EXECUTIVE FINDING

On 9 October 2024, federal prosecutors in Boston announced what they described as the first criminal charges against financial-services firms for market manipulation and wash trading in the cryptocurrency industry.

Eighteen individuals and entities were charged in a coordinated investigation targeting cryptocurrency promoters and companies that allegedly sold something retail investors often assumed arose naturally:

TRADING ACTIVITY.

Authorities accused token promoters of hiring purported “market makers” to execute sham transactions designed to create the appearance that their cryptocurrencies were actively traded and attracting genuine investor demand.

According to prosecutors, those artificial trades could increase apparent volume, generate investor interest and help support higher token prices. Token insiders could then sell holdings to real investors at prices influenced by the manufactured activity—a familiar securities fraud model known as a pump and dump, applied to cryptocurrency.

The Justice Department said more than $25 million in cryptocurrency had been seized, while trading bots responsible for millions of dollars in wash trades across approximately 60 cryptocurrencies had been deactivated as part of the operation.

The investigation involved several purported market-making businesses, including:

• Gotbit Consulting LLC
• ZM Quant Investment Ltd.
• CLS Global FZC LLC
• and

MyTrade MM.

In parallel civil actions, the Securities and Exchange Commission alleged that promoters hired these firms to generate artificial trading volume or manipulate crypto-asset prices and thereby create the false appearance of active markets.

The allegations expose a structural weakness in cryptocurrency markets.

Retail investors commonly treat:

• trading volume
• liquidity
• market-capitalisation rankings
• price momentum
• exchange listings
• and trending-token statistics

as independent market signals.

But what if those signals can be purchased?

That produces the central finding of this dossier:

IN A MANIPULATED MARKET, THE INVESTOR IS NOT MERELY BUYING THE TOKEN.

THE INVESTOR IS BUYING A FALSE STORY ABOUT HOW MANY OTHER PEOPLE WANT THE TOKEN.

THE FINDING

Markets depend upon information.

Price is information.

Volume is information.

Liquidity is information.

Order-book depth is information.

A rising chart is information.

Investors interpret these signals collectively.

High volume suggests:

interest.

Liquidity suggests:

market depth.

Price appreciation suggests:

demand.

A listing on a popular market-data service may suggest:

credibility.

But those conclusions are valid only if the activity is economically genuine.

If one actor controls both sides of trades, volume can exist without genuine demand.

That distinction is the heart of wash trading.

WHAT IS WASH TRADING?

A legitimate trade contains independent economic interests.

Seller wants to sell.

Buyer wants to buy.

The transaction transfers market risk.

A wash trade may create the appearance of a trade without meaningful economic change.

The same person or coordinated actors effectively stand on both sides.

Simplified:

• ACCOUNT A
• sells token
• ↓
• ACCOUNT B

The token appears active.

But genuine outside demand may not have changed at all.

THE MIRROR-MARKET MODEL

Imagine a theatre with 1,000 seats.

Only 50 real customers have bought tickets.

The promoter secretly purchases and resells another 800 tickets among controlled accounts.

A public counter now reports:

850 tickets sold.

A prospective customer sees:

almost sold out.

Demand appears enormous.

The customer buys.

The venue was never actually full.

The appearance of demand created new demand.

That is the economic logic of wash trading.

WHY VOLUME MATTERS

Investors frequently use trading volume as a shortcut for market quality.

High volume can suggest:

• ease of entry
• ease of exit
• real investor interest
• institutional participation
• lower manipulation risk

and greater probability that the quoted price is meaningful.

That makes volume itself commercially valuable.

A cryptocurrency project does not necessarily need millions of genuine investors if it can make the market look as though millions of investors already care.

MARKET ACTIVITY AS A PRODUCT

The October 2024 cases reveal something especially important.

According to prosecutors, firms were allegedly selling artificial market activity as a service.

The promoter did not necessarily need to build its own manipulation infrastructure.

It could hire specialists.

That creates:

MARKET MANIPULATION AS A SERVICE

The architecture becomes:

The manipulation becomes outsourced.

THE MARKET MAKER

Legitimate market makers perform an important financial function.

They provide continuous bids and offers.

They help buyers and sellers transact.

They reduce spreads.

They improve liquidity.

Their legitimate model is approximately:

The market maker assumes economic exposure between transactions.

That is fundamentally different from repeatedly trading with itself merely to create reported volume.

LIQUIDITY VERSUS FAKE LIQUIDITY

The distinction is critical.

REAL LIQUIDITY

Independent buyers.

Independent sellers.

Capital at risk.

Genuine ability to execute.

FAKE LIQUIDITY

Controlled accounts.

Self-trades.

Circular activity.

Volume without independent demand.

