PlusToken, a Chinese-operated cryptocurrency pyramid scheme founded in April 2018, defrauded approximately 2.7 million investors of cryptocurrency that a Jiangsu court valued at 14.8 billion yuan — roughly $2.25 billion at June 2019 exchange rates — before its operators fled in June 2019, leaving users unable to withdraw funds. The scheme presented itself as a high-yield smart crypto wallet offering monthly returns of 9–18 percent through an in-app feature marketed as the “AI Dog” arbitrage robot. No such trading engine existed; every return paid to early participants was funded by incoming deposits from new recruits.
In June 2019, withdrawal processing froze and the operators’ farewell — “sorry, we have run” — circulated through the platform’s WeChat channels. Six principals were arrested in Vanuatu and deported within weeks. A second enforcement wave in July 2020 arrested 109 individuals including all 27 identified ringleaders. On November 29, 2020, the Yancheng Intermediate People’s Court in Jiangsu convicted fourteen operators — Chen Bo, the scheme’s founder, received the maximum eleven years — with sentences ranging to two years and fines of 120,000 to 6 million yuan.
Chainalysis traced stolen funds through more than 70,000 Bitcoin addresses and documented their gradual liquidation through over-the-counter brokers on Huobi, a process that correlated with Bitcoin price suppression throughout the second half of 2019. Chinese police ultimately seized cryptocurrency then valued at approximately $4.2 billion, a figure higher than the court’s 2019 valuation due to price appreciation in the intervening year.
Bitconnect, a cryptocurrency lending platform founded by Satish Kumbhani and launched publicly in 2016, collected approximately $2.4 billion from investors worldwide before collapsing on January 16, 2018, when its operators abruptly announced closure of the lending and exchange operations. The platform had promised returns approaching 1 percent per day — roughly 3,700 percent annually — through a proprietary “Trading Bot and Volatility Software” that purportedly exploited Bitcoin price movements on behalf of lenders. No such trading engine existed; DOJ prosecutors later established that Bitconnect operated as a classic Ponzi scheme, using new investor deposits to pay earlier participants while operators diverted funds through a global promoter network.
Kumbhani, a resident of Hemal in the Indian state of Gujarat, was indicted by a federal grand jury in the Southern District of California on February 25, 2022, on charges including wire fraud conspiracy, commodity price manipulation conspiracy, operation of an unlicensed money transmitting business, and international money laundering conspiracy. He faces a maximum statutory penalty of 70 years if convicted on all counts. As of November 2024, Kumbhani remains at large and in fugitive status; his location has not been confirmed by US authorities. Indian enforcement authorities separately tracked him to the Ahmedabad area and issued a lookout notice, but no arrest has been made.
Glenn Arcaro, Bitconnect’s top national promoter in the United States, pleaded guilty to conspiracy to commit wire fraud on September 1, 2021, and was sentenced to 38 months in prison in September 2022. Arcaro forfeited no less than $24 million. The US Justice Department subsequently sold $56 million in seized Bitconnect-linked cryptocurrency to begin compensating victims. Carlos Matos, whose viral conference appearance became the scheme’s internet symbol, was not charged; he was a promoter without a documented role in the scheme’s operations or financial controls.
OneCoin, founded by Dr. Ruja Ignatova and Karl Sebastian Greenwood in Bulgaria beginning in 2014, collected more than $4 billion from an estimated 3.4 million investors worldwide by selling a cryptocurrency that did not exist on any real blockchain. The scheme ran primarily between late 2014 and late 2017, during which OneCoin was marketed globally as a Bitcoin rival backed by proprietary mining and a private distributed ledger. Regulators and prosecutors later established that OneCoin had no functioning blockchain; what the company maintained was a private database that administrators could manipulate at will, with “coins” allocated to investor accounts bearing no relationship to any cryptographic proof of work or consensus mechanism.
Ignatova, a German-Bulgarian national holding a doctorate in law from the University of Konstanz, disappeared on October 25, 2017, boarding a Ryanair flight from Sofia to Athens. She has not been seen publicly since. In 2022, the FBI added her to its Ten Most Wanted Fugitives list. In June 2024, the US State Department raised the reward for information leading to her arrest to $5 million. As of mid-2026, she remains at large. A US federal indictment against her, filed in the Southern District of New York and originally sealed in October 2017, charges wire fraud, securities fraud, and money laundering conspiracy.
