Worked example · 2014-20

OneCoin — Ruja Ignatova / Karl Sebastian Greenwood multi-level fake-cryptocurrency Ponzi — global — 2014-2017 (operating) / 2017-onward (federal action)

Loss: approximately $4B+ alleged investor loss across approximately 3.5M investors worldwide per the U.S. Department of Justice / Southern District of New York indictment and superseding-information record. The DOJ figure is the prosecuted-fraud number used in the Greenwood plea and sentencing record (December 2022 plea; September 2023 sentencing); independent estimates and victim-association tallies have ranged higher into the $4-15B band depending on whether unrecovered "OFC-claim" balances are included alongside actual cash receipts.
Recovery: partial federal forfeiture and victim-claims process — the DOJ opened the OneCoin victim-claims process in April 2026 with an approximately $40M restitution-fund cap, which is a small fraction of the alleged loss; the bulk of the proceeds were laundered offshore through European financial conduits and remain unrecovered. Mark Scott (the lawyer-money-launderer convicted in November 2019 for laundering approximately $400M of OneCoin proceeds) was disbarred and sentenced; Frank Schneider (former Luxembourg intelligence officer, OneCoin co-conspirator who managed money flows and counter-investigations) was arrested in France in 2021, lost his extradition appeal, but escaped monitored detention in May 2023 and is at v0.1 reporting horizon a fugitive.
OAK Techniques observed: OAK-T11.005.002 — fake-custodian / fake-asset-manager fraud — the canonical pre-pig-butchering-era anchor for the structural class. OneCoin presented itself as a legitimate cryptocurrency with mining, blockchain, and an internal exchange ("xcoinx"), but no public blockchain ever existed: OneCoin was a SQL-database-backed centralised ledger whose "mining" and "balance growth" were operator-controlled UI fictions distributed through a multi-level-marketing (MLM) recruitment structure. The structural class is operator-side fake-platform fraud where the platform itself is the asset of fraud — distinct from T5.005 (treasury-management exit on a real DeFi protocol), distinct from T2.x (rug-pull tokens — there was no public token contract, no AMM pool, no on-chain primitive at all), and distinct from T4 phishing (users deposited willingly; the platform itself was the fraud). Downstream techniques: OAK-T7.x — laundering through European correspondent banking (Mark Scott's BNY Mellon / Bank of Ireland routing of approximately $400M; offshore Caribbean and Middle Eastern conduits) rather than crypto mixers, because OneCoin's receivables were predominantly fiat (wired or cash-deposited by investors) rather than on-chain crypto.
Attribution: confirmed for Karl Sebastian Greenwood (DOJ Southern District of New York; pled guilty December 16, 2022; sentenced September 12-13, 2023 to 240 months / 20 years) and Mark Scott (convicted November 21, 2019 of money laundering conspiracy; disbarred). FBI Top Ten Most Wanted Fugitive for Ruja Ignatova (added June 2022; the only woman on the list at the time of addition; reward increased from $250K to $5M in June 2024 jointly by FBI + State Department under the Transnational Organized Crime Rewards Program). Confirmed federal-record indictment (October 2017 SDNY; February 2018 superseding indictment) for Ignatova on conspiracy to commit wire fraud, wire fraud, conspiracy to commit money laundering, conspiracy to commit securities fraud, and securities fraud — but Ignatova has been at large since October 25, 2017 (last seen flying from Sofia, Bulgaria to Athens, Greece). Frank Schneider's federal indictment was unsealed in December 2022; he was extradited from France in 2023 but escaped monitored detention in May 2023 and is a fugitive at v0.1 reporting horizon.
OAK-Gnn: unattributed at the operator-cluster level — OneCoin was a Bulgarian-founded MLM-Ponzi cohort with European, Middle Eastern, Asian, and Latin American distribution networks; the cohort does not map to any v0.1 OAK-Gnn cluster (which are predominantly cybercriminal / state-aligned operator clusters). The OneCoin operator surface is structurally distinct from any v0.1 OAK-G actor profile and remains pseudonymous at the cluster-attribution level despite the federal-record-confirmed individual attributions.
Key teaching point: OneCoin is the single largest pre-pig-butchering-era fake-platform fraud case on the public record, and is the canonical historical anchor for the OAK-T11.005 Operator-side Fake-Platform Fraud class. Its structural features — operator-controlled centralised ledger presented as a public blockchain, multi-level-marketing recruitment, fictitious yield ("mining" growth) tracked entirely in operator-controlled UI, and operator-mobility-and-disappearance pattern at the federal-record-indictment threshold — recur across the broader T11.005 cohort spanning 2014-2026 and have continuous lineage into the modern pig-butchering / fake-CEX cohort.

