Federal investigators say a darknet vendor using the name “DaddyBiden” built up roughly 4,600 sales on Abacus Market and was also active on TorZon Market. The vendor allegedly sold Adderall and ecstasy, but laboratory testing of pills obtained through controlled purchases found that the supposed Adderall was counterfeit and contained methamphetamine. A recently filed criminal complaint says investigators linked a defendant named Peter Lam to the operation using postal surveillance, phone-location data, and information obtained from the Apple and Google accounts of another alleged member of the DaddyBiden operation.
The investigation began in July 2024, when the Drug Enforcement Administration and the United States Postal Inspection Service started examining DaddyBiden’s activity on Abacus. According to the criminal complaint, which was filed in federal court in Nebraska, the vendor advertised “Pressed Adderall,” “E341 10MG IR Real Pharma Adderall,” and imported MDMA. The filing says DaddyBiden’s Abacus profile displayed approximately 4,600 completed sales. An April X post from cybercrime tracker Dark Web Informer shows an account named BidensWarAid on darknet forum Dread promoting DaddyBiden with claims of more than 10,000 completed sales and 5,000 positive reviews.
I wish X was less limited to what we can post, so I’m just leaving the the Dread thread until I can come up with an easy template to use to post this type of stuff with images on the website.
Who comes up with the name DaddyBiden anyways?
Dread Thread:… pic.twitter.com/wJAj1nUBPh
— Dark Web Informer (@DarkWebInformer) April 9, 2026
For those unfamiliar, darknet markets resemble illicit versions of familiar ecommerce platforms. Vendors create product pages, buyers compare reviews, and orders are commonly handled through an escrow system intended to prevent fraud. The sites are generally accessed through anonymity software such as Tor and commonly accept bitcoin and privacy-focused alternative cryptocurrencies like Monero.
According to blockchain analysis company TRM Labs, Abacus controlled more than 70% of the Bitcoin-supporting Western darknet-market segment in 2024. It disappeared in July 2025 in what TRM assessed was probably an exit scam, although the company said it could not rule out an undisclosed law-enforcement action. Another blockchain analysis company, Chainalysis, recently described TorZon as Abacus’s dominant Western-facing successor.
Agents say they conducted several controlled purchases through Abacus and TorZon that resulted in the shipment of more than 3,000 grams of counterfeit Adderall pills from California. One intercepted shipment followed surveillance conducted in Garden Grove, California, in March. Investigators watched an alleged member of the operation, Trong Xuan Tran, collect bags containing what appeared to be USPS boxes from Lam’s residence and take them to a post office. Agents isolated a parcel headed to Wisconsin, obtained a warrant and found approximately 2,162 grams of pills inside.
A later controlled purchase began May 20, when investigators ordered from a TorZon listing titled “($0.70) 1000 B974 ADDERALL PRESS.” The next day, agents allegedly watched Tran visit Lam’s home, load weighted garbage bags into a vehicle, and deposit approximately 100 packages at the Garden Grove Post Office. Investigators seized the parcel addressed to their Omaha location. It contained about 460.7 grams of pills matching the order, and a laboratory report confirmed that the supposed Adderall was counterfeit and contained a mixture of methamphetamine, the complaint says.
How Lam Was Connected to DaddyBiden
The complaint does not establish that Lam personally created the DaddyBiden account or managed every part of the business. It instead depicts him as an alleged supplier and logistics coordinator who stored drugs, packaged orders, provided parcels to runners, and handled payments.
Investigators allege that workers collected bags of packages from his house before taking them to the post office. USPS records also showed that an account bearing Lam’s name, home address, and email address had ordered 1,200 Priority Mail flat-rate boxes, according to the filing.
The complaint’s first detailed account connecting Lam’s residence to a DaddyBiden shipment involves the March surveillance of Tran. Agents allegedly followed Tran from his own residence to Lam’s home, then to the post office, where the Wisconsin-bound shipment was identified. The May controlled order produced a similar sequence, with Tran allegedly collecting bags at Lam’s address shortly before the parcel ordered from DaddyBiden entered the mail.
Investigators then connected Lam to a phone number found in another alleged member’s iCloud data. The number was saved as “Peter” accompanied by a barber-pole emoji, and an open-source records database associated it with Lam. Precise location information obtained under a federal warrant placed the phone near his Garden Grove residence as recently as June 2nd.
Messages involving that number allegedly discussed payments, orders, boxes and packages. In one exchange, the person using the number said he would “have it all pack up,” which investigators interpreted as evidence that Lam was responsible for preparing drugs for shipment.
The Apple and Google data described in the affidavit came from cloud accounts associated with another suspected member of the organization, not Lam. The iCloud material allegedly included conversations with the phone number attributed to him. Google data contained screenshots of Signal conversations with a contact named “Tripz 3000,” whom investigators also believe was Lam.
Investigators said the Signal conversations resembled the discussions found in iCloud and included messages about jobs, payments, and shipping boxes. In one conversation, a person asked whether they could “pull up to peters.” After being asked whether the visit was for packages, the person responded, “For the payout lol.”
The complaint offers only a partial account of the cloud-data searches, and it does not identify the legal process used to obtain those records.
Investigators combined that cloud evidence with the controlled orders, postal records, phone-location warrant, and repeated surveillance of Lam’s home. On June 15, DEA and Postal Inspection Service agents executed a search warrant at the residence. When agents asked whether anyone else was inside, Lam allegedly responded that there were just the drugs in his room and no guns. Investigators reported finding boxes of orange pills resembling those advertised by DaddyBiden and previously recovered from the mail.
Lam was charged by criminal complaint with conspiracy to distribute and possess with intent to distribute 50 grams or more of methamphetamine, in violation of federal law. The complaint requested an arrest warrant and was initially sealed to avoid alerting Lam and other investigative targets. The complaint contains allegations that have not been proven in court, and Lam is presumed innocent unless convicted.
