FBI Built a Fake Crypto Token to Catch Market Manipulators

In March 2024, the FBI quietly launched an Ethereum-based token called NexFundAI, gave it a website, promoted it as an AI investment vehicle, and waited. By October, the trap had closed. Federal prosecutors unsealed charges against 18 individuals and entities for wash trading and market manipulation, seized more than $25 million in digital assets, and deactivated trading bots that had been generating fake volume across roughly 60 different tokens.

The operation, called Operation Token Mirrors, marked the first time the bureau built its own cryptocurrency from scratch to catch financial criminals in the act. Jodi Cohen, Special Agent in Charge of the FBI’s Boston Field Office, called the creation of NexFundAI an “unprecedented step.” The evidence the bait token gathered, documented across hundreds of pages of recorded calls and court filings, revealed that selling fabricated trading volume was not an occasional abuse. It was a billable service with clients, contracts, and performance dashboards.

A Fake Token, a Real Federal Case

Four firms sat at the center of the Operation Token Mirrors indictment unsealed in the District of Massachusetts: Gotbit, CLS Global, ZM Quant, and MyTrade. Each marketed itself as a cryptocurrency market maker, a role with legitimate applications in traditional finance where firms post real buy and sell orders to keep markets liquid. In crypto, prosecutors allege, these firms charged token issuers fees to manufacture the appearance of trading activity using automated bots and coordinated self-dealing trades.

ZM Quant collected more than $3 million in fees for manipulation services across multiple token projects. Saitama, one of the token-issuing companies that hired a market maker, manipulated its token to display a reported market value of $7.5 billion before executives quietly liquidated their own holdings at inflated prices. The Securities and Exchange Commission (SEC, the U.S. agency overseeing securities markets) filed parallel civil complaints against three of the market-making firms on the same day the DOJ announced its criminal charges.

Four defendants pleaded guilty or agreed to do so at the time of unsealing. Three others were arrested in Texas, the United Kingdom, and Portugal within days. Acting United States Attorney Joshua Levy put it plainly: “Wash trading has long been outlawed in the financial markets, and cryptocurrency is no exception.”

The Wash Trading Economy the FBI Targeted

Wash trading, the practice of simultaneously buying and selling the same asset to generate artificial volume without any real change in ownership, has been illegal in regulated U.S. financial markets since the Commodity Exchange Act of 1936. Crypto markets operated for years with far less oversight, and the gap between rules and enforcement created a functioning service industry that token issuers could purchase on demand.

• 70%+ average fabricated trading volume on unregulated crypto exchanges, per the NBER crypto wash trading study analyzing 29 exchanges, with fabricated volumes reaching trillions of dollars annually
• $7.5 billion fictitious market capitalization displayed by the Saitama token after market makers applied their inflation services
• 60 different cryptocurrencies had their manipulation bots shut down as part of the operation
• 25+ exchange ranking spots gained on CoinMarketCap by platforms inflating reported volume by 70%, per Nasdaq’s market surveillance analysis

The market-making firms charged in the case sat inside that economy as professional service providers. Token issuers needed volume metrics to qualify for listings on major exchanges and to signal legitimate demand to retail buyers who use trading activity as a quality indicator. The market makers supplied those numbers on contract, complete with weekly performance dashboards tracking the activity they generated.

What NexFundAI’s Recorded Calls Revealed

The FBI’s central advantage was direct participation. Agents posed as the token’s promoters in video calls and Telegram conversations with representatives of the target firms, documenting freely what those representatives said to someone they believed was a paying client.

ZM Quant’s Ruiqi Liu, on a recorded call from March 2024, described the firm’s operational method: using “one thousand wallets, two thousand wallets” to execute trades “ten times every minute” or “twenty times a minute” in order to “increase the trading volume” and “pump the price.” Liu explained that distributing trades across thousands of wallets was specifically designed to prevent the activity from appearing artificial to exchange monitors.

CLS Global sent its own representative to negotiations that were even more explicit. During videoconferences in July and August 2024, the employee explained that CLS’s algorithm distributed self-dealing trades “from multiple wallets so it’s not visible,” making the activity look like “organic buying and selling that is happening.” Then came the line that prosecutors later cited in court:

I know that it’s wash trading and I know people might not be happy about it.

That same employee delivered a formal “Market Making proposal” to the agents, complete with a dashboard showing “total volume,” “CLS volume,” and “external volume,” then sent weekly performance reports on the fabricated activity being generated on the FBI’s own token. ZM Quant, separately, accounted for more than 80% of the bait token’s trading volume during May 2024, with its bots still generating millions of dollars in wash trades as late as the week before the arrest announcements.

Guilty Pleas, Sentences, and a Global Dragnet

The October 2024 press conference was the opening act. The operation expanded steadily through 2025 and into 2026, drawing in defendants from jurisdictions the first indictment did not reach.

• October 2024: 18 individuals and entities charged; arrests made in Texas, United Kingdom, and Portugal; more than $25 million in cryptocurrency seized; roughly 60 manipulation bots deactivated
• January 2025: CLS Global pleads guilty to wire fraud and conspiracy to commit market manipulation
• April 2025: A federal court in Boston sentences CLS Global to a $428,059 fine, three years of probation, and a ban from offering services to U.S. clients
• 2025: Additional indictments issued; defendants arrested in Singapore and the United Arab Emirates
• March 2026: DOJ charges 10 more executives from four additional firms, including Vortex, Antier, and Contrarian; three defendants extradited from Singapore and appearing in federal court in Oakland, California

The investigation also revealed that NexFundAI was not the only undercover instrument. Court documents tied to the CLS Global guilty plea were part of a broader evidence base that included at least one additional bait token, Powerlink, deployed in a parallel investigation. Of 942 total transactions recorded in Powerlink’s history, 922 were executed by wallets linked to a single target firm. The FBI was running multiple undercover tokens simultaneously, across multiple exchanges.

