarket[.]so.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
9 events from the most recent confirmed update back to the earliest known activity.
Alan Bill sentenced to more than 16 years in prison
A U.S. court sentenced Alan Bill to more than 16 years, or 200 months, in federal prison for his role in operating Kingdom Market. The court found he was a leader or organizer of the criminal enterprise and ordered forfeiture of multiple cryptocurrencies and Kingdom Market domains.
France opens formal criminal investigation into Musk, X, xAI, and Yaccarino
French prosecutors escalated the case by opening a formal criminal investigation involving Elon Musk, X, xAI, and Linda Yaccarino over alleged illegal content on X, including child sexual abuse material, Holocaust-denial claims, and explicit deepfakes. Authorities said they may compel testimony and pursue charges or an indictment-equivalent warrant if the subjects do not comply.
French prosecutors seek voluntary interviews with Musk and Yaccarino
In April 2026, French prosecutors sought voluntary interviews with Elon Musk and former X CEO Linda Yaccarino as part of the X investigation. Neither appeared for questioning, according to reporting.
French police raid X's Paris office
French law enforcement raided X's Paris offices to gather evidence as part of the ongoing investigation. Multiple reports place the raid in February 2026, about three months before the formal criminal probe was announced.
Alan Bill pleads guilty in U.S. court
Bill pleaded guilty in January 2026 to conspiracy to distribute controlled substances, admitting he helped maintain and operate Kingdom Market. He also acknowledged providing web administration, handling cryptocurrency, and supporting the marketplace's online presence.
French investigation into X begins
French authorities opened an investigation into X in 2025 over allegations including use of a biased algorithm. The case later broadened into a wider probe of illegal content and platform conduct.
Authorities seize Kingdom Market servers and shut down the site
German law enforcement, working with authorities from the United States, Switzerland, Moldova, and Ukraine, seized Kingdom Market's servers and took the marketplace offline. The takedown ended the site's operation after it had run from March 2021 through December 2023.
Alan Bill arrested at Newark Airport
Alan Bill, a Slovak national accused of helping operate Kingdom Market, was arrested at Newark Liberty International Airport. His arrest came shortly before coordinated international action against the marketplace.
Kingdom Market begins operating on the dark web
Kingdom Market started operating as a darknet marketplace selling illegal drugs, stolen financial data, fake IDs, counterfeit currency, malware, and other illicit goods. Authorities later said the platform facilitated thousands of illicit cryptocurrency-based transactions.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
7 references tracked. Mallory keeps watching after this page renders.
Elon Musk faces criminal probe in France after ignoring summons in X case - Ars Technica
arstechnica.com
Open sourceEastern District of Missouri | Slovakian Administrator of Darknet Market that Sold Drugs and Stolen Personal Information Sentenced to 200 Months in Prison | United States Department of Justice
justice.gov
Open sourceKingdom Market Admin Sentenced to 16 Years in Prison
darkwebinformer.com
Open sourceKingdom Market administrator given 16-year sentence | The Record from Recorded Future News
therecord.media
Open sourceFrance summons Musk for X criminal charges - Boing Boing
boingboing.net
Open sourceEastern District of Missouri | Slovakian Man Admits Aiding Darknet Market that Sold Drugs and Stolen Personal Information | United States Department of Justice
justice.gov
Open sourceBKA - Listenseite für Pressemitteilungen 2023 - BKA und ZIT schalten Darknet-Plattform „Kingdom Market“ ab
bka.de
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sentencing in Darknet Drug Trafficking and Marketplace Operations
US federal courts issued prison sentences tied to **darknet-enabled drug trafficking**. In Los Angeles, **Davit Avalyan** received a **57-month** sentence after pleading guilty to conspiracy to distribute narcotics as part of a multi-year operation that used numerous darknet vendor accounts/storefronts (e.g., *JoyInc*, *PlanetHollywood*, *LaFarmacia*) to sell cocaine, methamphetamine, MDMA, and ketamine nationwide, taking payment in cryptocurrency including **Bitcoin** and **Monero**, and shipping parcels via **USPS**. Separately, reporting on the **Incognito** darknet market case describes sentencing filings alleging that an **FBI-controlled informant/asset** helped administer the marketplace while opioid and fentanyl-tainted products were sold, including claims the informant ignored internal alerts and user complaints about suspected fentanyl-laced pills. A third item—about a Ukrainian national sentenced for facilitating **North Korean remote IT worker infiltration** using stolen identities and US-based “laptop farms”—is a different national-security/cyber-enabled fraud matter and not part of the darknet drug-market sentencing story.
Mar 21, 2026
Law enforcement actions against darknet marketplaces and cybercrime forums
US and international law enforcement continued disrupting illicit online marketplaces and forums used to trade **ransomware services, malware, stolen data, and drugs**. The FBI seized the dark web and clear web domains for **RAMP**, a long-running, predominantly Russian-language cybercrime forum that marketed itself as the “only place ransomware allowed,” and which hosted vetted users, tutorials, and a marketplace for malware and criminal services; the seizure was coordinated with the US Attorney’s Office for the Southern District of Florida and DOJ’s Computer Crime and Intellectual Property Section. Separately, US prosecutors announced guilty pleas tied to major darknet markets that also sold **cybercrime tools and stolen information** alongside narcotics. A Virginia man, **Raheim Hamilton** (aka `Sydney`/`ZeroAngel`), co-creator of **Empire Market**, pleaded guilty to federal drug conspiracy charges related to facilitating roughly **$430M** in transactions (2018–2020) and designing the market to evade law enforcement using cryptocurrency. A Slovakian national, **Alan Bill** (aka `Vend0r`/`KingdomOfficial`), pleaded guilty for helping operate **Kingdom Market** (2021–2023), which authorities previously seized in December 2023; investigators linked him to the operation after his arrest with devices and a crypto hardware wallet allegedly containing evidence tying him to the marketplace.
Mar 21, 2026
Incognito Market Operator Sentenced to 30 Years for Darknet Drug Trafficking and Money Laundering
A U.S. federal court sentenced **Rui-Siang Lin** (24), a Taiwanese national accused of operating the dark web narcotics marketplace **Incognito Market**, to **30 years in prison** for conspiring to distribute narcotics, **money laundering**, and conspiring to sell **adulterated/misbranded medication**. Prosecutors said Lin ran the marketplace under the alias **“Pharaoh”** and oversaw more than **$105 million** in narcotics sales, including large quantities of cocaine and methamphetamine and pills purported to be oxycodone, some allegedly **laced with fentanyl**; the sentence also included **five years of supervised release** and forfeiture of **more than $105 million**. Authorities described Incognito Market as a large-scale, “polished” online drug marketplace that supported cryptocurrency payments (including an internal payment mechanism described as **“Incognito Bank”**) and charged vendors a **5% commission**. Reporting cited platform scale estimates of roughly **1,800 vendors**, **400,000+ customer accounts**, and **~640,000 transactions**, with Lin exercising ultimate control over operations while living abroad (including in **St. Lucia**) and shutting the site down in **March 2024**; Lin was arrested in **May 2024** after arriving at **JFK Airport** en route to Singapore and pleaded guilty in **December 2024**. Investigators also obtained warrants (reported as in **2022** and **2023**) to access servers supporting marketplace operations, including transaction data, DDoS protection, and cryptocurrency processing.
Mar 21, 2026