Summary

OneCoin was a fake-cryptocurrency multi-level-marketing Ponzi scheme founded in Bulgaria in 2014 by Ruja Ignatova ("Cryptoqueen", a German-Bulgarian dual citizen with a doctorate in law and a former McKinsey consultant) and co-founder Karl Sebastian Greenwood (a Swedish-British dual citizen). The scheme operated through approximately 3.5M investors across more than 175 countries between 2014 and the federal-record indictment in October 2017; it continued operating even after Ignatova's October 2017 disappearance, driven forward by Greenwood and a network of regional promoters and money-launderers including Mark Scott (the Florida-based lawyer responsible for routing approximately $400M through offshore investment-fund vehicles).

The structural fraud was a fake-cryptocurrency MLM Ponzi: investors purchased "educational packages" priced from approximately €100 to €118,000, which entitled them to "tokens" that were claimed to be redeemable for OneCoin via a future blockchain-based exchange. No public blockchain ever existed. The OneCoin "ledger" was a SQL-database-backed centralised system whose "mining" rate and "balance growth" were operator-controlled. Internal communications obtained in the U.S. trial (including Ignatova's own emails referring to OneCoin as a "trashy coin" and discussing exit strategies) confirmed that the founders were aware throughout the scheme's operation that no underlying blockchain or cryptocurrency primitive existed.

OneCoin's recruitment surface was a multi-level-marketing structure: existing investors earned referral commissions for recruiting new investors, with commission structures designed to maximise viral expansion. The MLM-recruitment surface combined with global online seminars, mass live-events at venues such as Wembley Arena (June 2016), and aggressive marketing through Ignatova's personal brand ("Dr Ruja", "Cryptoqueen") to build the global investor base.

For OAK's purposes, OneCoin is the canonical pre-pig-butchering-era anchor for the operator-side fake-platform fraud class (T11.005). The case is structurally instructive because it predates the modern fake-CEX / pig-butchering era (2020 onward) by approximately five years, demonstrating that the "operator-controlled platform whose database balance is the entire substrate of value claimed" pattern has a continuous lineage from the MLM-token-Ponzi era of the mid-2010s through the multi-asset-wallet Ponzi era (PlusToken 2018-2019) into the pig-butchering / fake-CEX era (2020-2026). The realised-loss-versus-aggregate-claimed-loss gap (~$4B+ alleged versus ~$40M restitution fund opened April 2026) is structurally informative across the cohort: OneCoin proceeds were laundered through European correspondent banking and offshore investment-fund vehicles, with the dominant laundering rail being Mark Scott's "Fenero Funds" structure that interposed Cayman-Islands-based investment-fund vehicles between OneCoin source receivables and ultimate fiat off-ramping. Crypto mixers were not the dominant laundering surface because OneCoin's receivables were predominantly fiat, not on-chain crypto — a structural feature that distinguishes pre-2018-pig-butchering-era cases from 2020-onward fake-CEX cases.

Timeline (UTC unless noted)