A token may therefore display high reported liquidity while remaining almost impossible to sell at scale to genuine outside buyers.

THE EXIT-LIQUIDITY PROBLEM

For token insiders, manipulated volume can solve another problem.

They may own large token holdings.

But ownership is not the same as wealth.

If there are no genuine buyers, tokens cannot be converted into cash.

Retail demand creates:

EXIT LIQUIDITY

The alleged sequence is:

This is why market manipulation ultimately requires a real victim.

Artificial volume alone moves money in circles.

Profit appears when genuine outsiders enter the circle.

THE OCTOBER 9 OPERATION

Federal prosecutors charged leaders of four cryptocurrency companies, four purported market-making firms and employees of those businesses.

Authorities said:

• four defendants had already pleaded guilty
• another had agreed to plead guilty
• three defendants had been arrested in the United States, United Kingdom and Portugal
• more than $25 million in cryptocurrency had been seized

and multiple trading bots had been deactivated.

The operation therefore targeted both sides of the alleged market-manipulation economy:

THE PROMOTER

and

THE MARKET MAKER.

THE PROMOTER SIDE

Prosecutors alleged that crypto-company leaders:

• made false statements concerning tokens
• arranged wash trades
• created artificial activity
• attracted outside investors

and subsequently sold token holdings at artificially influenced prices.

This resembles traditional penny-stock manipulation.

The technology changed.

The economic model did not.

THE MARKET-MAKER SIDE

The alleged market makers offered the infrastructure.

Trading algorithms.

Bots.

Accounts.

Volume targets.

Price-management strategies.

Potential exchange-listing support.

The distinction matters because it suggests that manipulation had become professionalised.

A token promoter could buy market appearance from someone who already possessed the technical machinery.

GOTBIT

One of the most prominent businesses charged was Gotbit Consulting LLC, also known as Gotbit Hedge Fund.

Prosecutors described Gotbit as a well-known cryptocurrency market maker.

Its founder and CEO, Aleksei Andriunin, was arrested in Portugal on 8 October 2024, one day before the public announcement, and awaited extradition as of the archive date.

Gotbit, employees Fedor Kedrov and Qawi Jalili, and Andriunin faced federal charges relating to alleged market manipulation and wire fraud.

As of 9 October 2024, these were criminal allegations.

THE GOTBIT ALLEGATION

Federal prosecutors alleged that between 2018 and 2024 Gotbit offered market-manipulation and wash-trading services to multiple cryptocurrency companies, including companies located in the United States.

The SEC separately alleged that Gotbit generated fake daily trading volume that could reach millions of dollars by effectively trading clients’ crypto assets with itself.

In some instances, according to the SEC complaint, Gotbit’s self-trading allegedly accounted for more than 90% of a token’s reported market activity at particular times.

That figure, if proven, fundamentally changes what “market volume” means.

THE 90% PROBLEM

Suppose a token reports:

$10 million daily volume.

An investor may infer substantial interest.

But if $9 million represents controlled wash trading, genuine outside activity may be only:

$1 million.

The displayed market is ten times larger than the economic market.

That difference affects:

• liquidity assumptions
• valuation
• volatility
• market depth

and ability to exit.

CREATED VOLUME VERSUS MARKET VOLUME

The SEC alleged that Gotbit internally distinguished between:

• “created volume”
• and
• “market volume.”

That terminology is analytically revealing.

It suggests two markets existed simultaneously.

One produced by real outside participants.

Another manufactured through controlled trading.

For investors looking only at public statistics, the two could appear indistinguishable.

ZM QUANT

ZM Quant Investment Ltd. was another purported market maker targeted in the coordinated enforcement action.

The SEC alleged that ZM Quant and associated individuals participated in schemes involving artificial volume and manipulative trading for crypto assets offered to retail investors.

Most significantly, ZM Quant was among the firms that allegedly agreed to manipulate a cryptocurrency created under law-enforcement direction:

NEXFUNDAI

This allowed investigators to observe alleged market-manipulation services without relying exclusively on historical reconstruction.

CLS GLOBAL

The investigation also charged CLS Global FZC LLC, a UAE entity, and employee Andrey Zhorzhes.

The DOJ alleged that Zhorzhes described an algorithm capable of generating volume through self-trading and understood the activity to constitute wash trading.

The SEC separately accused CLS Global and Zhorzhes of engaging in manipulation involving NexFundAI.

As of the archive date, these were allegations and had not been finally adjudicated.

THE ALGORITHM

Automated trading changes the scale of manipulation.

One trader manually buying and selling against himself can create some fake activity.

A bot can operate:

• 24 hours per day
• across numerous wallets
• across several exchanges
• at varying trade sizes

with randomised timing.

