Worked example · 2024-10
Operation Token Mirrors — FBI NexFundAI sting against crypto market-maker wash-trading-as-pump cohort — multi-CEX (centred on FBI-deployed token, NexFundAI on Ethereum) — initial charges 2024-10-09; guilty pleas + sentencings through 2025–2026
Summary
Through 2018–2024, a cohort of cryptocurrency market-maker firms — Gotbit, ZM Quant, MyTrade, CLS Global, and others — operated wash-trading-as-a-service businesses for cryptocurrency-token issuers. The market-makers offered "Volume Support" or equivalent services in which the firm operated automated trading bots that executed self-trades (buy and sell on the same venue at the same second by accounts under the firm's joint control) at sufficient volume to (a) inflate the apparent trading volume of the issuer's token to attract retail attention and CEX-listing-eligibility metrics, and (b) produce the price-action signature of organic demand on minute-resolution OHLCV that retail traders interpreted as a buy signal. The wash-trade pattern is therefore structurally a pump-signal service: the wash trade is the pump, the wash-traded artificial price spike is the signal, and the realised retail entry into the spike is the dump-counter-party.
The cohort came to FBI / IRS-CI attention in early 2024. The FBI took the unprecedented step of creating its own cryptocurrency token, NexFundAI, deployed on Ethereum, with FBI agents posing as NexFundAI promoters in Telegram chats and videoconferences with the targeted market-makers. The operation, codenamed Operation Token Mirrors, captured direct evidentiary recordings of the market-makers' sales pitches and operational coordination — including (per the DOJ filings) MyTrade founder Liu Zhou explaining that MyTrade's volume bot "does self-trades — a buy and a sell in the same second" and that the bot can be used to execute "pump and dumps," with the explicit objective being to find "other buyers from the community" because "we have to make [the other buyers] lose money to make profit."
On October 9, 2024 the US Attorney's Office for the District of Massachusetts announced charges against 18 individuals and entities — including the leadership and employees of four cryptocurrency-issuer companies and four market-maker firms (Gotbit, ZM Quant, CLS Global, MyTrade). The DOJ + SEC + FBI announcement seized over $25M in cryptocurrency. Subsequent guilty pleas through 2024–2025 produced individual operator dispositions: Liu Zhou pleaded guilty October 30, 2024 (the first-ever guilty plea by a cryptocurrency market-maker firm leader for wash trading and market manipulation); CLS Global FZC LLC pleaded guilty in January–April 2025; Aleksei Andriunin (Gotbit founder) and Gotbit pleaded guilty in March 2025 with Gotbit forfeiting $23M in cryptocurrency; Andriunin was sentenced to 8 months in prison + 1 year of supervised release. Per the Gotbit DOJ filings, Gotbit's wash-trading clients included Saitama and Robo Inu, and Gotbit had operated the wash-trading service from 2018 through 2024 across approximately 60 different cryptocurrencies.
A second-wave Operation Token Mirrors indictment was unsealed in the Northern District of California on March 30, 2026 charging ten additional foreign nationals across firms Gotbit, Vortex, Antier, and Contrarian — extending the operator-cluster identification into a broader cohort.
Why this is structurally novel
Operation Token Mirrors is OAK's named-defendant anchor for the wash-trading-as-pump-signal-service sub-pattern of T3.003 and the first-ever criminal prosecution of cryptocurrency market-maker firms for market manipulation. Three structural features distinguish this cohort and motivate its anchor status:
The market-maker fee model converts T3.002 into a T3.003 service. A "market-maker" in the cryptocurrency-token cohort is structurally distinct from a market-maker in a regulated equities market. The cohort firms (Gotbit, MyTrade, ZM Quant, CLS Global) accepted issuer-side payments for "Volume Support" services in which the firm operated wash-trade bots that produced artificial volume and price-spike signatures. The wash trade — which under T3.002 alone is a volume-inflation pattern — becomes a T3.003 pump signal because the wash trade is what produces the price-spike that retail entrants interpret as organic demand. The operator-revenue model is therefore issuer-side fee-for-service, structurally distinct from the BPS-class channel-membership-and-coordinator-position model and from the McAfee-class promoter-position-accumulation model. Future T3.003 work should record the operator-revenue model explicitly because it shapes the regulator-side evidentiary chain and the per-defendant disposition outcomes.