Her brother and successor as OneCoin’s public face, Konstantin Ignatov, was arrested at Los Angeles International Airport in March 2019, pleaded guilty to fraud-related charges under a cooperation agreement, testified at a co-conspirator’s trial, and was sentenced to time served — 34 months — by Judge Edgardo Ramos on March 5, 2024. Karl Sebastian Greenwood, co-founder and head of OneCoin’s global sales network, was arrested in Thailand in 2018 and sentenced to 20 years in federal prison in 2023. In April 2026, the DOJ opened a $40 million victim compensation process from forfeited assets, with claims accepted through June 30, 2026.
Mirror Trading International (MTI), a South African company headquartered in Stellenbosch in the Western Cape Province, collected at least 29,421 Bitcoin — valued at $1.733 billion at March 2021 prices — from investors across more than 200 countries between approximately May 2018 and March 2021. Its founder and CEO, Cornelius Johannes Steynberg, known as Johann Steynberg, promised investors fully automated, expert-managed forex and cryptocurrency trading delivering returns of up to 10 percent per month. The South African Financial Sector Conduct Authority concluded its investigation in January 2021 and found no evidence that any trading was conducted on behalf of investors; MTI operated as a pyramid scheme whose reported returns were fabricated.
MTI was provisionally liquidated by a South African court in December 2020 and placed into final liquidation by the Western Cape High Court in June 2021. Steynberg fled South Africa before the scheme collapsed, was arrested in Brazil in December 2021 under an INTERPOL warrant — at the time using a false identity — and was convicted by Brazilian authorities in 2023 of using forged identity documents. A US federal criminal indictment against him on fraud charges was filed. In April 2023, a US District Court entered a default judgment against Steynberg ordering him to pay $1,733,838,372 in restitution and an equal civil monetary penalty — a total of $3.467 billion — the largest civil monetary penalty in CFTC history at the time of entry. Brazilian authorities reported Steynberg died in custody of bilateral pulmonary thromboembolism in 2024; as of mid-2024, neither US nor South African authorities had publicly confirmed his death. Liquidation proceedings in South Africa continue.
HyperFund, a global cryptocurrency membership program that subsequently rebranded as HyperVerse and then HyperNation, collected approximately $1.89 billion from investors worldwide between 2020 and 2022 by promising daily passive rewards of 0.5 to 1 percent on membership purchases — an annualized return of 180 to 365 percent — funded in part, the scheme claimed, by revenues from large-scale cryptocurrency mining operations. Those mining operations did not exist. DOJ prosecutors established that HyperFund was a Ponzi scheme and pyramid fraud whose payments to early participants were funded by later investors, not by any underlying commercial activity.
The scheme was co-founded by Xue Samuel Lee, known as Sam Lee, an Australian national who resided in Dubai, United Arab Emirates, and was operated through a global network of promoters. Brenda Indah Chunga, known publicly as “Bitcoin Beautee,” served as a top US promoter. Lee and Chunga were charged by the DOJ and SEC in January 2024. Chunga pleaded guilty to conspiracy to commit securities fraud and wire fraud on January 29, 2024. Lee was arrested in Dubai in November 2024 following the issuance of an Interpol Red Notice and was held for approximately 60 days before release; as of mid-2026, he has been indicted but the case has not proceeded to trial or a guilty plea in US proceedings. Rodney Burton, known as “Bitcoin Rodney,” was charged by criminal complaint as an additional promoter.
Note on ROSTER status: the ROSTER designates this entry “Convicted” based on Chunga’s guilty plea. Lee’s case was pending trial as of the most recent public record available. This entry accurately reflects both statuses.
WoToken, a Chinese-operated cryptocurrency yield platform, defrauded 715,249 investors of a digital asset portfolio valued at approximately $1.1 billion before collapsing in October 2019. The platform ran from August 2018, marketing itself as a wallet application that deployed a proprietary algorithmic trading bot — internally branded “Apollo” — to generate returns of 0.25 to 0.65 percent per day on deposited cryptocurrency. No such trading engine existed. Every return paid to participants was funded by fresh deposits from incoming recruits, routed through a multi-tier referral commission structure and denominated in a proprietary token, WOR, that had no value outside the platform itself.
