Worked example · 2021-03

McAfee / Watson digital-asset pump-and-dump CFTC + DOJ enforcement — multi-CEX (Twitter-amplified) — 2017-12 / 2018-01 conduct; charges 2021-03-05

Loss: >$2M in alleged operator profits per the CFTC complaint (CFTC v. McAfee and Watson, S.D.N.Y. filed March 5, 2021), realised across the December 2017 – January 2018 conduct window during which McAfee's Twitter-amplified "coin of the day" / "Crypto Team" promotions targeted thinly-traded altcoins. Aggregate retail loss is not separately tabulated in the CFTC complaint but the structural transfer was from retail buyers entering on McAfee's Twitter-amplified promotions (McAfee then operated a >1M-follower Twitter account) to the operator cohort that had accumulated position before the promotion.
OAK Techniques observed: OAK-T3.003 (Coordinated Pump-and-Dump) — primary; this is the first US CFTC enforcement action for a manipulative pump-and-dump scheme involving digital assets and the canonical v0.1 named-defendant Twitter-coordinated-pump case. The scheme is a promoter-coordinated sub-variant of T3.003 (off-platform reach via X / Twitter rather than channel-administrator coordination via Telegram). OAK-T17.001 (Cross-Venue Arbitrage-Driven Price-Discovery Distortion — compositing with T3.003: the operator cohort's pre-positioning, Twitter-amplified promotional pump, and subsequent dump into the demand surge constitutes a market-manipulation primitive that distorted price discovery across the named tokens' trading venues; the CFTC's own characterisation of the conduct as a "manipulative scheme" places it at the T17↔T3.003 overlap that the T17 tactic page explicitly cross-references as the influencer-amplified pump-and-dump cohort). OAK-T6 (Defense Evasion) — modifier: per the complaints, the promotion posts allegedly omitted the operators' pre-acquisition of positions and the promoter / promoted-issuer compensation arrangements that underlay some posts (the so-called touting sub-pattern under §17(b) of the Securities Act).
Status: CFTC civil action filed March 5, 2021 in S.D.N.Y. against John David McAfee and Jimmy Gale Watson Jr. seeking restitution, disgorgement, civil monetary penalties, and trading bans. Parallel SDNY criminal indictment (DOJ) on the same date charging conspiracy to commit commodities and securities fraud, wire fraud, wire fraud conspiracy, conspiracy to commit securities touting fraud, and money laundering. McAfee was found dead in a Spanish prison cell on June 23, 2021 while awaiting extradition — the criminal charges against him were terminated. Watson reached settlement / plea proceedings in subsequent years; the CFTC case against the McAfee estate was concluded with the resolution of the bodyguard's matter per [blockmcafeecftc2022] (the Block 2022 reporting).
Attribution: confirmed (verified) — the CFTC and DOJ complaints publicly name John David McAfee and Jimmy Gale Watson Jr. as the operators; the conduct is documented in the federal complaints. The case is the highest-profile US-government-pursued T3.003 prosecution at v0.1 alongside the SafeMoon prosecution, and is the canonical Twitter-amplified-promoter sub-pattern's named-defendant anchor.
Key teaching point: The McAfee / Watson case is OAK's v0.1 named-defendant anchor for the Twitter-amplified-promoter sub-pattern of T3.003 and the first US CFTC enforcement action for a manipulative scheme involving digital assets. The case is structurally adjacent to the SafeMoon prosecution (examples/2023-11-safemoon-charges.md) and the Save the Kids / FaZe Clan promoter cohort but distinct in operator topology: McAfee was an individual high-reach promoter with a small executive-adviser cohort, not a deployer-author (SafeMoon) and not a celebrity-cluster (FaZe Clan / Save the Kids). The case is the cleanest v0.1 example of the individual-promoter-as-T3.003-operator sub-pattern.

