U.S. FBI Cryptocurrency Phishing Enforcement: First Arrests and Prosecutions of Multiple Meme Market Makers

Source: U.S. Department of Justice

Compiled by: Wu Says Blockchain

Eighteen individuals and entities have been charged for widespread fraud and manipulation in the cryptocurrency market. A Boston court has announced charges against four cryptocurrency companies, four cryptocurrency financial services firms (known as "market makers"), and their employees.

Four defendants have pleaded guilty, another defendant has agreed to plead guilty, and three additional defendants were arrested this week in Texas, the UK, and Portugal. Over $25 million in cryptocurrency has been seized, and multiple trading bots responsible for millions of dollars in "wash trading" across approximately 60 cryptocurrencies have been shut down.

According to the indictment, the defendants made false statements about their cryptocurrency (referred to as "tokens") when creating cryptocurrency companies and generated false trading activity through fictitious transactions (known as "wash trading") to make these tokens appear to be good investment choices. These deceptive practices allegedly attracted new investors and buyers, leading to inflated trading prices. Subsequently, the defendants sold their tokens when prices were artificially high, a practice commonly referred to as "pump and dump." The largest of these cryptocurrency companies, Saitama, once had a market value reaching billions of dollars.

These cryptocurrency companies also hired financial services firms (market makers) to conduct wash trading in exchange for compensation. According to one market maker defendant who has agreed to plead guilty, the goal in the secondary market was to find "other buyers from the community, those you don't know or care about," because "we have to make [those other buyers] lose money to profit."

Three market makers—ZM Quant, CLS Global, and MyTrade—along with their employees, have been accused of conducting wash trading and/or conspiring to conduct wash trading on behalf of a cryptocurrency company called NexFundAI, created for investigative purposes by government law enforcement. A fourth market maker, Gotbit, along with its CEO and two directors, has also been charged for implementing similar schemes.

"This investigation is the first of its kind, identifying a significant number of fraudsters within the cryptocurrency industry. Wash trading has long been prohibited in financial markets, and the cryptocurrency market is no exception. These cases illustrate the situation when an innovative technology—cryptocurrency—encounters a century-old fraudulent practice—manipulating stock prices and dumping shares. The message today is: if you deceive investors through false statements, that is fraud. Our office will aggressively combat fraud, including in the cryptocurrency industry," said U.S. Acting Attorney Joshua Levy. "These charges also remind online investors to remain vigilant and conduct thorough research before entering the digital frontier. People should understand how these scams work to protect themselves when considering investments in the cryptocurrency industry."

"The FBI has uncovered a new variant of traditional financial crime in this case. 'Operation Token Mirrors' targets illegal token developers, promoters, and market makers within the cryptocurrency space. The criminal activities we have exposed have led to the indictment of the leadership of four cryptocurrency companies, four cryptocurrency 'market makers,' and their employees, who are accused of leading a complex trading scheme that defrauded honest investors, resulting in millions of dollars in losses," said Jodi Cohen, Special Agent in Charge of the FBI Boston Division. "The FBI has taken unprecedented steps to create its own cryptocurrency tokens and companies to identify, dismantle, and bring these alleged fraudsters to justice."

The U.S. Securities and Exchange Commission (SEC) has filed civil lawsuits against Gotbit, CLS, ZM Quant, Saitama, and Robo Inu for violations of securities laws. The FBI's legal attaché offices in Madrid and London, the Portuguese Judicial Police, the European Network of Fugitive Active Search Teams (ENFAST), the UK's National Crime Agency's National Extradition Unit, the IRS Criminal Investigation Boston Field Office, and the National Cryptocurrency Enforcement Team of the Computer Crime and Intellectual Property Section provided significant assistance in the investigation.

U.S. Acting Attorney Joshua S. Levy and FBI Boston Division Special Agent in Charge Jodi Cohen announced the news. U.S. Assistant Attorney Christopher J. Markham and David M. Holcomb from the Securities, Financial, and Cyber Fraud Section are prosecuting these cases.

The details in the indictment are allegations. The defendants are presumed innocent unless proven guilty beyond a reasonable doubt in court.