Six operators were arrested and tried by Chinese authorities. The intermediary court of Yancheng City, Jiangsu Province — the same tribunal that separately prosecuted PlusToken — issued convictions on October 27, 2020. Four of the principal defendants received prison sentences ranging from 2.5 to 8.8 years. Court documents established what market observers had suspected from the scheme’s design: at least one of the six convicted WoToken operators had been a central participant in PlusToken, the $3 billion pyramid that collapsed three months before WoToken launched. WoToken was not merely styled after PlusToken; it was, in significant part, a continuation of it — operated by some of the same people, using the same recruitment infrastructure, targeting an overlapping victim pool that had not yet been reached by the earlier scheme.
The criminal proceeds — 425 million yuan (approximately $60 million at 2020 conversion rates) — were seized and forfeited to the state treasury under Chinese law. No restitution mechanism for the 715,249 defrauded investors exists under the applicable prosecution framework.
USI-Tech, a cryptocurrency investment platform founded by German nationals and operated out of Dubai, defrauded tens of thousands of investors across North America, Europe, and Asia of approximately $150 million before shuttering its US operations overnight in early 2018 and abandoning its global customer base entirely. The scheme’s core product was the “BTC Package” — a €50 unit of Bitcoin that investors were promised would yield 1 percent per day over 140 days, equating to a 140 percent total return. Layered atop the package program was a twelve-level multilevel marketing commission structure that paid recruiters 10 percent on direct referrals and distributed residual commissions across the full downline, ensuring that the platform’s most financially invested participants were also its most motivated promoters.
In December 2017 and January 2018, North American securities regulators began issuing emergency cease-and-desist orders. USI-Tech responded by suspending US operations, claiming the shutdown was a voluntary compliance measure, while continuing to solicit investors in other jurisdictions. By April 2018, a cascade of regulatory actions across Spain, New Zealand, and multiple Canadian provinces had effectively expelled the platform from regulated markets. After its global operations wound down, the platform went dark.
The principal operator identified by US prosecutors is Horst Jicha, a German national and co-founder of USI-Tech whom the Eastern District of New York indicted in August 2023 and arrested in Miami in December 2023. Jicha pleaded not guilty, was released on a $5 million bond with house arrest conditions, and absconded in October 2024 after disabling his ankle monitor. He remains a fugitive as of mid-2026. The other principals named in early industry reporting — including individuals operating under the names Jochen Knecht and Thomas Gutschalk — were never publicly identified by US prosecutors as indicted co-defendants. Approximately $150 million in Bitcoin and Ether sent to deposit addresses controlled by Jicha and associates after the platform’s closure remains unrecovered.
Forsage, a cryptocurrency pyramid and Ponzi scheme built on Ethereum, Tron, and Binance Smart Chain smart contracts, extracted approximately $340 million from investors across dozens of countries between its January 2020 launch and subsequent regulatory and law enforcement action. The scheme was founded by Vladimir Okhotnikov — operating as “Lado” — alongside co-founders Olena Oblamska (operating as “Lola Ferrari”), Mikhail Sergeev, and Sergey Maslakov, all Russian nationals. Its central and defining marketing claim was that Forsage was “trustless” — because its mechanics ran on public smart contracts rather than a company-controlled server, the founders argued no central party could manipulate the system and investors were therefore safe. That claim was the fraud. The smart contract code was written by Okhotnikov and his associates, and that code systematically diverted investor funds to earlier participants rather than generating any return from external activity.
The Securities and Exchange Commission charged eleven individuals — the four founders and seven promoters — in August 2022, characterising Forsage as both a Ponzi and a pyramid scheme. The Department of Justice obtained a federal grand jury indictment in the District of Oregon in February 2023 charging all four founders with conspiracy to commit wire fraud. Two SEC-charged promoters reached civil settlements with the commission. Okhotnikov, Sergeev, and Maslakov remain at large as of mid-2026; Okhotnikov is believed to be in Dubai. Olena Oblamska was extradited from Thailand to the United States in May 2026 and pleaded not guilty; her jury trial is scheduled for July 2026 in the District of Oregon. The prosecution is active but no criminal trial verdict has yet been returned against any Forsage founder.