The Impersonator Token and What It Revealed

Within hours of the DOJ’s October 9, 2024 press release going live, an anonymous actor created a copycat token on Ethereum named “NexFund,” minted approximately 420 billion tokens using around 1.4 ETH (roughly $2,300 at the time), pumped the price through open markets, and cashed out more than 52 ETH, pocketing roughly $127,000, all within 24 hours of the federal announcement. As TRM Labs’ on-chain analysis of the sting documented, the creator moved the proceeds to an international exchange before the trading day was over.

The pump-and-dump ran on the announcement of a federal crackdown on pump-and-dumps. The infrastructure for manufactured token activity did not pause for federal news. It adapted within hours, using the announcement itself as a marketing event for a new scheme.

The operation also exposed limits in the bureau’s own operational security. Coinbase director Conor Grogan reviewed public blockchain data after the announcement and identified wallets linked to the undercover operation, noting they had made recent deposits to multiple exchanges including Binance. Grogan published a partial map of those holdings publicly. The same blockchain transparency that makes wash trading detectable, it turned out, also makes undercover law enforcement wallets traceable to anyone paying attention.

What the Case Means for Market Makers and Investors

The legal line prosecutors drew in the case is straightforward on paper. Legitimate market making requires that no single entity controls both sides of any given trade. Real market makers post simultaneous buy and sell orders at different prices, earn the spread when independent parties transact against those orders, and carry genuine inventory risk. Beneficial ownership changes hands in every transaction.

Wash trading inverts that: one entity, or a coordinated group, controls both the buy side and the sell side. No real ownership transfer occurs, no actual price discovery takes place, and no risk is carried because the same party sits on both sides. Every firm charged in the sting marketed its services as market making. The distinction that separated them from legal operators, in prosecutors’ framing, was the absence of any counterparty risk on either side of their trades.

For token issuers who purchased volume services without closely examining the mechanics, the expansion of the case into 2025 and 2026 signals that federal investigators are still working through their evidence files. The March 2026 wave of indictments charged 10 more executives from four additional firms. Three defendants were extradited from Singapore and appeared in federal court in Oakland. The sting is also one piece of a wider federal and state enforcement posture across digital asset categories, one that has run in parallel with state-level crackdowns that drove Bitcoin Depot into Chapter 11 bankruptcy under mounting regulatory pressure this year.

If the remaining defendants go to trial and are convicted, the operation will have produced criminal accountability across three federal districts and more than two years of active investigation. If entrapment defenses gain traction, which legal analysts consider unlikely given the defendants’ documented prior conduct with real tokens, the bureau still has the methodology and the blockchain infrastructure in place to build the next version. Market manipulators now face a variable they did not have to account for before: whether the next new token approaching them for volume services belongs to a startup or to a federal agent.

Frequently Asked Questions

What Is Wash Trading and Why Is It Illegal?

Wash trading is the practice of buying and selling the same asset to create artificial trading activity without any genuine change in beneficial ownership. It has been illegal in regulated U.S. financial markets since the Commodity Exchange Act of 1936. In cryptocurrency markets, some firms sold it as a paid “volume generation” service, charging token issuers contracted fees to fabricate the appearance of demand and help tokens qualify for exchange listings or attract retail investors.

Which Companies Were Charged in Operation Token Mirrors?

The four market-making firms charged in the original October 2024 indictment were Gotbit, CLS Global, ZM Quant, and MyTrade. Token-issuing companies including Saitama and Robo Inu Finance were also named. Subsequent indictments in 2025 and 2026 added Vortex, Antier, and Contrarian. CLS Global is the furthest along in proceedings, having pleaded guilty in January 2025 and received a $428,059 fine plus three-year probation from a Boston federal court in April 2025.

Can Investors Who Traded Affected Tokens File a Claim?

The FBI urged anyone who traded tokens connected to the schemes, including Saitama, Robo Inu, VZZN, and Lillian Finance, to report their losses through the FBI’s Internet Crime Complaint Center at ic3.gov. The investigation included a dedicated victim reporting form, and individuals who come forward may be eligible for restitution consideration under federal law, as well as legal protections available to crime victims in federal cases.

Has Operation Token Mirrors Changed How the FBI Handles Crypto Fraud?

Yes, materially. The sting established for the first time that the FBI can build and deploy a functioning cryptocurrency as an undercover instrument, collect recorded evidence of manipulation being solicited and delivered, and coordinate simultaneous arrests across multiple countries. The March 2026 follow-on indictments confirm the bureau is applying the same methodology to additional targets identified through the original investigation’s evidence base, and court records show the FBI deployed at least one additional bait token, Powerlink, in a parallel case.

Disclaimer: This article is for informational purposes only and does not constitute investment, legal, or financial advice. Cryptocurrency markets carry significant risk, and past enforcement actions do not guarantee protection from future market manipulation. Figures cited are sourced from court filings, DOJ press releases, and academic research and are accurate as of the publication date. Consult a qualified financial or legal professional before making investment decisions.