Author: Curry, Shenchao TechFlow
Two years ago, FBI agents pretended to be the founding team of an investment project at the "intersection of AI and finance," launched a token called NexFundAI on Ethereum, complete with an official website, whitepaper, and business plan, looking no different from any legitimate project on the market.
Then they approached market makers to provide liquidity.
One function of market makers is sometimes to help project teams boost trading volume. The industry term is "volume support," which translates to volume manipulation.
The undercover FBI agents contacted several well-known market makers in the industry one by one, stating upfront: we have a new project and need someone to help boost the trading volume.
According to the indictment released by the U.S. Department of Justice, every single one said, okay.
No one asked if the project was compliant, no one asked if the token had any real utility, no one asked if this was illegal. According to court documents released by the U.S. Department of Justice, four market makers—Gotbit, ZM Quant, CLS Global, MyTrade—all took the job.
During a meeting with an undercover agent, the founder of one of these firms, on a recording device, referred to himself as the "mastermind." He explained in detail how his company used bots to simultaneously place buy and sell orders to create fake trading volume, and how to make the price chart look like a rollercoaster to lure retail investors to jump in.
Then he said something that the FBI recorded verbatim. According to Cointelegraph quoting the indictment, he said:
We have to make them lose money for us to make money.
"Them" refers to retail investors.
The operation was code-named Operation Token Mirrors. According to a U.S. Department of Justice announcement on October 9, 2024, the first batch of 18 people were charged, with over $25 million in crypto assets seized. According to an IRS announcement on March 30 of this year, a second batch of 10 people were charged, with three extradited to the U.S. from Singapore.
Two years, three continents, 28 people. This is the largest market manipulation enforcement action in cryptocurrency history. And it's not over yet.
A Price Quote
How did these market makers operate?
According to the indictment released by the U.S. Department of Justice, Gotbit's founder, Andriunin, maintained a spreadsheet within the company with two columns of data side by side: one labeled "Created Volume" and the other "Market Volume."
To translate, one column was the fake volume they generated themselves, the other was the actual trading happening in the market.
In a 2019 interview with CoinDesk, while still a sophomore at Moscow State University, this 20-year-old was already explaining in detail on camera how he wrote code to create fake volume and helped clients get their tokens onto CoinMarketCap's trending lists. According to the CoinDesk article, he himself said this business was "not entirely ethical."
After the interview aired, he didn't receive any subpoenas; instead, he gained five new clients.
By the time of his arrest in 2024, Gotbit had been operating for six years, serving projects worldwide. According to the U.S. Department of Justice's sentencing announcement, Andriunin was ultimately sentenced to 8 months in prison, Gotbit was ordered to dissolve, and approximately $23 million in crypto assets were forfeited.
Gotbit wasn't the cheapest.
According to a price quote from another market maker disclosed in the indictment, the cost of generating $1 million in daily trading volume was about $200. According to Cointelegraph citing court documents, an employee of ZM Quant explained to an FBI undercover agent on a recorded call: "We use one to two thousand wallets, trading ten times per hour, or ten times per minute, to reach the target volume."
Each transaction cost about $3.
And CLS Global went even further. According to SEC investigation documents, this company registered in the UAE used 30 wallets to execute 740 wash trades, creating nearly $600,000 in fake trading volume, accounting for 98% of the total trading volume of the fake token NexFundAI created by the FBI during that period.
$7.5 Billion of Thin Air
Market makers are tools; the people hiring them are the main actors.
According to the U.S. Department of Justice indictment, the biggest client exposed by this FBI sting operation was called Saitama, a crypto company registered in Massachusetts in 2021, with a peak market cap reportedly reaching $7.5 billion.
What does $7.5 billion mean? It was larger than many legitimate publicly traded companies on Nasdaq at the time.
But how did that number come about, according to the indictment? Starting in July 2021, Saitama's management coordinated actions in a Telegram group, using multiple wallets to place small buy orders, creating the illusion of "a large influx of new buyers."
According to Telegram chat logs cited in the indictment, a core member explained the purpose of the operation: "We want these small buys to look like more buyers, that’s the plan."
The chat logs also included "PUMP IT" emojis and GIFs they sent to each other to confirm buys and celebrate when retail investors followed.
According to the same indictment, Saitama then paid market makers including ZM Quant and Gotbit to conduct large-scale wash trading on exchanges like BitMart and LBank. After the market cap was inflated, the management quietly sold their own tokens, cashing out tens of millions of dollars. According to a DOJ announcement, Saitama's CEO was arrested in the UK, and five former and current employees were charged, with three pleading guilty.
Saitama wasn't the only one.
According to the same indictment, a project called Lillian Finance was founded by 48-year-old Bradley Beatty from Florida. This person publicly claimed to be a defense contractor, stated he had spoken before Congress on cryptocurrency issues, and promised that part of the token sale proceeds would go to charity to help children receive medical care.
According to the indictment, all these claims were fabricated. Beatty pocketed the profits meant for charity.
Defense contractor, congressional speech, children's medical charity—you just need to weave a compelling enough narrative and hire a market maker to paint a pretty price chart, and that's enough to attract some people to FOMO.
Looking back at these cases, what feels most unsettling isn't how sophisticated the scams were, but rather, how crude they were.
The FBI's Coin Was Pretty Legit
After the operation concluded, the FBI did one more thing.
According to a U.S. Department of Justice announcement, the NexFundAI website is still up, but now with a banner at the top that reads: "This website was created under the direction of the Federal Bureau of Investigation as part of an investigation into cryptocurrency fraud and market manipulation." Below the banner is a link to the full DOJ indictment.
The FBI also specifically opened a victim registration channel. According to the DOJ announcement, anyone who lost money on NexFundAI or related tokens can fill out a form to apply for compensation and legal protection.
The FBI launched a token, proactively disclosed information after the operation ended, and even opened a compensation channel for those who lost money; compared to the projects caught in this sting, the process was arguably much more legitimate.
The most absurd part is yet to come.
According to a report by blockchain analytics firm TRM Labs, within 24 hours of the DOJ announcement, someone cloned the FBI's NexFundAI smart contract and launched a copycat token. This person started with about $2,300, cashed out over 52 ETH within 24 hours, worth approximately $127,000 at the time.
The FBI used a fake token to prove market maker manipulation; the day the news broke, someone used the same tactic to launch a new meme and make another profit. Law enforcement took two years, but the market digested and absorbed the entire event in two hours, by launching yet another new shitcoin.
So next time you see a meme coin suddenly skyrocketing, you might want to think about whether it's a performance or real trading.
Of course, it could also be the FBI.