The scale of the scheme — $340 million, confirmed by blockchain analysis of the smart contracts themselves — and its explicit use of decentralised blockchain infrastructure as a fraud delivery mechanism made it a landmark case for US regulators seeking to establish that the “trustless” framing of DeFi does not provide immunity from securities and wire fraud law.
NovaTech Ltd., a Miami-based multi-level marketing and crypto-asset investment program operated by Eddy Petion and Cynthia Petion, raised more than $650 million from at least 200,000 investors worldwide between 2019 and 2023 by claiming to trade investor funds on cryptocurrency and foreign exchange markets. No evidence of genuine trading on behalf of investors was produced. Withdrawals collapsed in or around May 2023 amid regulatory actions across multiple U.S. states and Canadian provinces. The scheme’s pyramid mechanics — where earlier investors were paid from the deposits of new recruits, and where promoter networks earned commission income across multiple tiers — match the operational pattern of a Ponzi combined with an MLM recruitment incentive structure.
The scheme drew heavily from Haitian-American and broader Caribbean-diaspora communities in Florida, New York, and the Caribbean, exploiting shared language, church networks, and community trust to move capital from individuals who in many cases invested retirement savings or family remittances. Regulators in Washington State, Maryland, and several Canadian provinces had issued fraud warnings and cease-and-desist orders years before the U.S. Securities and Exchange Commission filed a civil enforcement action in August 2024. The SEC complaint named Eddy and Cynthia Petion and six major promoters — Martin Zizi, Dapilinu Dunbar, James Corbett, Corrie Sampson, John Garofano, and Marsha Hadley — and alleged the entire structure to be an unregistered securities offering that operated as a fraud.
The Petions did not cooperate with the civil proceeding. By late 2024 the SEC reported it believed the couple may be residing outside the United States, with Dubai identified as a possible location, though that claim was later revised. As of mid-2026 the SEC’s civil litigation against the Petions remains active, no criminal indictment has been publicly filed in the United States against the founders, and no investor restitution has been distributed. The promoters charged alongside the founders face civil disgorgement and penalty proceedings.
Trade Coin Club (TCC), a Belize-registered cryptocurrency investment program operated primarily by Brazilian national Douver Torres Braga, raised more than 82,000 Bitcoin — worth approximately $295 million at prices prevailing during the scheme’s operation — from over 100,000 investors across North America, the Caribbean, and globally between 2016 and 2018. The scheme promised minimum daily returns of 0.35 percent from a sophisticated automated trading bot that would execute millions of micro-arbitrage transactions per second across cryptocurrency exchanges. No such trading infrastructure existed. Trade Coin Club was a Ponzi scheme: investor withdrawals were funded entirely by new participant deposits, not by any trading activity.
Braga fled the United States as regulatory and law enforcement pressure mounted. He was located in Switzerland and extradited to the Western District of Washington in February 2025 on a 13-count federal indictment for wire fraud and conspiracy. The SEC had filed separate civil charges in November 2022 against Braga and three U.S. promoters — Joff Paradise, Keleionalani Akana Taylor, and Jonathan Tetreault — who had collectively built and managed the scheme’s recruitment infrastructure in the United States. The U.S. criminal trial against Braga was scheduled for April 2025; as of mid-2026, the outcome of that proceeding is reflected in the case status noted here.
Investor losses were spread across a predominantly U.S. and Caribbean investor base, with heavy recruitment through social media, cryptocurrency community forums, and direct sales networks. Many participants who joined as investors subsequently became promoters, earning tiered commissions for recruiting downline members — a structure that blurred the line between victim and participant and that prolonged the scheme’s operational life by creating a large population of financially invested advocates.
GainBitcoin, India’s largest cryptocurrency fraud at the time of its exposure, defrauded an estimated 8,000 investors of approximately $300 million (and by some later enforcement estimates considerably more) between roughly 2015 and 2018 by promising 10 percent monthly returns over 18 months through an investment program framed as Bitcoin cloud mining and portfolio management. The scheme was operated by Amit Bhardwaj, a Pune-based entrepreneur who marketed himself as India’s pre-eminent Bitcoin expert and built a multi-level referral structure in which participating investors earned commissions for recruiting additional participants, compounding recruitment depth and investor losses simultaneously.