Summary

Through December 2017 – January 2018, John McAfee — the founder of the antivirus company that bears his name and an active cryptocurrency commentator — operated a Twitter-amplified promotional campaign for digital-asset tokens. McAfee's Twitter account (>1M followers in the conduct window) issued a stream of "coin of the day" posts and longer-form endorsements naming specific altcoins; per the CFTC and DOJ complaints, McAfee and his executive adviser Jimmy Gale Watson Jr. (and a "Crypto Team" of associates) secretly accumulated positions in the named tokens before publishing the endorsements, then sold the accumulated positions into the demand surge that the endorsements produced.

The CFTC complaint (CFTC Press Release 8366-21, March 5, 2021) alleges that the named tokens included Verge (XVG), Dogecoin (DOGE), and Reddcoin (RDD), among others, and that the operator cohort realised more than $2M in profits from the manipulative scheme. The complaint additionally alleges a separate "scalping" sub-scheme involving Initial Coin Offerings (ICOs) where McAfee accepted undisclosed compensation from token issuers in exchange for promoting the tokens to his Twitter following.

The CFTC's action was the first enforcement action by the agency for a manipulative scheme involving digital assets and is structurally significant for OAK because it establishes the named-defendant precedent for the Twitter-amplified-promoter pump-and-dump sub-pattern of T3.003 — a sub-pattern in which the operator's reach is off-platform (X / Twitter) rather than channel-administrator (Telegram / Discord). The Twitter-amplified-promoter sub-pattern subsequently recurs through the Andrew Tate / Logan Paul / FaZe Clan celebrity-shill cohort and through the SafeMoon prosecution; McAfee is the v0.1 anchor for the structural pattern.

McAfee was found dead in a Spanish prison cell on June 23, 2021 while awaiting extradition to the United States; the criminal proceedings against him were terminated upon his death. The CFTC case against his estate continued and the bodyguard / co-defendant Watson reached settlement / plea proceedings; the case was concluded with the resolution of the bodyguard's matter (per The Block reporting in [blockmcafeecftc2022]).

Why this is structurally novel

The McAfee / Watson case is OAK's named-defendant anchor for the Twitter-amplified-promoter pump-and-dump sub-pattern of T3.003 and is the first US CFTC enforcement action for a manipulative scheme involving digital assets. Three structural features distinguish this case and motivate its anchor status:

Off-platform-promoter reach is the coordination surface. The McAfee operator cohort did not operate a Telegram / Discord coordination channel of the BPS-class type; the coordination surface was McAfee's >1M-follower Twitter account. The structural primitive is off-platform high-reach social-media-promoter status — the operator's pre-existing audience is the demand-side amplifier. This is the same structural primitive that subsequently recurs in the celebrity-shill cohort (FaZe Clan / Save the Kids; Andrew Tate / DADDY; SafeMoon) and in the Hayden Davis / Kelsier-cohort sovereign-endorsement cases (LIBRA / Milei). The McAfee case is the v0.1 named-defendant anchor for the off-platform-promoter sub-pattern.
The first-CFTC-digital-asset-manipulation precedent is the regulatory anchor. The CFTC's jurisdictional claim — that digital-asset spot manipulation is within the agency's anti-fraud authority — was a structural extension of US enforcement reach into the digital-asset spot market that had not previously been pursued. The McAfee case is therefore the v0.1 regulator-side anchor for T3.003 enforcement under the Commodity Exchange Act's anti-manipulation provisions, complementary to the SEC-side anchor (SafeMoon) under the securities-fraud framework.
The promoter-disclosure failure (§17(b) touting) is the secondary structural pattern. Beyond the pure pump-and-dump scheme, the CFTC and DOJ complaints allege that McAfee accepted undisclosed compensation from ICO issuers in exchange for promotional posts. This is a securities-touting sub-pattern under §17(b) of the Securities Act — the operator's promotional posts were materially misleading because they omitted the issuer-side compensation arrangement. The touting sub-pattern is structurally adjacent to the pump-and-dump sub-pattern but distinct: in pump-and-dump, the operator profits from price appreciation of pre-acquired positions; in touting, the operator profits from issuer-side compensation. Many real-world cases (including this one) combine both sub-patterns; future T3.003 cases should record the operator's revenue model explicitly to distinguish the sub-patterns.