The objective may be to make the activity appear organic.

MACHINE-GENERATED DECEPTION

The SEC alleged that some algorithms used by the firms could produce enormous quantities of transactions and billions of dollars in artificial trading volume.

This creates a new form of market manipulation.

Traditional manipulation is labour intensive.

Automated manipulation can become:

• persistent
• scalable
• cheap

and difficult for retail investors to recognise.

The deception is not merely digital.

It is machine-generated.

MYTRADE MM

MyTrade MM represented an especially revealing alleged business model.

Founder Liu Zhou was charged and had agreed to plead guilty to conspiracy to commit market manipulation and wire fraud by the time the operation was announced.

According to prosecutors, clients could use a dashboard to specify desired daily wash-trading volumes for particular tokens.

The dashboard reportedly described the feature as:

“Volume Support.”

That phrase captures the central deception perfectly.

The customer was not necessarily purchasing genuine liquidity.

The customer could allegedly purchase the appearance of liquidity.

THE DASHBOARD ECONOMY

A legitimate software dashboard might allow:

• daily advertising budget
• market-making capital
• spread target

inventory risk.

The alleged MyTrade model allowed clients to specify quantities of fake activity.

That transforms manipulation into a configurable service.

Choose:

token.

Exchange.

Daily volume.

Algorithm.

The market statistic becomes a purchased output.

THE UNDERCOVER TOKEN

The most innovative element of the investigation was NexFundAI.

Rather than merely observing existing tokens, law enforcement directed creation of a cryptocurrency that investigators could use to approach firms offering market-making services.

The token functioned as an undercover test.

Investigators could ask a suspected service provider:

Can you create artificial volume?

Then observe the response.

WHY NEXFUNDAI MATTERS

Historical market-manipulation investigations face an evidentiary problem.

A market maker can claim:

We were providing legitimate liquidity.

The suspicious trades merely reflected ordinary trading.

An undercover token reduces ambiguity.

The investigators know:

• who controls the token
• what genuine demand exists
• what activity they requested

and what the service provider claims it can produce.

This makes NexFundAI an unusually important investigative innovation.

THE CONTROLLED-MARKET TEST

The logic is similar to a controlled scientific experiment.

Create known baseline.

Introduce service provider.

Observe change.

If:

• no organic market exists
• and
• service provider produces apparent volume,

the source of that volume becomes easier to establish.

SAITAMA

The largest token company highlighted by DOJ was Saitama.

Prosecutors said it at one point achieved a market value measured in the billions of dollars.

Authorities alleged that Saitama leadership made false representations and paid market makers, including ZM Quant and Gotbit, to wash trade the token on exchanges including BitMart, LBank and XT.com.

As of the archive date, the relevant defendants were charged and allegations remained to be adjudicated except where specific guilty pleas had already occurred.

MARKET CAPITALISATION

Crypto investors frequently use:

MARKET CAP

calculated as:

token price

×

token supply.

But market capitalisation can create a misleading sense of scale.

Suppose:

1 billion tokens exist.

Last trade price:

$2.

Displayed market cap:

$2 billion.

But what if the $2 price resulted from extremely small or manipulated trading?

It does not mean investors could collectively liquidate $2 billion.

Market cap measures price multiplied by supply.

It does not measure cash available to buy all tokens.

THE LIQUIDITY DISCOUNT

The proper valuation question is not:

What is the displayed market cap?

It is:

HOW MUCH CAPITAL COULD ACTUALLY EXIT BEFORE THE PRICE COLLAPSES?

For concentrated or manipulated assets, the answer may be dramatically lower.

This is the same liquidity problem seen in FTX’s affiliated-token exposure.

ROBO INU

Prosecutors also described Robo Inu Finance, created by Vy Pham after she left Saitama.

According to DOJ, Robo Inu allegedly paid Gotbit beginning around 2022 to artificially inflate trading volume through wash trading. Pham had been charged and agreed to plead guilty by the October 2024 announcement.

The SEC separately alleged that Pham hired Gotbit to provide market-manipulation services designed to generate artificial volume for Robo Inu.

This case illustrates how easily the manipulation model can migrate from one token to another.

The infrastructure remains.

Only the ticker changes.

THE TOKEN FACTORY PROBLEM

Cryptocurrencies can be created relatively quickly.

That changes the economics of securities-style fraud.

Traditional stock manipulation requires:

• a company
• shares
• brokerage access
• corporate filings

and usually more infrastructure.

A token can potentially be created, marketed and traded far faster.

If manipulation services are also outsourced, the fraud production cycle can accelerate further.

TOKEN

↓

This begins to resemble an industrial process.

THE PUMP

A pump can occur through several mechanisms.