When	Event	OAK ref
2014	Ignatova and Greenwood found OneCoin in Bulgaria; MLM-Ponzi structure established with multi-tier referral commissions	(off-chain entry vector — OAK-T11.005.002)
2014–2017	OneCoin enrolls approximately 3.5M investors across ~175 countries; cumulative receivables on the order of ~$4B; payouts to early entrants funded entirely from later entrants' deposits	(T11.005.002 fake-custodian / fake-asset-manager Ponzi structure)
2016-06	OneCoin live-event at Wembley Arena, London; Ignatova ("Cryptoqueen") presents OneCoin as the "Bitcoin killer"; recruitment surge	(off-chain marketing — peak enrollment phase)
2017-10-12	U.S. District Court Southern District of New York issues sealed indictment / arrest warrant for Ignatova on conspiracy to commit wire fraud, wire fraud, money laundering, securities fraud	federal-record entry-point
2017-10-25	Ignatova flies from Sofia, Bulgaria to Athens, Greece; last known sighting	(operator-disappearance event)
2018-02	SDNY superseding indictment expands charges against Ignatova	(federal-record extension)
2018-07	Karl Sebastian Greenwood arrested in Thailand	(operator arrest)
2018-10	Greenwood extradited to U.S.	(operator extradition)
2019-11-21	Mark Scott convicted in SDNY of bank fraud and money laundering conspiracy for laundering approximately $400M of OneCoin proceeds through offshore "Fenero Funds" structure	T7.x — federal-record laundering attribution
2021	Frank Schneider (former Luxembourg intelligence officer, OneCoin counter-investigation manager) arrested in France on U.S. extradition warrant	(associated-actor arrest)
2022-06	Ignatova added to the FBI Ten Most Wanted Fugitives list; only woman on the list at the time of addition	FBI Most Wanted attribution
2022-12-16	Greenwood pleads guilty in SDNY to wire fraud and money laundering conspiracy (three-count superseding information; no plea agreement)	federal-record conviction
2023-09-12/13	Greenwood sentenced to 240 months (20 years) imprisonment	federal-record sentence
2023-04	French Court of Cassation rejects Schneider's extradition appeal	(extradition-affirmation)
2023-05 (mid-late)	Schneider escapes monitored detention in France; becomes fugitive	(associated-actor flight)
2024-06	FBI / State Department reward for information on Ignatova increased to $5M (TOC Rewards Program)	continuing federal-record attribution effort
2026-04	DOJ opens OneCoin victim-claims process; restitution fund approximately $40M	(partial federal-record recovery)
Continuing	Ignatova at large since October 2017; Schneider at large since May 2023; Mark Scott serving sentence; Greenwood serving 20-year sentence	(cohort recovery-phase open)

What defenders observed

The MLM-recruitment structure provides operational early-warning signals that on-chain-only telemetry cannot surface. OneCoin's primary recruitment surface was offline (in-person seminars, regional promoter networks) and the early-warning signals were off-chain: skeptic-blogger reports (BehindMLM tracked OneCoin from 2014 onward), regulator warnings (the U.K. Financial Conduct Authority warned about OneCoin in September 2016; the Bulgarian Financial Supervision Commission similarly), and investigative journalism (notably the BBC's Missing Cryptoqueen podcast which began publication in September 2019 and reconstructed the off-chain recruitment chain). The defender / framework lesson is that MLM-Ponzi attribution converges through off-chain investigative methodology rather than on-chain forensics; the OAK-T11.005 class detection surface is dominated by off-chain OSINT (regulator-warning subscription; investigative-journalism cross-reference; corporate-registry verification).
The "no underlying blockchain" claim was verifiable but not verified by the cohort at scale. OneCoin's marketing materials referred to OneCoin as a "blockchain-based cryptocurrency" continuously through 2014-2017, but no public blockchain explorer ever existed for OneCoin. Independent technical observers (Bjørn Bjercke and others) publicly identified that OneCoin's "blockchain" was a SQL-database-backed centralised ledger as early as 2017. The defender / user-side lesson is that the absence of a public blockchain explorer is a definitive disqualifying signal for any project claiming to be a cryptocurrency — and the gap between the technically-verifiable disqualifying signal and the cohort-scale uptake of the project demonstrates the structural feature of the T11.005 class: the gating constraint is user-layer enforcement of available verification primitives, not the availability of those primitives themselves.
The laundering chain ran through correspondent banking, not crypto mixers. Mark Scott's "Fenero Funds" structure interposed Cayman-Islands-based investment-fund vehicles between OneCoin source receivables and ultimate fiat off-ramping; the Bank of Ireland and BNY Mellon correspondent-banking relationships were the dominant fiat off-ramp surface. The structural feature is that pre-2018-pig-butchering-era fake-platform Ponzi cases launder through traditional correspondent banking because the receivables themselves were fiat (wired or cash-deposited), not crypto. The 2020-onward fake-CEX cohort by contrast launders predominantly on-chain (mixers, cross-chain bridges, Russian-CEX off-ramps, Huione Group / Cambodia laundering substrate) because the receivables themselves are crypto. The defender / framework lesson is that the laundering-chain fingerprint correlates with the era of the case rather than the structural class — both OneCoin (2014-2017) and PlusToken (2018-2019) are T11.005.002 fake-custodian / fake-asset-manager cases, but the laundering chains differ structurally because the receivables differ structurally.
The federal-record-attestation lag from incident onset is approximately 3-9 years. OneCoin began operations in 2014; the federal-record indictment landed October 2017 (~3 year lag); the Greenwood conviction landed December 2022 (~8 year lag); the sentencing landed September 2023 (~9 year lag); the victim-claims process opened April 2026 (~12 year lag). The defender / framework-credibility lesson is that the federal-record-attestation surface is structurally slow for the fake-platform Ponzi class, and the OAK convention's confirmed threshold (DOJ named-actor / regulator action) under-weights cases where the federal record is in motion but has not yet landed. Contributors writing future T11.005 worked examples should preserve the federal-record-versus-real-time-attribution timing dimension explicitly.
The operator-disappearance pattern (Ignatova October 2017; Schneider May 2023) is a recurring T11.005 feature. The structural feature is that key operators in the T11.005 class often retain mobility and external resources sufficient to flee jurisdictions, particularly when the operator is a national of a jurisdiction with limited extradition cooperation with the U.S. (Bulgaria for Ignatova; multiple Southeast Asian jurisdictions for Cambodia compound operators). The defender / framework lesson is that federal-record attribution does not require operator-in-custody — the OneCoin federal record (Ignatova FBI Top Ten Most Wanted; Schneider fugitive) is a confirmed attribution under OAK convention even though both individuals are at large at v0.1 reporting horizon.