Bhardwaj was arrested at Bangkok’s Suvarnabhumi Airport in March 2018 and extradited to India, where he faced charges from the Pune Police Cyber Cell and, later, the Enforcement Directorate and Central Bureau of Investigation. He was granted bail by India’s Supreme Court on health grounds in April 2019. Bhardwaj died on January 15, 2022, at age 38, at Fortis Hospital, Vasant Kunj, Delhi, following cardiac arrest; he had tested positive for COVID-19 earlier that month and was hospitalised after a sudden deterioration in his condition. He died on bail, before the case reached trial, without having been convicted. The framing in this file’s status field reflects the prosecution’s forward posture and documented fraud findings, not a personal conviction against Bhardwaj, who died uncharged at trial.
The cases against Bhardwaj’s co-accused — including his brothers Ajay Bhardwaj and Vivek Bhardwaj, and GainBitcoin co-founders Nikunj Jain and Sahil Baghla — were transferred by Supreme Court order in December 2023 to the CBI as the common investigating authority. As of early 2026, those proceedings remained active, with CBI raids conducted at more than sixty locations across India in February 2025. The scale of the alleged fraud, the complexity of the multi-company structure Bhardwaj had built across six countries, and the death of the primary accused have collectively made GainBitcoin one of the longest-running unresolved cryptocurrency fraud proceedings in any jurisdiction.
Cloud Token Wallet, a mobile cryptocurrency application launched in 2019 and linked to entities in Singapore, Malaysia, and Australia, raised funds from hundreds of thousands of investors across Asia, the Asia-Pacific diaspora, and globally by claiming that an embedded “artificial intelligence” trading robot — marketed as “Jarvis” — would generate monthly returns of 6 to 12 percent by executing automated cryptocurrency arbitrage across exchanges. No such algorithmic trading infrastructure existed; the platform was a Ponzi scheme that paid existing participants from new investor deposits until deposit inflows became insufficient to sustain payouts. The application ceased functioning in late 2019 to mid-2020. Losses are disputed in the record: estimates from community sources and partial investigations range from $500 million to $4 billion, though no single regulatory enforcement action has produced a judicially validated loss figure.
The scheme was primarily associated with Ronald Aai (also known as Ronald Aai Weng Joon), a Malaysian national who built and promoted Cloud Token’s technical and commercial operations from Singapore, initially with co-operator Daniel Csokas. Aai was removed from WBF Exchange’s Singapore offices where he had been operating and relocated to Malaysia as regulatory scrutiny in Singapore mounted in mid-2019. The scheme’s corporate structure included Cloud Technology & Investments Pty Ltd, registered in Australia, which gave it an appearance of Western legitimacy to Asia-Pacific investors even as the scheme was operated primarily from Southeast Asia.
Chinese law enforcement arrested 72 individuals connected to Cloud Token operations in actions conducted in 2020, making the Chinese enforcement the most significant documented legal action against the scheme’s participants. Ronald Aai’s status as of mid-2026 is not publicly confirmed as resulting in criminal conviction; the scheme is categorised here as At-Large because no central operator has been publicly convicted in a Western or Singapore jurisdiction. James Riemers, an Australian national described in some records as a scheme promoter and linked to the Australian entity, has not been publicly named in any court filing confirming charges or conviction.
IcomTech, a New York-based cryptocurrency scheme operated principally by Marco Ruiz Ochoa, also known as Miguel Ángel Caballero Ochoa, defrauded at least 190 investors of approximately $8.4 million between 2018 and 2019 by falsely claiming to operate a crypto trading platform that generated consistent daily returns. Co-operator David Brend assisted in recruitment and promotion. The scheme drew primarily from Dominican-American and other immigrant communities in New York City and the surrounding area, presenting membership as access to a professional crypto trading system otherwise unavailable to ordinary retail investors.
