Author: Kuri, Deep Tide TechFlow

Two years ago, FBI agents disguised themselves as the founding team of an "AI and finance crossover" investment project and issued a token called NexFundAI on Ethereum, complete with a website, white paper, and business plan, looking no different from any legitimate project on the market.

Then they approached market makers for trading.

One of the functions of market makers is sometimes to help projects inflate their trading volume. The industry term is "volume support," which translates to boosting volume in Chinese.

FBI's undercover agents contacted several well-known market makers individually and got straight to the point: we have a new project that needs help inflating its trading volume.

According to the indictment released by the U.S. Department of Justice, each one said, sure.

No one asked if the project was compliant, no one asked if the token had real utility, no one asked if this was illegal. According to court documents released by the U.S. Department of Justice, four market makers — Gotbit, ZM Quant, CLS Global, MyTrade — all took the orders.

One founder, when meeting with the undercover agent, referred to himself as the "mastermind" in front of a recording device. He detailed how his company used bots to place buy and sell orders simultaneously to create fake trading volume, and how they made the candlestick charts look roller-coaster-like to attract retail investors.

Then he said a sentence that the FBI meticulously recorded. According to Cointelegraph quoting the indictment, he said:

We must make them lose money for us to make money.

"They" refers to retail investors.

This operation is codenamed Operation Token Mirrors. According to a notice from the U.S. Department of Justice on October 9, 2024, the first 18 individuals were indicted, and over $25 million in cryptocurrency assets were seized. According to an announcement from the IRS on March 30 of this year, a second batch of 10 individuals were indicted, with three extradited from Singapore to the U.S.

Two years, three continents, 28 people. This is the largest law enforcement action for market manipulation in cryptocurrency history. And it is not over yet.

A Quote Sheet

How did these market makers operate?

According to the indictment released by the U.S. Department of Justice, Gotbit's founder Andriunin maintained an electronic spreadsheet within the company, with two columns of data side by side, one labeled "Created Volume" and the other "Market Volume."

To translate, one column is the fake volume they created, and the other column is the actual trading that occurred in the market.

This person was interviewed by CoinDesk in 2019 while still a sophomore at Moscow State University, at 20 years old, and he detailed how he wrote code to create fake volume and how he helped clients boost their tokens onto CoinMarketCap's trending list. According to the original text from CoinDesk, he himself stated that this business is "not entirely ethical."

After the interview aired, he did not receive any subpoenas and instead gained five new clients.

By the time of his arrest in 2024, Gotbit had been operating for six years, servicing projects globally. According to the sentencing announcement from the U.S. Department of Justice, Andriunin was ultimately sentenced to 8 months in prison, Gotbit was ordered to be dissolved, and approximately $23 million in cryptocurrency assets were forfeited.

Gotbit was not the cheapest.

According to the indictment, another market maker quoted the cost of creating a $1 million daily trading volume at around $200. According to court documents cited by Cointelegraph, an employee from ZM Quant explained to an FBI undercover agent over a recorded call: "We achieve the target trading volume by using one thousand to two thousand wallets, trading ten times an hour or ten times a minute."

The cost for each transaction was about $3.

CLS Global was even more thorough. According to the SEC's investigation documents, this company registered in the UAE executed 740 fake transactions using 30 wallets, generating nearly $600,000 in fake trading volume, accounting for 98% of the total trading volume of the fake token NexFundAI created by the FBI during the same period.

$7.5 Billion of Air

Market makers are tools; the ones hiring them are the main characters.

According to the indictment from the U.S. Department of Justice, the biggest client unveiled by this FBI sting operation was called Saitama, a cryptocurrency company registered in Massachusetts in 2021 that claimed a market cap of $7.5 billion at its peak.

What does $7.5 billion mean? Greater than many legitimate listed companies on Nasdaq at that time.

But according to the indictment, how did this number come about? Starting from July 2021, Saitama's management coordinated actions in a Telegram group, using multiple wallets to place small buy orders, creating the illusion of "a large influx of new buyers."

According to Telegram chat records cited in the indictment, a core member explained the purpose of the operation by saying, "We want these small buy orders to look like more buyers, that's the plan."

In the chat records, they also confirmed purchases with each other and celebrated retail investors following the trend with "PUMP IT" memes and GIFs.

According to the same indictment, Saitama subsequently spent money hiring market makers including ZM Quant and Gotbit to conduct large-scale volume inflation on exchanges like BitMart and LBank. After the market cap was pushed up, the management quietly sold off their tokens for tens of millions of dollars. According to the DOJ announcement, Saitama's CEO was arrested in the UK, and five former and current employees were indicted, three of whom pleaded guilty.

Saitama was not the only one.

According to the same indictment, a project called Lillian Finance, founded by 48-year-old Bradley Beatty from Florida, claimed to be a defense contractor, stating he had testified on cryptocurrency issues in Congress, and promised that part of the token sale revenues would be used for charity to help children with medical expenses.

According to the indictment, all these claims were fabricated. Beatty pocketed profits that were supposed to be used for charity.

Defense contractor, congressional testimony, children's medical charity — you just need to craft a narrative compelling enough and find a market maker to make the candlestick charts look good, and it is enough to attract some people to FOMO in.

Looking back on these cases, the most uncomfortable thing is not how sophisticated the scams are, but rather how crude the scams are.

The FBI's Token is Quite Proper

After the operation ended, the FBI did one thing.

According to an announcement from the U.S. Department of Justice, the NexFundAI website is still up, but now has an additional banner at the top stating: "This website was created under the guidance of the Federal Bureau of Investigation for the purpose of investigating cryptocurrency fraud and market manipulation." Below the banner is a link to the full text of the DOJ indictment.

The FBI also specifically opened a victim registration channel. According to the original DOJ announcement, anyone who lost money on NexFundAI or related tokens could fill out a form to apply for compensation and legal protection.

The FBI issued a token, proactively disclosed information after the operation, and provided a compensation channel for those who lost money; compared to the projects that were caught this time, its process may be much more legitimate.

The most absurd thing is still to come.

According to a report from blockchain analysis company TRM Labs, less than 24 hours after the DOJ announcement, someone cloned the FBI's NexFundAI smart contract and issued a counterfeit token. This person started with about $2,300 and cashed out over 52 ETH within 24 hours, equivalent to around $127,000 at that time's token price.

The FBI proved market makers' forgery with a fake token, and the day the news spread, someone used the same method to create a meme token and made a profit. Law enforcement took two years, but the market took two hours to digest the whole event and create a new air token.

So the next time you see a meme suddenly soaring, you might want to think about whether it's a performance or real trading.

Of course, it could also be the FBI.