Mirror Trading International (MTI), a South African company headquartered in Stellenbosch in the Western Cape Province, collected at least 29,421 Bitcoin — valued at $1.733 billion at March 2021 prices — from investors across more than 200 countries between approximately May 2018 and March 2021. Its founder and CEO, Cornelius Johannes Steynberg, known as Johann Steynberg, promised investors fully automated, expert-managed forex and cryptocurrency trading delivering returns of up to 10 percent per month. The South African Financial Sector Conduct Authority concluded its investigation in January 2021 and found no evidence that any trading was conducted on behalf of investors; MTI operated as a pyramid scheme whose reported returns were fabricated.
MTI was provisionally liquidated by a South African court in December 2020 and placed into final liquidation by the Western Cape High Court in June 2021. Steynberg fled South Africa before the scheme collapsed, was arrested in Brazil in December 2021 under an INTERPOL warrant — at the time using a false identity — and was convicted by Brazilian authorities in 2023 of using forged identity documents. A US federal criminal indictment against him on fraud charges was filed. In April 2023, a US District Court entered a default judgment against Steynberg ordering him to pay $1,733,838,372 in restitution and an equal civil monetary penalty — a total of $3.467 billion — the largest civil monetary penalty in CFTC history at the time of entry. Brazilian authorities reported Steynberg died in custody of bilateral pulmonary thromboembolism in 2024; as of mid-2024, neither US nor South African authorities had publicly confirmed his death. Liquidation proceedings in South Africa continue.
WoToken, a Chinese-operated cryptocurrency yield platform, defrauded 715,249 investors of a digital asset portfolio valued at approximately $1.1 billion before collapsing in October 2019. The platform ran from August 2018, marketing itself as a wallet application that deployed a proprietary algorithmic trading bot — internally branded “Apollo” — to generate returns of 0.25 to 0.65 percent per day on deposited cryptocurrency. No such trading engine existed. Every return paid to participants was funded by fresh deposits from incoming recruits, routed through a multi-tier referral commission structure and denominated in a proprietary token, WOR, that had no value outside the platform itself.
Six operators were arrested and tried by Chinese authorities. The intermediary court of Yancheng City, Jiangsu Province — the same tribunal that separately prosecuted PlusToken — issued convictions on October 27, 2020. Four of the principal defendants received prison sentences ranging from 2.5 to 8.8 years. Court documents established what market observers had suspected from the scheme’s design: at least one of the six convicted WoToken operators had been a central participant in PlusToken, the $3 billion pyramid that collapsed three months before WoToken launched. WoToken was not merely styled after PlusToken; it was, in significant part, a continuation of it — operated by some of the same people, using the same recruitment infrastructure, targeting an overlapping victim pool that had not yet been reached by the earlier scheme.
The criminal proceeds — 425 million yuan (approximately $60 million at 2020 conversion rates) — were seized and forfeited to the state treasury under Chinese law. No restitution mechanism for the 715,249 defrauded investors exists under the applicable prosecution framework.
Forsage, a cryptocurrency pyramid and Ponzi scheme built on Ethereum, Tron, and Binance Smart Chain smart contracts, extracted approximately $340 million from investors across dozens of countries between its January 2020 launch and subsequent regulatory and law enforcement action. The scheme was founded by Vladimir Okhotnikov — operating as “Lado” — alongside co-founders Olena Oblamska (operating as “Lola Ferrari”), Mikhail Sergeev, and Sergey Maslakov, all Russian nationals. Its central and defining marketing claim was that Forsage was “trustless” — because its mechanics ran on public smart contracts rather than a company-controlled server, the founders argued no central party could manipulate the system and investors were therefore safe. That claim was the fraud. The smart contract code was written by Okhotnikov and his associates, and that code systematically diverted investor funds to earlier participants rather than generating any return from external activity.
The Securities and Exchange Commission charged eleven individuals — the four founders and seven promoters — in August 2022, characterising Forsage as both a Ponzi and a pyramid scheme. The Department of Justice obtained a federal grand jury indictment in the District of Oregon in February 2023 charging all four founders with conspiracy to commit wire fraud. Two SEC-charged promoters reached civil settlements with the commission. Okhotnikov, Sergeev, and Maslakov remain at large as of mid-2026; Okhotnikov is believed to be in Dubai. Olena Oblamska was extradited from Thailand to the United States in May 2026 and pleaded not guilty; her jury trial is scheduled for July 2026 in the District of Oregon. The prosecution is active but no criminal trial verdict has yet been returned against any Forsage founder.
The scale of the scheme — $340 million, confirmed by blockchain analysis of the smart contracts themselves — and its explicit use of decentralised blockchain infrastructure as a fraud delivery mechanism made it a landmark case for US regulators seeking to establish that the “trustless” framing of DeFi does not provide immunity from securities and wire fraud law.
Cloud Token Wallet, a mobile cryptocurrency application launched in 2019 and linked to entities in Singapore, Malaysia, and Australia, raised funds from hundreds of thousands of investors across Asia, the Asia-Pacific diaspora, and globally by claiming that an embedded “artificial intelligence” trading robot — marketed as “Jarvis” — would generate monthly returns of 6 to 12 percent by executing automated cryptocurrency arbitrage across exchanges. No such algorithmic trading infrastructure existed; the platform was a Ponzi scheme that paid existing participants from new investor deposits until deposit inflows became insufficient to sustain payouts. The application ceased functioning in late 2019 to mid-2020. Losses are disputed in the record: estimates from community sources and partial investigations range from $500 million to $4 billion, though no single regulatory enforcement action has produced a judicially validated loss figure.
The scheme was primarily associated with Ronald Aai (also known as Ronald Aai Weng Joon), a Malaysian national who built and promoted Cloud Token’s technical and commercial operations from Singapore, initially with co-operator Daniel Csokas. Aai was removed from WBF Exchange’s Singapore offices where he had been operating and relocated to Malaysia as regulatory scrutiny in Singapore mounted in mid-2019. The scheme’s corporate structure included Cloud Technology & Investments Pty Ltd, registered in Australia, which gave it an appearance of Western legitimacy to Asia-Pacific investors even as the scheme was operated primarily from Southeast Asia.
Chinese law enforcement arrested 72 individuals connected to Cloud Token operations in actions conducted in 2020, making the Chinese enforcement the most significant documented legal action against the scheme’s participants. Ronald Aai’s status as of mid-2026 is not publicly confirmed as resulting in criminal conviction; the scheme is categorised here as At-Large because no central operator has been publicly convicted in a Western or Singapore jurisdiction. James Riemers, an Australian national described in some records as a scheme promoter and linked to the Australian entity, has not been publicly named in any court filing confirming charges or conviction.