What this example tells contributors writing future Technique pages

OneCoin is the canonical pre-pig-butchering-era anchor for the OAK-T11.005 Operator-side Fake-Platform Fraud class. Contributors writing future T11.005.002 worked examples should preserve the (a) MLM-Ponzi recruitment surface, (b) absence-of-underlying-blockchain disqualifying signal, (c) correspondent-banking laundering chain, (d) operator-mobility-and-disappearance pattern, and (e) multi-year federal-record-attestation lag dimensions explicitly. The case is structurally distinct from the 2020-onward fake-CEX / pig-butchering cohort along the laundering-chain dimension (correspondent banking vs. crypto mixers + Cambodia / Huione laundering substrate), but structurally identical along the platform-itself-is-the-fraud dimension.
The T11.005 family lineage spans 2014-2026 and across ~12 years of corpus history. OneCoin (2014-2017, T11.005.002) → PlusToken (2018-2019, T11.005.002, see examples/2019-06-plus-token.md) → CryptoFX (2020-2022, T11.005.002, see examples/2022-09-cryptofx-chavez.md) → CoinDeal-Chandran (2019-2022, T11.005.002, see examples/2023-01-coindeal-chandran.md) → Forsage (2020-2022, T11.005.002, see examples/2022-08-forsage-okhotnikov.md) → HyperVerse / HyperFund (2020-2022, T11.005.002, see examples/2024-01-hyperverse-hyperfund.md) → JPEX (2022-2023, T11.005.001-borderline, see examples/2023-09-jpex-hong-kong.md) → BeurAx-class fake-CEX cohort (2020-2026, T11.005.001, see examples/2020-2026-fake-cex-pig-butchering-cohort.md) → Cambodian / Burmese compound cohort (2020-2026, T11.005.003, see examples/2024-2025-southeast-asia-compound-cohort.md and the Chen Zhi / Prince Group $15B forfeiture at examples/2025-10-prince-group-chen-zhi-15b-seizure.md). The cohort's continuous lineage across structural eras is itself a teaching point: contributors should not under-weight the historical anchor cases.
Operator-mobility-and-disappearance is a first-class observable for the T11.005 class. Contributors writing future T11.005 worked examples should record (a) operator nationality, (b) jurisdiction footprint, (c) extradition-cooperation status with U.S. / EU / OECD jurisdictions, and (d) post-incident operator-mobility events. The OneCoin case anchors this dimension with two operator-flight events (Ignatova October 2017; Schneider May 2023) over a ~12-year timeline.

Public references

[doj2017ignatovaindictment] — DOJ SDNY sealed indictment of Ruja Ignatova; original federal-record entry point for OneCoin attribution.
[doj2023greenwoodsentencing] — DOJ SDNY sentencing announcement of Karl Sebastian Greenwood (September 2023); 20-year sentence; primary federal-record source.
[fbi2022ignatovamostwanted] — FBI announcement of Ignatova's addition to the Ten Most Wanted Fugitives List (June 2022); primary FBI-record source.
[state2024ignatovareward] — U.S. Department of State / TOC Rewards Program announcement of $5M reward (June 2024); primary State Department source.
[doj2022greenwoodguiltyplea] — DOJ SDNY announcement of Greenwood's guilty plea (December 2022); primary federal-record-conviction source.
[coindesk2026onecoinvictims] — CoinDesk April 2026 coverage of the DOJ-opened OneCoin victim-claims process (~$40M restitution fund).
[wikipedia2024onecoin] — Wikipedia OneCoin article; useful aggregate-secondary source for cross-referenced timelines and figures.
[bbc2019cryptoqueenpodcast] — BBC Missing Cryptoqueen podcast (Jamie Bartlett, September 2019 onward); primary investigative-journalism source for the off-chain recruitment-chain reconstruction.
[behindmlmonecoin] — BehindMLM long-running OneCoin coverage (2014 onward); primary skeptic-blogger / off-chain-OSINT source.