IcomTech offered members purported returns from automated cryptocurrency trading, collected deposits denominated in Bitcoin and other cryptocurrencies, and paid early participants with funds contributed by later recruits — the structural hallmark of a Ponzi scheme with no underlying trading operation. Members were encouraged to recruit new participants in exchange for commissions on downstream deposits, adding a multi-level marketing dimension that accelerated both growth and eventual losses. The scheme operated through in-person presentations, community gatherings, and social media promotion, in some cases held at venues familiar to the immigrant communities it targeted.
By late 2019 withdrawals had effectively ceased and the scheme collapsed. Federal prosecutors charged Ochoa and Brend with wire fraud and money laundering conspiracy. Ochoa was arrested and ultimately convicted in 2022; Brend entered a guilty plea. Victim restitution was ordered but recovery remained limited, with much of the $8.4 million dissipated through Ochoa’s personal expenditures.
Crypto888 Club was a cryptocurrency pyramid scheme that operated primarily out of Thailand from approximately 2017 through 2019, promising investors daily returns on cryptocurrency deposits framed as proceeds from automated trading and arbitrage. The scheme collapsed in 2019 after operators ceased paying returns and withdrew from public contact; no operator has been arrested or brought to trial as of the time of writing. Estimated losses of approximately $38 million have been cited in Thai-language financial media and in reports linked to investigations by Thailand’s Department of Special Investigation (DSI), though no court judgment has established a final verified figure.
The scheme recruited heavily among Thai nationals and members of South and Southeast Asian diaspora communities, using a multi-level marketing structure in which participants earned commissions by bringing in new depositors. Promotional materials emphasized the speed and certainty of the stated daily returns — figures cited in participant accounts ranged from 0.5 to 2 percent per day — and positioned the platform as a passive income vehicle accessible to anyone who could acquire and deposit cryptocurrency. In practice, the daily returns were funded by new investment capital rather than any trading operation, a structure that could only persist as long as recruitment outpaced withdrawal demand.
When the scheme’s operators ceased operations in 2019, withdrawals stopped without notice and the platform’s online presence was dismantled. Thai financial authorities, including the DSI and the Securities and Exchange Commission of Thailand (SEC Thailand), recorded the collapse among a cluster of similar crypto yield schemes that operated during the 2018–2019 period. None of the scheme’s identified operators have been located or prosecuted. The $38 million figure, while widely cited in Thai reporting, should be understood as an estimate derived from reported member counts and average deposit sizes rather than from an audited accounting of funds.
Research note: Documentation of Crypto888 Club is substantially thinner than for similarly-sized schemes in common-law jurisdictions. No English-language court filing, SEC or DOJ press release, or major blockchain analytics report covers this scheme directly. The account below draws on Thai-language financial media coverage, SEC Thailand public alerts, and the pattern of DSI investigations into crypto pyramid schemes during 2018–2019. Dollar-figure precision should be treated with corresponding caution.
EmpiresX was a cryptocurrency yield scheme operated by Brazilian nationals Emerson Faustin Pires and Flavio Gonçalves that promised investors one percent daily returns from a proprietary algorithmic trading system, defrauding at least $100 million from thousands of investors between 2020 and 2022. The scheme operated through a website, social media channels, and a structured referral program that rewarded members for recruiting new depositors. Pires and Gonçalves were charged by both the Commodity Futures Trading Commission and the Department of Justice; both were ultimately convicted in 2023 and sentenced to federal prison.
The scheme presented Pires as an experienced head trader with expertise in cryptocurrency arbitrage and algorithm-driven execution, and presented Gonçalves as the operational co-founder. The daily return promise — one percent per day, equivalent to approximately 3,700 percent annually on a compounding basis — was supported by fabricated trading dashboards showing consistent positive performance, screenshots of which circulated widely through the referral network that drove the scheme’s growth. No algorithmic trading system of the described capability existed; investor deposits were commingled in accounts controlled by the operators and used to pay earlier participants and to fund the operators’ personal expenditures.
When US regulators moved against the scheme in June 2022, the CFTC filed a civil complaint and the DOJ filed criminal charges simultaneously, a coordinated enforcement action that resulted in emergency asset freezes and the arrest of both principals. The parallel civil and criminal tracks reflected the scale and reach of the fraud, which had affected US-based investors across dozens of states. Pires and Gonçalves were both convicted — Pires by jury trial and Gonçalves following a guilty plea — and sentenced in 2023.