The following individuals and entities have been indicted in the U.S. District Court in Boston, Massachusetts:

Aleksei Andriunin, Fedor Kedrov, Qawi Jalili, Gotbit Consulting LLC (Gotbit)—According to court documents, Gotbit is a well-known "market maker" in the cryptocurrency industry. Aleksei Andriunin (26, Russia and Portugal) is the CEO and founder of Gotbit. Andriunin was arrested in Portugal on October 8, 2024, and is awaiting extradition. Fedor Kedrov (Russia) is the market-making director at Gotbit. Qawi Jalili (Russia) is the sales director at Gotbit. Gotbit, Kedrov, and Jalili are charged with wire fraud, conspiracy to commit market manipulation, and wire fraud. Andriunin is also separately charged in another criminal indictment with wire fraud, conspiracy to commit market manipulation, wire fraud, and conspiracy to commit money laundering. It is alleged that between 2018 and 2024, Gotbit provided market manipulation and wash trading services to multiple cryptocurrency companies, including those based in the U.S. Allegedly, Gotbit conducted wash trades worth millions of dollars on behalf of clients and earned tens of millions of dollars from these illegal services. In an online interview released in 2019, Andriunin described how he developed code for wash trading to artificially increase trading volume in cryptocurrencies. It is alleged that Andriunin documented Gotbit's market manipulation activities in spreadsheets, comparing the "false trading volume" generated by wash trading with the naturally occurring "market trading volume." Allegedly, Gotbit employees, including Jalili and Kedrov, introduced these wash trading strategies to potential clients and discussed how to avoid detection by regulators. Jalili and Kedrov also provided these services for multiple cryptocurrencies, including Saitama and Robo Inu.

Riqui Liu, Baijun Ou, ZM Quant Investment LTD (ZM Quant)—ZM Quant is a "market maker" in the cryptocurrency industry, allegedly providing clients with illegal market manipulation services. Liu Riqui (26, UK and Hong Kong) is an employee of ZM Quant. Baijun Ou (32, Hong Kong) is also an employee of ZM Quant. ZM Quant, Liu, and Ou are charged with wire fraud and conspiracy to commit market manipulation and wire fraud in an amended indictment.

According to court documents, ZM Quant is accused of promoting a "trading bot" that could "generate trading volume." Allegedly, ZM Quant employees discussed these illegal services with clients via Telegram messages and video conferences. For example, according to the indictment, during a video conference in March 2024, Liu and Ou detailed how ZM Quant could trade "possibly ten or twenty times" per minute to "increase trading volume" and "push up prices." Liu and Ou also described how ZM Quant used multiple trading wallets to avoid trades appearing "false." It is further alleged that ZM Quant provided market manipulation services for multiple cryptocurrency companies, including Saitama and NexFundAI.

Andrey Zhorzhes, CLS Global FZC, LLC (CLS)—CLS is a "market maker" in the cryptocurrency industry, allegedly providing clients with illegal market manipulation services. Andrey Zhorzhes, from the UAE, is an employee of CLS. Both CLS and Zhorzhes are charged with wire fraud and conspiracy to commit market manipulation and wire fraud.

It is alleged that Zhorzhes described to potential clients how CLS's algorithm generated trading volume across multiple cryptocurrency exchanges, as follows:

• "We have an algorithm… basically self-trading, buying and selling."

• "The idea of generating trading volume is… to make the tokens look organic, real, and to generate interest in trading."

• "This is very hard to trace… we've done this for many clients."

• "I know this is wash trading, and I also know people might not be happy about it."

It is alleged that Zhorzhes and other CLS traders provided these market manipulation services for NexFundAI.

Liu Zhou, MyTrade MM—MyTrade MM is another "market maker" in the cryptocurrency industry, allegedly providing clients with illegal market manipulation services, including "pump and dump" consulting services and "wash trading" conducted by "bots." Liu Zhou (39, Chinese and Canadian citizen) is the founder of MyTrade MM. Liu Zhou has been charged and has agreed to plead guilty to conspiracy to commit market manipulation and wire fraud.

MyTrade MM's clients can access these services through a dashboard on the MyTrade MM website, where clients can specify the desired wash trading volume per day in designated cryptocurrency exchanges. MyTrade MM's dashboard describes the service as "volume support" and allows for millions of wash trades per day for each client's cryptocurrency. For example:

In conversations with alleged promoters of NexFundAI, Liu Zhou claimed to describe MyTrade MM as superior to "CLS" and "Gotbit," because those market makers "kept clients in the dark" and "controlled the pump and dump," meaning "they could easily engage in insider trading." Allegedly, Liu Zhou also described various purposes of wash trading, including showing "continuous trading activity every hour," generating sufficient trading volume to exempt cryptocurrency exchanges from listing fees, and implementing "pump and dump." According to court documents, Liu Zhou further described that the goal in the secondary market was to find "other buyers from the community, those you don't know or care about," because "we have to make [those other buyers] lose money to profit."

Manpreet Kohli, Haroon Mohsini, Nam Tran, Max Hernandez, Russell Armand, Vy Pham, Saitama LLC (Saitama)—Saitama is a cryptocurrency company that was initially registered in Massachusetts in August 2021.