Social-media promotion.

Influencer endorsement.

Claims of partnerships.

Exchange listings.

Artificial trading volume.

Coordinated buying.

Announcements.

Market makers.

The objective is to create:

attention

plus

price movement.

Investors often interpret rising price as confirmation that the underlying story is true.

PRICE AS MARKETING

In speculative markets, price itself can advertise the asset.

Token rises 30%.

People notice.

Token rises another 50%.

Social media accelerates.

The price movement creates credibility for the narrative.

This produces:

REFLEXIVE MARKETING

Price attracts buyers.

Buyers increase price.

Higher price attracts more buyers.

Manipulation attempts to ignite this loop artificially.

THE DUMP

The pump has value only if insiders can eventually sell.

That is the dump.

Promoters or insiders exchange their token holdings for:

• stablecoins
• Bitcoin
• Ether

or fiat-linked value.

Real investors remain holding the token.

If artificial support stops, price can collapse.

The economic transfer becomes:

The market chart may look like speculation.

The economic structure may resemble wealth transfer.

THE GREATER-FOOL ARCHITECTURE

One defendant quoted in DOJ materials allegedly described the objective in unusually direct terms: secondary-market profit required finding outside buyers because the other buyers had to lose money for insiders to profit.

The statement is notable because it strips away the vocabulary of liquidity.

The economic requirement is:

find someone outside the coordinated group willing to buy.

That outside investor supplies the money that makes the manipulation profitable.

MARKET MAKER VERSUS MANIPULATOR

The term “market maker” itself can create legitimacy.

Traditional markets rely on regulated firms performing this role.

But the label does not prove the activity is genuine market making.

Kleptik should evaluate actual behaviour.

Does the firm:

• maintain independent inventory?
• quote two-sided markets?
• manage market risk?
• or
• trade controlled accounts against one another?

The economic substance determines the classification.

THE SELF-TRADE TEST

For every suspicious trading pair:

Buyer wallet.

Seller wallet.

Funding source.

Withdrawal destination.

Timing.

Device.

Exchange account.

Beneficial owner.

If both sides ultimately lead to the same controller, the transaction may be economically circular.

On-chain data can make some of this visible.

Exchange account data may be necessary for the rest.

BLOCKCHAIN TRANSPARENCY

Wash trading creates an interesting contradiction.

Blockchain-based markets are often described as transparent.

Transactions may indeed be public.

But public transactions do not necessarily reveal coordination.

An observer sees:

Wallet A sells.

Wallet B buys.

Without knowing both wallets share control, the trade appears genuine.

Transparency of movement is not transparency of ownership.

THE WALLET-CLUSTER PROBLEM

Investigators therefore use clustering.

Signals can include:

• common funding wallet
• common withdrawal destination
• identical timing
• repeated mirrored trades
• common exchange account
• common device information
• shared gas funding

or contractual evidence.

The important methodological rule is:

CLUSTERING IS PROBABILISTIC UNTIL ATTRIBUTION IS CONFIRMED.

Kleptik should not label two wallets as controlled by one person solely because an analytics tool suggests it.

THE EXCHANGE QUESTION

Wash trading generally occurs somewhere.

An exchange provides:

• matching engine
• order book
• trade reporting

account infrastructure.

This raises a major unanswered question:

WHAT SHOULD AN EXCHANGE BE ABLE TO DETECT?

If two accounts:

• repeatedly trade with one another
• have common funding sources
• place matching orders
• generate huge volume
• and show no economic profit motive,

surveillance should potentially recognise the pattern.

TRADITIONAL MARKET SURVEILLANCE

Regulated securities markets routinely monitor for:

• wash trades
• spoofing
• layering
• matched orders
• insider trading

and unusual concentration.

Crypto exchanges vary significantly in surveillance sophistication.

This creates an opportunity for manipulators.

Where detection is weak, artificial markets can survive longer.

THE LISTING INCENTIVE

Prosecutors alleged that wash trading could help tokens meet volume thresholds relevant to exchange listings or fee arrangements.

This produces another feedback loop.

The manipulated statistic may therefore create legitimate downstream consequences.

That makes early detection essential.

COINMARKET DATA

Crypto investors frequently rely on market-data platforms.

Rankings may incorporate:

• price
• volume
• market cap
• liquidity

trending status.

Those platforms typically depend on data supplied by exchanges.

If exchange volume is manipulated, the manipulation can propagate into data services.

A fake trade can therefore influence more than one order book.

It can affect the entire information ecosystem.

DATA LAUNDERING

Kleptik calls this:

DATA LAUNDERING

The information has acquired credibility by passing through an apparently neutral data platform.

This resembles financial laundering.

