Two years ago, FBI agents impersonated the founding team of a fictional "AI and finance crossover" project and launched a token called NexFundAI on Ethereum, complete with a website, whitepaper, and business plan—indistinguishable from any legitimate project in the market.

Then they approached market makers to provide liquidity.

One function of market makers is occasionally to artificially inflate trading volume. Industry jargon calls this "volume support"—commonly known in Chinese as "volume pumping."

FBI undercover agents contacted several well-known market makers in the industry, directly stating: "We have a new project; we need someone to help boost trading volume."

According to the indictment released by the U.S. Department of Justice (DOJ), each one responded with "Sure."

No one questioned whether the project was compliant, no one asked if the token had real utility, no one questioned whether such actions were illegal. According to DOJ court filings, four market makers—Gotbit, ZM Quant, CLS Global, and MyTrade—all accepted the order.

During a meeting with an undercover agent, one founder, speaking directly into a recording device, referred to himself as the "mastermind." He detailed how his company used bots to simultaneously place buy and sell orders to fabricate false trading volume, and how they shaped candlestick charts to resemble rollercoasters, luring retail investors into jumping in.

Then he said a line that the FBI recorded verbatim. Citing the indictment, Cointelegraph reported:

We must make them lose money so we can profit.

"They" refers to retail investors.

This operation was codenamed Operation Token Mirrors. According to a DOJ announcement on October 9, 2024, the first wave of 18 individuals were charged, with over $25 million in crypto assets seized. According to an IRS announcement on March 30 of this year, a second wave of 10 people were indicted, including three extradited from Singapore.

Two years. Three continents. Twenty-eight people. This marks the largest market manipulation enforcement action in cryptocurrency history—and it’s not over yet.

A Price Quote

How do these market makers operate?

According to the DOJ indictment, Gotbit’s founder Andriunin maintained an internal spreadsheet showing two columns side by side—one labeled "Created Volume," the other "Market Volume."

Translated: one column represents fabricated volume created by them, the other shows actual market transactions.

In a 2019 interview with CoinDesk while still a sophomore at Moscow State University, the 20-year-old explained on camera how he wrote code to generate fake volume and helped clients push tokens onto CoinMarketCap’s trending lists. According to CoinDesk’s original report, he admitted the business was “not entirely ethical.”

After the interview aired, he received no subpoenas—instead, he landed five additional clients.

By the time he was arrested in 2024, Gotbit had operated for six years, serving projects worldwide. According to DOJ sentencing documents, Andriunin was ultimately sentenced to eight months in prison, Gotbit was ordered dissolved, and approximately $23 million in crypto assets were seized.

Gotbit wasn’t the cheapest.

According to pricing disclosed in the indictment from another market maker, generating $1 million in daily trading volume cost roughly $200. Citing court documents, ZM Quant employees told FBI undercover agents on a recorded call: "We use between 1,000 to 2,000 wallets, trading ten times per hour or ten times per minute, to hit our target volume."

The average cost per transaction was about $3.

CLS Global went further. According to SEC investigation files, this UAE-registered firm executed 740 fake trades using just 30 wallets, creating nearly $600,000 in fraudulent volume—accounting for 98% of NexFundAI’s total trading volume during the period monitored by the FBI.

$7.5 Billion of Air

Market makers are tools; the ones who hire them are the real players.

According to the DOJ indictment, the biggest client uncovered in this FBI sting operation was Saitama, a crypto company registered in Massachusetts in 2021, which claimed a peak valuation of $7.5 billion.

What does $7.5 billion mean? It surpassed the market cap of many legitimate public companies listed on Nasdaq at the time.

But how was that number generated? As described in the indictment, starting in July 2021, Saitama’s management coordinated actions via Telegram groups, placing small buy orders across multiple wallets to simulate a surge of new buyers.

According to cited Telegram chat logs, a core member explained the goal: "We want these small buy orders to look like more buyers—this is the plan."

The chats also included confirmation messages, celebratory GIFs, and emoji reactions like "PUMP IT" when retail investors followed suit.

According to the same indictment, Saitama subsequently hired market makers—including ZM Quant and Gotbit—to conduct large-scale volume pumping on exchanges like BitMart and LBank. After inflating its valuation, executives quietly sold their holdings, cashing out tens of millions of dollars. According to DOJ announcements, Saitama’s CEO was arrested in the UK, and five former and current employees were charged, with three admitting guilt.

Saitama wasn’t alone.

Per the same indictment, another project called Lillian Finance was founded by Bradley Beatty, a 48-year-old from Florida. Beatty publicly claimed to be a defense contractor, stated he had spoken on crypto issues before Congress, and promised that part of the token’s revenue would go to charity helping children access medical care.

According to the indictment, all of these claims were fabricated. Beatty diverted profits meant for charity into his own pockets.

Defense contractor. Congressional testimony. Child healthcare charity. All you need is a compelling narrative—and a market maker to draw a smooth chart—and you can trigger FOMO in some investors.

Looking back at these cases, what’s most unsettling isn’t how sophisticated the scams were—but rather how crude they were.

FBI’s Coins, Quite Legitimate

After the operation concluded, the FBI did something unusual.

According to a DOJ announcement, the NexFundAI website remained live, but now featured a banner at the top reading: "This website was created under the direction of the Federal Bureau of Investigation for the purpose of investigating cryptocurrency fraud and market manipulation." Below the banner was a link to the full indictment.

The FBI also set up a dedicated victim registration portal. According to the DOJ’s official statement, anyone who lost money on NexFundAI or related tokens could fill out a form to apply for compensation and legal protection.

The FBI issued a token, disclosed information post-operation, and even opened a compensation channel for those who lost money—making the process arguably more transparent than many of the very projects now being prosecuted.

The most absurd twist came next.

According to a report by blockchain analytics firm TRM Labs, within less than 24 hours after the DOJ announcement, someone cloned the FBI’s NexFundAI smart contract and launched a counterfeit token. Using just around $2,300 in initial capital, the individual cashed out over 52 ETH within 24 hours—worth roughly $127,000 at the prevailing price at the time.

The FBI used a fake token to expose market maker fraud. Within hours of the news breaking, someone replicated the exact same tactic to mint a meme coin and profit again. Enforcement took two years—but the market digested the entire event in just two hours, by launching a new air coin.

So the next time you see a sudden spike in a meme coin, consider: is this performance—or real trading?

Of course, it might just be the FBI.

Author: Ku Li, DeepFlow TechFlow

Original: DeepFlow TechFlow