The FBI-deployed-token sting is the regulatory-evidence-chain anchor. Operation Token Mirrors is the first US case in which the federal government deployed its own cryptocurrency token specifically to capture evidence of market-maker wash-trading-as-pump-signal-service conduct. The structural feature is that the government created an evidentiary surface (NexFundAI, with on-chain wash-trade activity directly attributable to the targeted market-makers via the FBI-controlled deployment) that is unobtainable through retrospective evidentiary chains alone. The sting's success rate ($25M seized, multiple guilty pleas, second-wave indictment) demonstrates that the deployment-as-evidentiary-surface model is operationally effective and is likely to recur in future enforcement.
Telegram is the operator-coordination layer for the regulator-side evidentiary chain. Per the DOJ filings, the targeted market-makers' communications were primarily on Telegram — videoconferences and group chats where the operators "communicated openly, sharing memes including the phrase 'pump it up,' exchanging details about the timing and volume of wash trading activity." The Telegram-chat evidence is the bridge between the on-chain wash-trade pattern and the per-defendant intent evidence; the case is therefore the v0.1 anchor for the Telegram-as-operator-coordination-layer evidentiary chain in T3.003 prosecutions. Future T3.003 enforcement is likely to depend on similar Telegram-chat evidence; the structural lesson is that the encrypted-messaging coordination layer is itself part of the regulator-side evidentiary chain, not a defense-evasion feature that successfully evaded prosecution.
Timeline (UTC)
| When | Event | OAK ref |
|---|---|---|
| 2018–2024 | Gotbit, MyTrade, ZM Quant, CLS Global operate wash-trading-as-pump-signal-service businesses for cryptocurrency-token issuer clients (~60 cryptocurrencies per the MyTrade plea docs; Saitama and Robo Inu among Gotbit clients) | T3.002 + T3.003 (conduct window) |
| 2024-05 | FBI begins Operation Token Mirrors; deploys NexFundAI token on Ethereum and creates promotional surface (website, social-media) | (sting genesis) |
| 2024-05 → 2024-10 | FBI agents pose as NexFundAI promoters in Telegram chats / videoconferences with targeted market-makers; market-makers describe the wash-trade-as-pump-signal service and execute live wash trades on NexFundAI; FBI captures evidentiary recordings | T3.003 (sting evidence collection) |
| 2024-10-09 | US Attorney's Office (D. Mass.) + DOJ + SEC + FBI announce charges against 18 individuals and entities including leadership of four crypto-issuer companies and four market-maker firms (Gotbit, ZM Quant, MyTrade, CLS Global); >$25M cryptocurrency seized | T3.003 (regulator action — first-wave) |
| 2024-10-30 | Liu "David" Zhou (MyTrade founder) pleads guilty to conspiracy to commit market manipulation and wire fraud — first-ever guilty plea by a cryptocurrency market-maker firm leader for wash trading and market manipulation | T3.003 (first criminal disposition) |
| 2025-01 → 2025-04 | CLS Global FZC LLC pleads guilty | T3.003 (criminal disposition) |
| 2025-03-20 | Aleksei Andriunin (Gotbit founder) and Gotbit plead guilty in federal court in Boston; Gotbit forfeits ~$23M in cryptocurrency | T3.003 (criminal disposition) |
| 2025-06 | Antoine Tsao (Gotbit) pleads guilty to wire-fraud conspiracy | T3.003 (criminal disposition) |
| 2025–2026 | Andriunin sentenced to 8 months prison + 1 year supervised release; Nemanja Popov (Gotbit account manager) sentenced February 2026 | T3.003 (sentencing) |
| 2026-03-30 | Second-wave Operation Token Mirrors indictment unsealed in Northern District of California charging ten additional foreign nationals across Gotbit, Vortex, Antier, Contrarian | T3.003 (regulator action — second-wave) |
| Continuing | Operation Token Mirrors persists in OAK as the v0.1 named-defendant anchor for the wash-trading-as-pump-signal-service sub-pattern of T3.003 and as the first criminal prosecution of cryptocurrency market-maker firms | (anchor status) |
What defenders observed
- Pre-event: the pre-event detection signal for the wash-trading-as-pump-signal sub-pattern is the wash-trade volume-share signature on minute-resolution OHLCV — a coin whose volume is dominated by self-trades from a small wallet-cluster has a structural signature that distinguishes it from organic-demand volume. The pre-event signal is detectable by defenders with access to address-level CEX trading data (the regulator, the venue's own surveillance, and academic researchers with data agreements) but is not directly visible to retail traders via standard CEX UIs. Solidus Labs, Chainalysis, and similar surveillance vendors operate the venue-data-side detection pipeline; the regulator action draws on the venue-side cooperation with the surveillance infrastructure.