The underlying thing has not changed.

Its apparent legitimacy has.

THE RANKING EFFECT

SOCIAL MEDIA

Crypto markets also combine price data with social-media promotion.

A manipulator can coordinate:

• artificial trades
• Twitter/X activity
• Telegram
• Discord
• influencers

and promotional announcements.

The investor sees multiple independent signals.

But they may come from one coordinated campaign.

THE MULTI-SIGNAL DECEPTION

Artificial volume.

Rising price.

Trending hashtag.

Influencer posts.

Exchange listing.

Market-cap ranking.

Each appears independent.

Together they create powerful confirmation.

The investigation must ask whether those signals share a common beneficial sponsor.

BENEFICIAL OWNERSHIP OF PROMOTION

Financial investigators identify beneficial owners of companies.

Market investigators should identify:

BENEFICIAL OWNERS OF MARKET SENTIMENT

• Who paid the influencer?
• Who hired the market maker?
• Who controls the wallets?
• Who funded the advertising?
• Who owns the tokens being sold?

Once these relationships are mapped, seemingly organic excitement may become coordinated activity.

THE SEC ACTION

The SEC filed parallel civil enforcement cases against three purported market makers and nine individuals on 9 October 2024.

The agency alleged that promoters hired ZM Quant and Gotbit to generate artificial trading volume or manipulate token prices, while ZM Quant and CLS Global allegedly manipulated NexFundAI in the undercover operation.

The SEC described the objective as inducing retail investors to purchase crypto assets by creating the false appearance of active markets.

This aligns closely with the criminal theory.

CRIMINAL VERSUS CIVIL

The October operation involved both criminal DOJ cases and civil SEC proceedings.

Kleptik should distinguish them.

DOJ

Can seek criminal convictions and imprisonment.

SEC

Brings civil enforcement concerning securities-law violations.

The same underlying conduct can trigger both.

But a civil allegation is not a criminal conviction.

THE SECURITIES QUESTION

The SEC actions concern crypto assets the agency alleged were offered and sold as securities.

Crypto classification remains legally contested across the industry.

For this dossier, the market-manipulation principle is broader.

Whether an asset is labelled:

• security
• commodity
• token
• or cryptocurrency,

fake trading volume can deceive buyers.

Market integrity is conceptually distinct from classification.

MANIPULATION DOES NOT BECOME LEGITIMATE BECAUSE THE ASSET IS NEW

DOJ’s public statement captured the central principle:

wash trading has long been prohibited in conventional markets, and cryptocurrency does not make the underlying scheme novel.

This is another recurring pattern in digital finance.

New technology.

Old fraud.

THE HUNDRED-YEAR-OLD SCHEME

The pump and dump predates crypto by generations.

The traditional model:

acquire cheap stock.

Promote aggressively.

Manipulate price.

Sell to outsiders.

Crypto changes:

• speed
• global reach
• 24/7 trading
• token creation cost
• automation
• pseudonymous wallets

and jurisdiction.

The economic structure remains familiar.

THE AUTOMATION ADVANTAGE

Bots make several old manipulation strategies cheaper.

They can:

• trade continuously
• split orders
• vary size
• randomise timing
• operate many accounts
• react to market movement

and maintain target volume.

One operator can therefore simulate what once required many human traders.

THE BOT-FORENSICS QUESTION

Investigators should identify:

• bot code
• API keys
• exchange accounts
• IP logs
• execution patterns
• funding wallets

and client instructions.

The bot itself can become evidence of intent if programmed specifically to avoid detection or manufacture volume.

API KEYS AS EVIDENCE

Crypto market makers often trade through exchange APIs.

An API record may identify:

• account
• timestamp
• strategy
• order
• execution

and source system.

These technical records can connect trading behaviour to organisational control far more precisely than public charts alone.

THE CLIENT DASHBOARD

The alleged MyTrade dashboard is especially significant because it could provide direct evidence of client intent.

If a customer chooses:

“daily volume target”

rather than:

“spread target” or “inventory target,”

the commercial service may be designed around appearance rather than genuine liquidity.

Interface design itself can become evidence.

THE UAE CONNECTION

CLS Global FZC LLC was identified by authorities as a United Arab Emirates entity.

The firm’s inclusion demonstrates the borderless nature of crypto market infrastructure.

Promoter in one country.

Market maker in another.

Exchange elsewhere.

Retail victims around the world.

Token on a blockchain without national borders.

Yet U.S. authorities asserted jurisdiction because the alleged conduct touched U.S. markets, investors or investigative operations.

JURISDICTIONAL STACK

A manipulation scheme might involve:

TOKEN ENTITY

jurisdiction A.

↓

MARKET MAKER

jurisdiction B.

