OAK — OnChain Attack Knowledge

Worked example · 2012-08

Bitcoin Savings & Trust Ponzi — Bitcoin — 2011-02 to 2012-08

Loss
more than 700,000 bitcoins taken from investors, February 2011 through August 2012, per the SEC [btcstsec]. Trendon Shavers, operating under the online pseudonym "Pirateat40," solicited Bitcoin-denominated investments through Bitcoin Savings & Trust (BTCST) online, including on the Bitcoin Forum, promising returns of up to 7% weekly paid in bitcoins [btcstsec]. The earlier text's "~100 investors" and dollar-equivalent figures were unsourced and removed.
OAK Techniques observed
OAK-T11.005.002 (Fake-Custodian / Fake-Asset-Manager Fraud) — primary; Shavers presented BTCS&T as a legitimate Bitcoin-denominated investment vehicle with Bitcoin arbitrage trading as the yield source, but the operation was a Ponzi scheme where existing investors were paid with new investors' deposits. OAK-T3.001 (Pump-and-Dump / Coordinated Social-Media Promotion) — the investment solicitation was propagated through the Bitcoin Talk forum (the dominant social platform for the 2011-2012 Bitcoin community), making this the earliest documented case of social-platform-distributed crypto investment fraud. OAK-T5.005 (Treasury-Management Exit — broadly construed at the Ponzi level; the operator accumulated investor deposits and progressively diverted them for personal use rather than conducting the claimed trading activity).
Attribution
confirmed. The SEC civil action against Shavers and BTCST is SEC v. Shavers, Civil Action No. 4:13-CV-416 (U.S. District Court, Sherman, Texas). On 2014-09-18 the court entered final judgment: $39,638,569 disgorgement plus $1,766,098 prejudgment interest ($40,404,667 total, joint and several) and a $150,000 civil penalty each for Shavers and BTCST; the court found BTCST "a sham and a Ponzi scheme" [btcstsec]. Shavers was arrested in November 2014 on securities and wire fraud charges and later pleaded guilty to one count of securities fraud [btcstdoj][btcstie]. The sentence is not established by the cited sources (earlier text said 18 months).
Key teaching point
Bitcoin Savings & Trust is the canonical 2011-2012 worked example of the three structural primitives that became the dominant crypto fraud template: (1) social-platform-distributed investment solicitation (Bitcoin Talk forum → modern X/Twitter, Discord, Telegram), (2) fake-asset-manager fraud with a fictitious yield-generation narrative (Bitcoin arbitrage → modern DeFi yield, MEV, AI trading), and (3) Ponzi payout structure masking extraction (early investors paid with later investors' deposits). The case is the earliest SEC enforcement action classifying Bitcoin-denominated investments as securities, establishing the legal framework that underpins modern crypto-enforcement.
Corrected 2026-10-11
Scheme dates now follow the SEC (Feb 2011 to Aug 2012, more than 700,000 BTC); the 2014 judgment was a final judgment totalling $40,404,667 plus $150,000 penalties; removed the unsourced '~100 investors', wire-fraud conviction and 18-month sentence.

Summary

Trendon Shavers solicited investments in "Bitcoin Savings & Trust" under the pseudonym "Pirateat40," including on the Bitcoin Forum, claiming a Bitcoin arbitrage operation and promising up to 7% weekly returns paid in bitcoins [btcstsec].

Between February 2011 and August 2012 more than 700,000 bitcoins were taken from investors [btcstsec]. The SEC found the operation a sham and a Ponzi scheme [btcstsec]. Claims here that Shavers day-traded and diverted funds for personal expenses, and that BTCST was the largest Bitcoin-denominated vehicle of its era, are not supported by the cited sources.

The scheme ran through August 2012 [btcstsec]. The SEC filed its civil action in July 2013; a district court ruling in August 2013 reportedly held that BTCST investments were securities (not re-verified in this pass). The final judgment of 2014-09-18 is above; earlier text calling it a default judgment, and the 18-month sentence, are unverified.

The case's structural signature — social-platform-distributed fake-investment solicitation with Ponzi payout mechanics — is the direct ancestor of the 2017-2019 ICO-era Ponzi schemes, the 2019 PlusToken $2B+ scheme (T11.005.002 at scale), the 2020-2022 DeFi yield-farm Ponzi cohort, and the 2023-2026 pig-butchering / fake-CEX fraud class (T11.005.001). The forum-distribution primitive (Bitcoin Talk 2011) is the structural template for Telegram/Discord/X-distributed investment fraud in the modern era.

Timeline (UTC)

When Event OAK ref
2011-02 Scheme start per SEC (Feb 2011 through Aug 2012); Shavers solicits on the Bitcoin Forum [btcstsec] T3.001 (social-platform promotion)
2011-02 to 2012-08 More than 700,000 bitcoins taken from investors [btcstsec] T11.005.002 + T5.005
2012-08 Scheme period ends per SEC [btcstsec] (Ponzi collapse)
2013-07-23 SEC files civil enforcement action (SEC v. Shavers; filing date per earlier text, not re-verified) (legal precedent)
2013-08 Court ruling: Bitcoin is "a currency or form of money"; BTCS&T satisfies Howey test (securities-law precedent)
2014-09-18 Final judgment: $40,404,667 disgorgement and interest plus $150,000 penalty each [btcstsec] (enforcement)
2014-11 Shavers arrested on securities and wire fraud charges; later pleads guilty to one count of securities fraud [btcstdoj]``[btcstie] (criminal disposition)

Realised extraction

More than 700,000 BTC taken from investors [btcstsec]; judgment amounts above.

Public references

Techniques demonstrated (3)