- At-event: the at-event detection signal is the joint-series price / volume / unique-account-growth alignment — wash-traded artificial volume produces a price spike without proportional growth in unique trading accounts. The Karbalaii 2025 microstructure corpus (
[karbalaii2025]) calibrates the joint-series detection signature on Poloniex CEX OHLCV; the same calibration generalises to the cohort's primary venues (Gate.io, Bitget, KuCoin, MEXC). - Post-event: the FBI's deployment-of-its-own-token model is the post-event evidentiary anchor — the on-chain activity on NexFundAI is directly attributable to the targeted market-makers via the FBI's controlled deployment, and the Telegram-chat evidence is the bridge between the on-chain pattern and the per-defendant intent evidence. The structural lesson for the defender side is that retrospective regulator-side evidence chains for the wash-trading-as-pump sub-pattern depend on either (a) cooperative venue-side trading-data access plus (b) seized off-chain communications evidence, or alternatively (c) prospective sting deployment of evidentiary surfaces. Pure on-chain analysis alone is not sufficient for named-defendant prosecution at v0.1.
What this example tells contributors writing future Technique pages
- Wash trading and pump-and-dump are operationally indistinguishable in the cohort. The market-maker firms in this cohort do not maintain a clean distinction between T3.002 (wash trade for volume inflation) and T3.003 (wash trade as pump signal); the same wash-trade activity functions as both, with the pump-signal aspect emerging when retail traders interpret the artificial volume / price-spike signature as an organic-demand signal. Future T3.002 / T3.003 worked examples should record the operator-intent dimension where the regulator-side evidentiary chain permits — Liu Zhou's recorded statement that the bot is for "pump and dumps" and that the objective is to make other buyers "lose money" is the canonical anchor for operator-intent evidence in the cohort.
- The FBI-deployed-token sting model is a structurally novel evidentiary surface. Future Technique pages and worked examples should record the evidentiary-surface-deployment dimension where it applies. Pre-Token-Mirrors enforcement against named operators relied primarily on retrospective on-chain analysis + cooperative venue-data access; post-Token-Mirrors enforcement is likely to use deployment-as-evidentiary-surface as a recurring tool. The OAK Detection signals sections for T3.002 and T3.003 should reflect this evidentiary-surface model where it generalises.
- The Telegram coordination layer is part of the regulator-side evidentiary chain, not a defense-evasion feature. Future T3.003 cases should record the operator-coordination layer (Telegram, Discord, WhatsApp, Signal, Telegram-internal-channels) and the regulator-access pathway (subpoena, mutual-legal-assistance treaty, sting-operative direct participation in the channel). The Token Mirrors case is the v0.1 anchor for sting-operative-direct-participation as the regulator-access pathway.
- The cohort is multi-jurisdictional but US-led. The targeted market-makers were headquartered across multiple non-US jurisdictions (UAE / Russia / China / Canada / Hong Kong) but the prosecution proceeded in US federal courts (D. Mass. for the first-wave, N.D. Cal. for the second-wave) on the basis of US-victim retail traders and the FBI-deployed token's US-deployment. Future cohort cases should record the jurisdictional asymmetry — operator-side foreign domicile is not a defense against US regulator action where US victims and US-deployed evidentiary surfaces exist.
