Federal investigators say a darknet vendor using the name “DaddyBiden” racked up approximately 4,600 sales on Abacus Market and was also active on TorZon Market. The seller allegedly sold Adderall and ecstasy, but laboratory testing of the pills obtained through controlled purchases found that the alleged Adderall was counterfeit and contained methamphetamine. A recently filed criminal complaint says investigators linked a defendant named Peter Lam to the operation using postal surveillance, phone location data and information obtained from the Apple and Google accounts of another alleged member of the DaddyBiden operation.
The investigation began in July 2024, when the DEA and the United States Postal Inspection Service began examining DaddyBiden’s activity on Abacus. According to the criminal complaint, filed in federal court in Nebraska, the seller advertised “Pressed Adderall,” “E341 10MG IR Real Pharma Adderall” and imported MDMA. The filing says DaddyBiden’s Abacus profile showed approximately 4,600 completed sales. An April 10 post from cybercrime tracker Dark Web Informer shows an account called BidensWarAid on the darknet forum Dread promoting DaddyBiden with claims of over 10,000 completed sales and 5,000 positive reviews.
I wish that
Who comes up with the name DaddyBiden anyway?
Scary thread:… pic.twitter.com/wJAj1nUBPh
— Dark Web Informer (@DarkWebInformer) April 9, 2026
For those unfamiliar, darknet marketplaces resemble illicit versions of familiar e-commerce platforms. Suppliers create product pages, buyers compare reviews, and orders are often handled through an escrow system intended to prevent fraud. The sites are generally accessed through anonymity software like Tor and commonly accept bitcoin and privacy-focused alternative cryptocurrencies like Monero.
According to blockchain analysis company TRM LabsAbacus controlled more than 70% of the western darknet market segment supporting Bitcoin in 2024. It disappeared in July 2025 in what TRM assessed as likely an exit scam, although the company said it could not rule out undisclosed police action. Another blockchain analysis company, Chainalysis, recently described TorZon as the dominant Western-oriented successor to Abacus.
Agents say they made several controlled purchases through Abacus and TorZon that resulted in more than 3,000 grams of counterfeit Adderall pills being shipped from California. One intercepted shipment occurred following surveillance in Garden Grove, California, in March. Investigators observed an alleged member of the operation, Trong Xuan Tran, pick up bags containing what appeared to be USPS boxes from Lam’s residence and take them to a post office. Agents isolated a package headed to Wisconsin, obtained a warrant and found approximately 2,162 grams of pills inside.
A subsequent controlled purchase began on May 20, when researchers placed an order from a TorZon listing titled “($0.70) 1000 B974 ADDERALL PRESS.” The next day, agents allegedly saw Tran visit Lam’s home, load heavy bags of garbage into a vehicle, and drop off approximately 100 packages at the Garden Grove post office. Investigators seized the package addressed to his location in Omaha. It contained about 460.7 grams of pills that matched the order, and a lab report confirmed that the alleged Adderall was counterfeit and contained a methamphetamine mixture, the complaint says.
How Lam connected with DaddyBiden
The complaint does not establish that Lam personally created the DaddyBiden account or managed each part of the business. Instead, it describes him as an alleged supplier and logistics coordinator who stored drugs, packaged orders, provided packages to runners and handled payments.
Investigators allege the workers collected bags of packages from his home before taking them to the post office. USPS records also showed that an account with Lam’s name, home address and email address had ordered 1,200 flat-rate boxes from Priority Mail, according to the document.
The first detailed account of the complaint connecting Lam’s residence to a DaddyBiden shipment involves surveillance of Tran in March. Agents allegedly followed Tran from his own residence to Lam’s home and then to the post office, where the Wisconsin-bound shipment was identified. The May controlled order produced a similar sequence, with Tran allegedly picking up bags at Lam’s address shortly before the package ordered from DaddyBiden entered the mail.
Investigators then connected Lam to a phone number found in another suspected member’s iCloud data. The number was saved as “Peter” accompanied by a barber pole emoji, and an open-source registry database associated it with Lam. Precise location information obtained under a federal warrant placed the phone near his Garden Grove residence as recently as June 2.
The messages involving that number supposedly talked about payments, orders, boxes and packages. In one exchange, the person using the number said he would “have everything packed,” which investigators interpreted as evidence that Lam was responsible for preparing the drugs for shipment.
The Apple and Google data described in the affidavit came from cloud accounts associated with another suspected member of the organization, not Lam. The iCloud material allegedly included conversations with the phone number attributed to him. Google’s data contained screenshots of Signal conversations with a contact named “Tripz 3000,” who researchers also believe was Lam.
Researchers said the Signal conversations resembled discussions found on iCloud and included messages about jobs, payments and shipping boxes. In one conversation, one person asked if they could “stop up to Peters.” After being asked if the visit was for packages, the person responded: “For payment lol.”
The complaint offers only a partial description of the cloud data searches and does not identify the legal process used to obtain those records.
Investigators combined that cloud of evidence with controlled warrants, postal records, the phone location warrant and repeated surveillance of Lam’s home. On June 15, DEA and Postal Inspection Service agents executed a search warrant at the residence. When officers asked if anyone else was inside, Lam allegedly responded that there were only drugs in his room and no weapons. Investigators reported finding boxes of orange pills that resembled those advertised by DaddyBiden and previously recovered from the mail.
Lam was criminally charged with conspiracy to distribute and possess with intent to distribute 50 grams or more of methamphetamine, in violation of federal law. The complaint requested an arrest warrant and was initially sealed to avoid alerting Lam and other targets of the investigation. The complaint contains allegations that have not been proven in court and Lam is presumed innocent unless convicted.