↓

EXCHANGE

jurisdiction C.

↓

SERVER

jurisdiction D.

↓

INVESTOR

United States.

↓

TOKEN

global blockchain.

This fragmentation can create enforcement difficulty.

It does not necessarily create immunity.

EXTRADITION

Gotbit founder Aleksei Andriunin was arrested in Portugal immediately before the charges were announced and faced potential extradition to the United States.

Again, crypto is borderless.

Defendants are not.

Cross-border arrest and extradition remain among the most important tools in international crypto enforcement.

FOLLOW THE FEES

A crucial Kleptik investigation should examine how manipulation services were priced.

Possible models include:

• monthly retainer
• percentage of token supply
• percentage of trading profits
• fixed daily volume
• performance fee

token compensation.

Compensation structure can reveal incentives.

A market maker paid in the same token it manipulates has a direct economic interest in higher prices.

TOKEN COMPENSATION

Suppose market maker receives:

10 million tokens.

If price is $0.01:

value = $100,000.

If manipulation pushes price to $0.10:

value = $1 million.

The service provider now benefits directly from price inflation.

That turns the intermediary into an economic participant.

FOLLOW THE TOKEN SUPPLY

For every suspected pump-and-dump:

Total supply.

Founder allocation.

Team allocation.

Market-maker allocation.

Exchange wallets.

Treasury.

Locked tokens.

Circulating tokens.

Top 20 wallets.

If a small group controls most supply, apparent market capitalisation can be misleading.

THE FLOAT PROBLEM

A token may have:

1 billion total tokens.

But only:

50 million genuinely tradable.

If last price is applied to all 1 billion tokens, displayed market cap may dramatically overstate economic depth.

Concentrated supply plus wash trading creates especially severe distortion.

THE EXIT MODEL

Kleptik should calculate:

Insider token balance.

Average cost.

Artificial-volume period.

Retail inflow.

Insider sales.

Stablecoin proceeds.

Subsequent transfers.

The question is not merely:

Did price rise?

It is:

WHO CONVERTED THE RISE INTO REAL MONEY?

FOLLOW THE STABLECOINS

Crypto pump-and-dump proceeds often do not immediately become dollars.

They may become:

• USDT
• USDC
• BTC

ETH.

These assets can then move through:

• exchange
• OTC desk
• bridge
• other chain

private wallet.

Investigators must follow value, not only fiat.

THE OTC EXIT

Large token insiders may use over-the-counter brokers to convert proceeds without placing obvious public sell orders.

A future Kleptik investigation should identify:

• OTC counterparties
• stablecoin transfers
• exchange deposits

and fiat off-ramps.

That is where manipulated market value becomes spendable wealth.

RETAIL VICTIM IDENTIFICATION

Market manipulation produces diffuse victim populations.

Unlike a direct fraud where each person wires money to the promoter, a retail trader may simply buy on an exchange.

The victim may never know who was selling.

Loss analysis therefore requires:

• trade timestamps
• wallet attribution
• exchange account data
• price manipulation window

and insider-sale records.

LOSS IS NOT EVERY PRICE DECLINE

Crypto prices move for many legitimate reasons.

Kleptik should not attribute every investor loss during a manipulated period to defendants.

A defensible methodology should estimate:

• price inflation attributable to manipulation
• purchases during relevant period
• insider sales

and price normalisation afterward.

This remains analytically difficult.

MARKET SURVEILLANCE

The October 2024 cases raise an uncomfortable question for exchanges.

If artificial activity reached millions in volume, why was it not stopped earlier?

Potential explanations include:

• weak surveillance
• limited identity integration
• poor wash-trade detection
• off-platform coordination

or incentives to tolerate high volume.

High volume generates exchange fees.

That can create conflict.

THE EXCHANGE INCENTIVE

Exchange earns:

fee per trade.

More trades:

more revenue.

Wash trading:

many trades.

Therefore the exchange requires independent controls to prevent commercial incentives from rewarding artificial activity.

This is analogous to Binance’s compliance conflict.

Revenue-generating activity requires controls precisely because revenue alone does not establish legitimacy.

VOLUME IS NOT QUALITY

Crypto exchanges often advertise:

daily volume;

number of pairs;

number of users.

But an exchange should also measure:

• organic volume
• concentration
• self-trade rate
• bot rate
• manipulation alerts

and genuine unique counterparties.

A billion dollars of trades among ten coordinated accounts is not a billion-dollar market.

THE ORGANIC-VOLUME RATIO

Kleptik proposes:

ORGANIC VOLUME RATIO

Estimated genuine independent volume

÷

total reported volume.

Example:

Reported = $100 million.

Suspected wash volume = $70 million.