Public references
[doj2024nexfundai]— DOJ press release "Eighteen Individuals and Entities Charged in International Operation Targeting Widespread Fraud and Manipulation in the Cryptocurrency Markets" (US Attorney's Office, D. Mass., October 9, 2024).[fortuneFBInexfund2024]— Fortune Crypto reporting "The FBI created its own crypto token in an 'unprecedented' operation to take down a market manipulation scheme" (October 9, 2024).[trmnexfundai2024]— TRM Labs forensic write-up on Operation Token Mirrors (October 2024) and ten-foreign-nationals second-wave indictment (March 2026).[mintznexfundai2024]— Mintz Levin client alert "The Murky Waters of Wash Trading Digital Assets – DOJ Charges 18 Individuals and Entities" (October 2024).[arnoldporter2024remaking]— Arnold & Porter Enforcement Edge blog "Remaking the Classics: Cryptocurrency Companies and Market Makers Charged for Wash Trading and 'Pump and Dump' Schemes" (October 2024).[dojzhou2024]— DOJ filings related to Liu Zhou (MyTrade) plea (October 30, 2024). https://www.justice.gov/d9/2024-10/zhou_information_0.pdf[coindeskgotbit2025]— CoinDesk reporting "Gotbit Founder Aleksei Andriunin Pleads Guilty to Wire Fraud, Market Manipulation" (March 20, 2025).[decryptgotbitsentence2025]— Decrypt reporting "Gotbit Got Got: Founder Sentenced to Prison for Crypto Wash Trading" (sentencing reporting on Andriunin's 8-month sentence).[karbalaii2025]— Karbalaii arXiv:2504.15790 — Poloniex CEX-side microstructure cohort companion to the wash-trading-as-pump-signal evidentiary record.
Discussion
Operation Token Mirrors is OAK's v0.1 named-defendant anchor for the wash-trading-as-pump-signal-service sub-pattern of T3.003 and is the first criminal prosecution of cryptocurrency market-maker firms in the United States. The case is structurally adjacent to the BPS-class Telegram-coordinated cohort and to the McAfee Twitter-amplified-promoter cohort but distinct in operator topology: the Token Mirrors operators are fee-for-service market-maker firms with corporate structures and named executives, not channel-administrators (BPS-class) and not individual high-reach promoters (McAfee-class). The case is the cleanest v0.1 example of the firm-as-T3.003-operator sub-pattern.
The case also establishes a novel regulator-side evidentiary-chain primitive — deployment-of-its-own-token by the federal government as evidentiary surface — that is likely to recur in future enforcement against named cohort operators. Pre-Token-Mirrors enforcement against named T3.003 operators (the McAfee CFTC case, the SafeMoon SEC enforcement) relied primarily on retrospective on-chain analysis + cooperative venue-data access + seized off-chain communications evidence; the deployment-of-its-own-token model is a structurally distinct evidentiary surface that operates prospectively rather than retrospectively. Future Technique pages and worked examples covering regulator-side enforcement classes should record the evidentiary-surface model where it applies.
For OAK's v0.x Technique work, the Token Mirrors cohort + the BPS-class cohort + the McAfee / SafeMoon promoter cohort collectively motivate the proposed T3.003 operator-topology split: (a) channel-administrator sub-pattern (Telegram / Discord coordination via channel-membership broadcast); (b) off-platform-promoter sub-pattern (Twitter / X / podcast / off-platform high-reach audience); (c) market-maker-firm sub-pattern (fee-for-service wash-trading-as-pump-signal). The three sub-patterns share the joint-series detection signature of the parent T3.003 but differ in operator-revenue model, in coordination-layer evidence chain, and in regulator-side prosecution pathway. A v0.x sub-Technique split is plausible once the cohort-evidence base for each sub-pattern matures further; at v0.1 the unified T3.003 framing remains justified by the shared joint-series detection signature.
The case also illustrates the structural feature that subsequent cohort enforcement is producing a steadily expanding named-operator evidentiary record: from 18 named individuals/entities at first-wave (October 2024), to 28+ named individuals/entities across both waves at second-wave (March 2026). The expanding record supports the case-shape's status as the v0.1 anchor for the wash-trading-as-pump-signal-service sub-pattern and its likely continued role as the canonical anchor through the v0.x cycle.