Citations

Existing citation keys reused: none directly — this is the first OAK example anchoring the T11.005.002 fake-custodian / fake-asset-manager fraud class for the pre-pig-butchering-era cohort.

Proposed new BibTeX entries (added to citations.bib as part of this batch):

[doj2017ignatovaindictment] — DOJ SDNY 2017 sealed indictment / arrest warrant for Ignatova (federal-record entry point).
[doj2023greenwoodsentencing] — DOJ SDNY September 2023 sentencing announcement (Greenwood 20-year sentence).
[fbi2022ignatovamostwanted] — FBI June 2022 Top Ten Most Wanted Fugitives addition.
[state2024ignatovareward] — State Department / TOC Rewards Program $5M reward (June 2024).
[doj2022greenwoodguiltyplea] — DOJ SDNY December 2022 guilty-plea announcement.
[coindesk2026onecoinvictims] — CoinDesk April 2026 victim-claims-process coverage.
[wikipedia2024onecoin] — Wikipedia OneCoin reference.
[bbc2019cryptoqueenpodcast] — BBC Missing Cryptoqueen podcast (investigative journalism).
[behindmlmonecoin] — BehindMLM OneCoin long-running coverage.

Discussion

OneCoin is the single largest pre-pig-butchering-era fake-platform fraud case on the public record, and is the canonical historical anchor for the OAK-T11.005 Operator-side Fake-Platform Fraud class. Its structural features — operator-controlled centralised ledger presented as a public blockchain, multi-level-marketing recruitment, fictitious yield ("mining" growth) tracked entirely in operator-controlled UI, and operator-mobility-and-disappearance pattern at the federal-record-indictment threshold — recur across the broader T11.005 cohort spanning 2014-2026 and have continuous lineage into the modern pig-butchering / fake-CEX cohort.

The case operationally distinguishes the pre-2018-pig-butchering-era cohort from the 2020-onward cohort along the laundering-chain dimension. OneCoin's receivables were predominantly fiat (wired or cash-deposited by investors); the laundering chain ran through European correspondent banking and Cayman-Islands-based investment-fund vehicles ("Fenero Funds" — Mark Scott's primary structure). The 2020-onward fake-CEX / pig-butchering cohort by contrast launders predominantly on-chain through crypto mixers, cross-chain bridges, Russian-CEX off-ramps, and the Huione Group / Cambodia laundering substrate. Both cohorts share the structural-class feature (the platform itself is the asset of fraud), but the laundering-chain fingerprint differs structurally because the receivables themselves differ structurally. Contributors writing future T11.005 worked examples should preserve the receivables-fiat-vs-crypto dimension as a first-class observable.

The OneCoin case also anchors the operator-mobility-and-disappearance pattern that recurs across T11.005 cases. Ignatova has been at large since October 25, 2017, despite being on the FBI Ten Most Wanted Fugitives list since June 2022 and despite a $5M State Department / TOC Rewards Program reward (June 2024). Frank Schneider escaped monitored detention in France in May 2023 after losing his extradition appeal. The structural feature is that federal-record-confirmed attribution does not require operator-in-custody — the OAK convention's confirmed strength label is independent of operator-custody status, and contributors writing future T11.005 worked examples should preserve this distinction explicitly.

The realised-loss-versus-aggregate-claimed-loss gap (~$4B+ alleged versus ~$40M restitution fund opened April 2026) is structurally informative for cohort-level recovery analysis. The OneCoin restitution-fund cap is approximately 1% of the alleged-loss figure; the broader T11.005 cohort exhibits similar realised-recovery-to-loss ratios except for cases where DOJ civil-forfeiture seizure is the dominant recovery surface (Chen Zhi / Prince Group $15B Bitcoin seizure October 2025 represents an upper bound on realised cohort recovery; Philippines compound $225M USDT seizure June 2025 represents a substantial mid-band recovery). Contributors writing future T11.005 worked examples should report the (a) realised recovery, (b) recovery surface (restitution fund vs. civil forfeiture vs. unrecovered), and (c) aggregate-claimed-loss-to-realised-recovery ratio explicitly.