Organic ratio = 30%.

This may become more meaningful than headline trading volume.

THE UNIQUE-COUNTERPARTY RATIO

Another useful metric:

Unique independent counterparties

÷

total transactions.

A token can generate millions of trades among a very small number of controlled accounts.

Transaction count alone therefore means little.

MARKET-MAKER CONCENTRATION

Investigators should also ask:

What percentage of token volume comes from one market maker?

If one service provider controls most activity, the market is structurally dependent upon that provider.

Removing it may collapse liquidity.

THE WITHDRAWAL TEST

One of the simplest tests of apparent liquidity:

Can a large holder sell?

Model:

$10,000 sale.

$100,000 sale.

$1 million sale.

What happens to price?

If a “billion-dollar” token collapses under a modest real sale, displayed market cap is economically misleading.

THE DEPTH TEST

Order-book depth measures how much genuine buying interest exists near current price.

A token can show high historical volume but almost no available bids.

Volume measures the past.

Depth measures current ability to exit.

Retail investors often confuse the two.

THE MARKET-DATA RESPONSIBILITY

Market-data platforms also face difficult questions.

Should they:

• discount suspicious exchange volume?
• identify self-reported data?
• flag concentrated liquidity?
• exclude manipulated markets?
• show confidence scores?

The information layer influences investor decisions.

Therefore data quality becomes part of market integrity.

MANIPULATION DETECTION THROUGH BLOCKCHAIN ANALYTICS

Potential indicators include:

• repeated circular wallet paths
• same-source funding
• highly regular transaction spacing
• identical trade amounts
• rapid reversal
• minimal net position change
• shared gas funder

and concentration around specific exchanges.

But blockchain data alone is incomplete.

Centralised exchange internal records remain essential.

THE HUMAN INTENT LAYER

Algorithms show patterns.

Communications show intent.

The October 2024 operation is notable because prosecutors alleged market-making personnel openly discussed:

• self-trading
• volume generation
• avoiding detection
• pump-and-dump strategies

and the need for outside buyers.

This combination is powerful.

Trading pattern + communications.

Behavior + explanation.

WHAT INVESTORS SAW

The average retail investor did not see:

• market-maker contract
• bot dashboard
• controlled wallets

internal messages.

They saw:

price.

volume.

market cap.

social media.

exchange.

That asymmetry is the fraud opportunity.

One side knows the market is being constructed.

The other believes the market emerged naturally.

INFORMATION ASYMMETRY

All markets contain information asymmetry.

Insiders know more than outsiders.

Market-manipulation law exists partly because deliberately manufacturing false public signals crosses a different line.

The issue is not that insiders understand their token better.

It is that outsiders may be shown a market that does not genuinely exist.

CHRONOLOGY

2018–2024

Federal prosecutors allege Gotbit provides wash-trading and market-manipulation services to various cryptocurrency projects.

2021

Vy Pham leaves Saitama and later creates Robo Inu Finance, according to DOJ’s charging summary.

2022

Robo Inu allegedly begins paying Gotbit to artificially increase trading volume.

2023–2024

Investigators develop a broader undercover operation targeting market-manipulation providers.

2024

At law-enforcement direction, the NexFundAI token is created for the undercover investigation. ZM Quant, CLS Global and MyTrade are alleged to have provided or offered wash-trading services involving the token.

8 October 2024

Gotbit founder Aleksei Andriunin is arrested in Portugal.

9 October 2024

DOJ announces charges against 18 individuals and entities in the coordinated operation.

Four defendants have pleaded guilty.

Another has agreed to plead guilty.

More than $25 million in cryptocurrency has been seized.

Multiple trading bots are deactivated.

9 October 2024

SEC files parallel civil actions against three purported market makers and nine individuals.

At the archive date, many of the principal criminal allegations remain pending and must be described as allegations.

DOCUMENTARY RECORD

DOJ — 9 OCTOBER 2024

The Justice Department’s announcement provides the central criminal-case overview, defendant list, description of the undercover token and allegations concerning wash trading, pump-and-dump strategies and market-making services.

SEC — 9 OCTOBER 2024

The SEC’s coordinated civil actions describe alleged market manipulation involving Gotbit, ZM Quant and CLS Global and the objective of creating a false appearance of active markets for retail investors.

SEC — GOTBIT COMPLAINT

The SEC complaint alleges that Gotbit generated fake trading volume that, for certain client tokens at particular periods, represented more than 90% of trading activity.

SEC — CLS GLOBAL

The SEC separately alleged that UAE-based CLS Global and Andrey Zhorzhes manipulated the market for NexFundAI, the token created under FBI direction.