Manpreet Kohli, 43, from the UK, is the CEO of Saitama. Kohli was arrested in the UK on October 7, 2024, and is currently awaiting extradition. Haroon Mohsini, 37, from Texas, also worked at Saitama. Mohsini was arrested in the Southern District of Texas on October 7, 2024. Nam Tran, 32, from Vietnam, worked at Saitama and is currently in Vietnam. Kohli, Mohsini, and Tran are all charged in an amended indictment with wire fraud, market manipulation, and conspiracy to commit wire fraud, market manipulation, and operating an unlicensed money transmitting business. Max Hernandez, 36, from Massachusetts, and Russell Armand, 42, from Texas, also worked at Saitama and have been separately indicted and pleaded guilty to market manipulation, conspiracy to commit wire fraud, and operating an unlicensed money transmitting business. Vy Pham, 32, from California, has also been indicted for actions related to another cryptocurrency company but admitted to certain actions related to Saitama in a plea agreement.

It is alleged that Saitama claimed to create a series of products that could be used in conjunction with its tokens and, at its peak, claimed a market value of $7.5 billion. The leadership of Saitama issued various false public statements, including that its business plan had been approved by regulators, that its leadership had not sold their Saitama tokens, and that the code design of Saitama tokens prevented market manipulation. According to the indictment, in reality, the leadership of Saitama was actively manipulating the Saitama token market and secretly selling their Saitama tokens, profiting tens of millions of dollars.

Saitama's market manipulation activities began around July 2021, when its leadership coordinated a series of small purchase transactions spread across multiple cryptocurrency wallets. These transactions were coordinated via Telegram, with Armand explaining that the purpose was to "create the illusion of a large number of buyers and new holders," to "stimulate people to buy more… we want these small buy orders to look like more buyers. That's the plan." The leadership of Saitama confirmed these purchases to each other and discussed how to successfully encourage others to buy Saitama cryptocurrency, during which they exchanged "PUMP IT" memes and GIFs:

Subsequently, the leadership of Saitama paid fees to multiple market makers, requesting them to conduct wash trading of Saitama cryptocurrency on exchanges including BitMart, LBank, and XT.com. Allegedly, the market makers paid by Saitama included ZM Quant and Gotbit.

Robo Inu Finance (Robo Inu)—Robo Inu is a cryptocurrency company created by Vy Pham after leaving Saitama in 2021. Pham has been indicted and has agreed to plead guilty to conspiracy to commit market manipulation, conspiracy to commit wire fraud, and operating an unlicensed money transmitting business. Pham established and promoted Robo Inu in the U.S. Similar to Saitama, Robo Inu claimed to create a series of products that could be used in conjunction with its cryptocurrency. Starting around 2022, Robo Inu paid Gotbit to artificially increase the trading volume of Robo Inu tokens through wash trading on exchanges like Bitmart.

Michael Thompson, VZZN—VZZN is a cryptocurrency company created by Armand after leaving Saitama in 2023. Michael Thompson, 50, from Virginia, also works at VZZN. Like Armand, Thompson has been charged and pleaded guilty to conspiracy to commit market manipulation. It is alleged that VZZN claimed to be a video streaming service that could be used with VZZN tokens. While promoting the service, Armand and Thompson also issued misleading public statements about VZZN and artificially increased the trading volume of VZZN tokens through wash trading.

Bradley Beatty, Lillian Finance LLC (Lillian Finance)—Lillian Finance is a cryptocurrency company founded by 48-year-old Florida resident Bradley Beatty. Beatty is charged with wire fraud. It is alleged that Lillian Finance claimed to use blockchain technology for the healthcare industry and that part of the proceeds from token sales would be used for charitable purposes. Beatty made a series of false statements to attract investors, such as claiming to be a defense contractor and having spoken to Congress on cryptocurrency issues. Subsequently, Beatty earned hundreds of thousands of dollars through retail sales of Lillian Finance tokens and misappropriated part of Lillian Finance's profits intended for charity.

Market manipulation charges carry a maximum sentence of 20 years in prison, up to 3 years of supervised release, a maximum fine of $5 million or twice the amount of the criminal proceeds or losses, and forfeiture of illegal proceeds. Wire fraud charges carry a maximum sentence of 20 years in prison, up to 3 years of supervised release, a maximum fine of $250,000 or twice the amount of the criminal proceeds or losses, and forfeiture of illegal proceeds and restitution. Conspiracy to commit wire fraud, market manipulation, and/or operating an unlicensed money transmitting business carries a maximum sentence of 5 years in prison, up to 3 years of supervised release, a maximum fine of $250,000 or twice the amount of the criminal proceeds or losses, and forfeiture of illegal proceeds and restitution. Conspiracy to commit money laundering carries a maximum sentence of 20 years in prison, up to 3 years of supervised release, a maximum fine of $500,000 or twice the value of the criminal proceeds, whichever is greater, and forfeiture of illegal proceeds. Sentences are determined by federal district court judges based on the U.S. Sentencing Guidelines and relevant laws.