FireBunnyUSA: How Authorities Dismantles a Multi Million Dollar Drug Network

Building a Nationwide Drug Supply Chain

Court documents identify 39-year-old Nan Wu of Flushing, Queens, as the central figure behind FireBunnyUSA. Wu is described as having overseen sourcing, digital communication, packaging, and the conversion of cryptocurrency proceeds into fiat. He worked closely with Peng Peng Tang, 30, of San Gabriel, California, who helped coordinate payments and financial transactions. Together, they managed both the online presence of FireBunnyUSA and the movement of products from New York and California to destinations across the U.S.

Several others were connected to the operation in supporting roles. Zixiang Lin, 22, handled packaging and shipping logistics, including the rental of storage facilities and vehicles. Katie Montgomery, 35, a U.S. Postal Service employee from Maine, provided advice related to shipping practices. Bowen Chen, 38, of Baldwin Park, California, later assumed responsibility for shipments after Wu’s temporary absence in mid-2022. Each contributed to keeping the operation functional across multiple states.

National Drug Shipments

FireBunnyUSA followed the established darknet marketplace model in its structure. Buyers communicated through encrypted platforms such as Wickr and Telegram, placed orders using cryptocurrency, and received packages through standard mail. Shipments were sent under false sender names, often using return addresses designed to appear legitimate. Packaging materials were chosen to avoid detection by postal scanners or inspections.

The operation’s ability to sustain thousands of shipments over several years indicates a significant level of organization. The involvement of an individual with postal system knowledge likely helped the group refine its methods for concealing contents and managing delivery risk.

The Cryptocurrency Layer

The financial side of FireBunnyUSA relied on a common laundering cycle observed in darknet markets. Buyers paid in Bitcoin, which the group then converted into Monero (XMR) to obscure transaction history. Funds were later reconverted into Bitcoin and moved through exchange accounts associated with Wu, Tang, and other participants. This combination of privacy coins and multiple wallet layers was used to distance proceeds from the original darknet transactions.

Investigators later estimated that approximately $7.9 million in proceeds passed through the group’s wallets, including $3.1 million processed via cryptocurrency exchanges. Of this amount, around $734,000 was withdrawn in U.S. dollars from domestic exchanges, while approximately $2.4 million in Bitcoin was transferred to an exchange based abroad and converted into Chinese yuan. According to court filings, Tang’s mobile device contained nearly $900,000 in crypto assets at the time of his arrest.

How the Case Was Built

The investigation that led to the group’s dismantling involved both traditional surveillance and blockchain tracing. Between June 2021 and August 2022, undercover agents placed eleven orders from FireBunnyUSA, receiving cocaine, MDMA, and Ketamine shipped to New York. The last controlled buy involved 60 grams of cocaine purchased for roughly $2,800. These orders confirmed that the vendor was still actively operating under consistent branding across darknet platforms.

In July 2022, a search warrant was executed at an apartment shared by Wu and Tang in Flushing. Authorities seized one kilogram of Ketamine, more than 1,200 MDMA tablets, half a kilogram of MDMA in crystalline form, and packaging equipment. Electronic devices and cryptocurrency wallets were also recovered. Wu was taken into custody on an unrelated federal warrant, while Tang’s phone contained data linking to multiple wallet addresses used in the operation.

After this search, FireBunnyUSA briefly suspended activity. Operations later resumed under Chen in California. A subsequent search at Chen’s residence in August 2022 led to the discovery of 1.2 kilograms of cocaine, 2.1 kilograms of MDMA, 34 kilograms of Ketamine, 19 kilograms of psilocybin mushrooms, and smaller quantities of heroin and methamphetamine. That seizure effectively ended the vendor’s activity.

Sentences and Forfeitures

On April 3, 2025, Nan Wu entered a guilty plea in New York State Supreme Court to charges of criminal sale of a controlled substance in the second degree and money laundering in the first degree. He received a sentence of six and a half years in state prison, followed by five years of post-release supervision, and was ordered to forfeit 20 Bitcoin, 3,297 Monero, and $12,857 in cash. Tang was sentenced to one and a half years in prison and one year of supervision, forfeiting his cryptocurrency holdings and more than $130,000 in cash. Chen received two years in prison, while Lin and Montgomery were each given a one-year conditional discharge for their limited roles.

Nan Wu in Custody

×Image of: Nan Wu in Custody

Coordinated Investigation and Evidence

The case involved collaboration between several investigative and forensic teams, including analysts from the Manhattan District Attorney’s Office, the Forensic Accounting and Financial Investigations Bureau, and federal agencies such as the U.S. Postal Inspection Service and Homeland Security Investigations. Digital evidence from seized phones and wallets, combined with transaction data on cryptocurrency exchanges, played a central role in linking the defendants to the funds and shipments described in the indictment.

The case also reflected a merging of on-chain and off-chain analysis. Blockchain data traced transaction paths, while physical evidence and communication records established connections between the digital activity and the individuals involved. The combination of these techniques has become increasingly common in cases involving darknet operations.

Broader Context

FireBunnyUSA’s activity fits within a wider trend of darknet marketplaces facilitating drug distribution through cryptocurrency. Similar operations have been identified in multiple countries, often using Bitcoin and privacy coins like Monero to manage proceeds. While Monero is frequently chosen for its privacy features, most darknet vendors still rely on Bitcoin for accessibility and liquidity. The use of both coins in tandem reflects an effort to balance traceability concerns with convenience for buyers and exchanges.

Globally, enforcement actions have targeted similar operations, resulting in domain seizures, cryptocurrency confiscations, and coordinated arrests. FireBunnyUSA’s case adds to this record as one of the larger darknet vendor prosecutions tied to U.S.-based operators who combined cross-country shipping and crypto laundering.

The End of FireBunnyUSA

By mid-2022, the sequence of arrests and seizures brought FireBunnyUSA’s activities to an end. The vendor’s disappearance followed a familiar trajectory observed in previous darknet cases—rapid growth, diversification across states, and eventual exposure through coordinated investigations. Although several individuals were convicted, many of the same dynamics that supported FireBunnyUSA’s business model remain active elsewhere on the darknet: demand for discreet shipping, use of crypto-based payments, and reliance on marketplace trust systems.

FireBunnyUSA’s story serves as an example of how darknet operations scale, adapt, and eventually collapse once law enforcement identifies digital or physical vulnerabilities. The outcome reinforces how the ecosystem evolves as both participants and investigators refine their tools, leaving the broader structure of the darknet economy largely intact, though increasingly contested.