Timeline (UTC)

When	Event	OAK ref
2017-12 → 2018-01	McAfee + Watson + "Crypto Team" allegedly accumulate positions in target altcoins (Verge, Dogecoin, Reddcoin, others) and publish Twitter endorsements that produce demand surges; operator cohort exits into the surges	T3.003 (conduct window)
2017–2018 (separately)	McAfee allegedly accepts undisclosed compensation from ICO issuers in exchange for promotional Twitter posts	T3.003 (touting sub-pattern)
2020-10	DOJ unrelated tax-fraud charges against McAfee (separate matter — McAfee subsequently arrested in Spain 2020-10 and held pending extradition)	(background — context for 2021 charges)
2021-03-05	CFTC files civil complaint in S.D.N.Y. seeking restitution, disgorgement, civil monetary penalties, and trading bans (CFTC v. McAfee and Watson, Press Release 8366-21)	T3.003 (regulator action — first US CFTC digital-asset-manipulation case)
2021-03-05	DOJ unseals SDNY criminal indictment against McAfee and Watson on conspiracy to commit commodities and securities fraud, wire fraud, wire fraud conspiracy, conspiracy to commit securities touting fraud, and money laundering	T3.003 (criminal action)
2021-06-23	McAfee found dead in Spanish prison cell while awaiting extradition; criminal proceedings against him terminated	(defendant disposition)
2022	CFTC case against the McAfee estate concluded; resolution of the bodyguard / co-defendant matter per The Block reporting	(case disposition)
Continuing	The McAfee case persists in OAK as the v0.1 named-defendant anchor for the Twitter-amplified-promoter sub-pattern of T3.003 and as the first US CFTC digital-asset-manipulation precedent	(anchor status)

What defenders observed

Pre-event: the pre-event detection signal for the Twitter-amplified-promoter sub-pattern is the operator's accumulation behaviour in the target coin during the 1–24-hour window before the endorsement post — but on-chain accumulation by an operator who is not yet publicly attributed to the Twitter handle is hard to detect in real-time. The retrospective evidentiary chain (CFTC complaint reconstructs the accumulation pattern from on-chain data + Twitter post timestamps) is what permitted the regulator action; the real-time detection signal at the time of the conduct was weak.
At-event: the joint-series price / volume signal — sharp upward price move on rising volume immediately after a high-reach promoter post — is the canonical at-event detection primitive. The McAfee posts produced minute-resolution price spikes on the named coins that are visible in CEX OHLCV; the spikes are the structural signature that subsequently became the load-bearing feature in academic detection corpora (Bolz et al., Karbalaii).
Post-event: the retrospective-evidentiary-chain is what permits the regulator action — on-chain accumulation timestamps + Twitter post timestamps + post-promotion price-decline shape collectively establish the manipulation pattern. The McAfee case is the canonical anchor for the chain: CFTC and DOJ complaints reconstructed the conduct from public-record on-chain and Twitter data plus internal-communications evidence (texts among the "Crypto Team").

What this example tells contributors writing future Technique pages

Twitter / X is a coordination surface for T3.003 just as Telegram / Discord is. The structural primitive is channel-with-administrator-control-and-broadcast-reach, which Twitter / X provides via the operator's owned high-follower account. Future T3.003 worked examples should record the operator-reach surface (Telegram channel-membership / Discord server-membership / Twitter follower-count / podcast-audience-size) as a load-bearing structural variable; the celebrity-shill and Twitter-amplified-promoter sub-patterns differ from the channel-administrator sub-pattern primarily in this surface.
Off-chain communications evidence is part of the load-bearing evidentiary chain. The CFTC and DOJ complaints relied on internal text-message communications among the "Crypto Team" to establish the coordination of pre-promotion accumulation and post-promotion exit. Future T3.003 cases will increasingly depend on this kind of off-chain evidence (the Operation Token Mirrors / NexFundAI sting subsequently obtained Telegram-chat evidence from the targeted market makers; per examples/2024-10-operation-token-mirrors-nexfundai.md). The on-chain evidence alone is rarely sufficient for named-defendant prosecution — the off-chain communications evidence is what bridges the evidentiary gap between cohort-level statistical evidence and individual-defendant intent evidence.
The first-of-its-kind regulator action is a structural inflection. The CFTC's first digital-asset-manipulation case is the regulatory-precedent anchor that subsequent cases (Token Mirrors, SafeMoon, MyTrade / Gotbit / CLS Global guilty pleas) build on. Future Technique pages covering regulator-side enforcement classes should record the first-of-its-kind precedent explicitly because it shapes the subsequent enforcement landscape.
Operator death does not eliminate the regulator-action evidentiary record. McAfee's death terminated the criminal action against him personally but the regulator-action evidentiary record (CFTC complaint, DOJ indictment, public-record on-chain and Twitter evidence) persists as a load-bearing OAK reference. Future Technique pages should preserve the case-evidentiary record even where the per-defendant disposition is incomplete.

Public references

[cftcmcafee2021] — CFTC Press Release 8366-21 "CFTC Charges Two Individuals with Multi-Million Dollar Digital Asset Pump-and-Dump Scheme" (March 5, 2021). https://www.cftc.gov/PressRoom/PressReleases/8366-21
[ropesgrayMcafee2021] — Ropes & Gray client alert "The CFTC Signals New Era in Enforcement of Cryptocurrency Trading with Action Against Antivirus Software Pioneer John McAfee" (March 2021).
[blockmcafeecftc2022] — The Block reporting on the conclusion of the CFTC case against the McAfee estate / Watson matter (2022).

Discussion

The McAfee / Watson case is OAK's v0.1 named-defendant anchor for the Twitter-amplified-promoter sub-pattern of T3.003 and the first US CFTC enforcement action for a manipulative scheme involving digital assets. The case is structurally adjacent to the SafeMoon prosecution (examples/2023-11-safemoon-charges.md) and the Save the Kids / FaZe Clan promoter cohort but distinct in operator topology: McAfee was an individual high-reach promoter with a small executive-adviser cohort, not a deployer-author (SafeMoon) and not a celebrity-cluster (FaZe Clan / Save the Kids). The case is the cleanest v0.1 example of the individual-promoter-as-T3.003-operator sub-pattern.

The case also illustrates a structural feature that recurs in the cohort: the operator-disposition outcomes are bifurcated between regulator-side civil resolution (CFTC against the McAfee estate; SafeMoon SEC enforcement) and criminal-side resolution (DOJ indictment terminated by McAfee's death; SafeMoon DOJ criminal action ongoing at v0.1 cutoff). The bifurcated disposition outcomes are characteristic of T3.003 cases; future Technique pages and worked examples should preserve the bifurcation and record both regulator-side and criminal-side dispositions where they exist.

For OAK's v0.x Technique work, the McAfee / Watson + SafeMoon + FaZe Clan / Save the Kids cohort collectively motivate the proposed T3.003.x off-platform-promoter sub-Technique (operator's coordination surface is owned audience on a high-reach social-media platform) as distinct from the T3.003.y channel-administrator sub-Technique (operator's coordination surface is administrative control of a high-membership Telegram / Discord channel). The two sub-Techniques share the joint-series detection signature of the parent T3.003 but differ in coordination surface and in the regulatory-evidence chain — a v0.x split is plausible once additional named-defendant cases anchor each sub-pattern independently.