WHAT THE AUTHORITIES SAY

Federal prosecutors say crypto promoters hired market-making companies to create artificial trading activity and make tokens appear more attractive to outside investors.

They allege that real retail buyers were then induced to enter markets whose apparent demand had been manufactured.

The SEC advances a parallel civil theory: promoters and market makers created the false appearance of active crypto markets through self-trading and other transactions lacking genuine economic purpose.

Where defendants had pleaded guilty by 9 October 2024, Kleptik should identify those pleas specifically.

For others, allegations remain unresolved.

WHAT THIS DOSSIER DOES NOT ESTABLISH

This dossier does not establish that:

• every cryptocurrency market maker engages in wash trading
• all algorithmic trading is manipulative
• all high-volume tokens have fake volume
• every exchange named as a venue knowingly permitted manipulation
• every investor loss in the identified tokens resulted from wash trading
• every wallet interacting with a manipulated token belonged to a conspirator
• CLS Global or its employee had been convicted as of the archive date
• Gotbit and all charged personnel had been convicted as of the archive date

or crypto market capitalisation is inherently meaningless.

The report distinguishes guilty pleas from unresolved charges.

It also distinguishes an exchange being used as a venue from evidence that the exchange itself knowingly participated in manipulation.

RIGHT OF REPLY

Before publication, Kleptik should seek comment from:

• Gotbit Consulting LLC
• Aleksei Andriunin and counsel
• Fedor Kedrov and counsel
• Qawi Jalili and counsel

ZM Quant Investment Ltd. and relevant charged personnel

• CLS Global FZC LLC
• Andrey Zhorzhes and counsel
• Liu Zhou / MyTrade and counsel
• Saitama-related defendants where specifically discussed
• Vy Pham and counsel

For any exchange whose surveillance or controls are specifically criticised:

• BitMart
• LBank
• XT.com

or other identified venues should receive transaction-specific questions.

The fact that alleged wash trades occurred on an exchange does not establish that the exchange knowingly facilitated them.

UNANSWERED QUESTIONS

The October operation exposes the alleged manipulation industry.

It does not yet show its full scale.

1. CLIENT LIST

How many tokens hired each market maker?

2. TOTAL VOLUME

How much artificial trading volume was generated from 2018 through 2024?

3. TOTAL FEES

How much did market makers earn from manipulation services?

4. TOKEN COMPENSATION

How often were market makers paid in tokens they were responsible for supporting?

5. EXCHANGE DISTRIBUTION

Which exchanges carried the greatest amount of alleged wash trading?

6. DETECTION

Which exchanges detected suspicious patterns?

7. ACCOUNT CLOSURES

Which trading accounts were terminated before law-enforcement action?

8. API LOGS

What do exchange API records reveal about automated manipulation?

9. BENEFICIAL OWNERSHIP

Who controlled the trading accounts on both sides of suspected wash trades?

10. WALLET CLUSTERS

How many public wallets can be confidently linked to the charged market makers?

11. REAL VOLUME

What proportion of affected tokens’ reported activity was organic?

12. RETAIL LOSSES

How much real investor capital entered during manipulated periods?

13. INSIDER SALES

How many tokens were sold by founders during periods of artificial volume?

14. STABLECOIN PROCEEDS

Where did the proceeds of insider token sales go?

15. OTC DESKS

Were manipulation profits converted through over-the-counter brokers?

16. MARKET-DATA SERVICES

Did artificial volume influence rankings on major crypto information platforms?

17. LISTING DECISIONS

Did manipulated volume help tokens obtain listings they otherwise would not have received?

18. SOCIAL MEDIA

Were market-making campaigns coordinated with influencers or paid promotional activity?

19. UAE OPERATIONS

What regulatory status and operational footprint did CLS Global maintain in the UAE?

20. INDUSTRY SCALE

Was this a handful of corrupt market makers—or evidence of a much larger hidden service industry?

That may ultimately become the most important question.

KLEPTIK INTELLIGENCE ASSESSMENT

ASSESSMENT: HIGH CONFIDENCE

Artificial trading volume can materially distort the market signals on which retail cryptocurrency investors rely.

This follows directly from the mechanics alleged by both DOJ and SEC.

ASSESSMENT: HIGH CONFIDENCE

By October 2024, U.S. investigators had identified an alleged commercial market in which purported market makers offered wash trading and volume generation to token promoters.

The charging records describe multiple firms and client relationships rather than a single isolated scheme.

ASSESSMENT: HIGH CONFIDENCE

Automated bots materially increase the scale and persistence with which fake market activity can be generated.

Authorities reported disabling multiple bots responsible for millions of dollars’ worth of wash trades across approximately 60 cryptocurrencies.

ASSESSMENT: HIGH CONFIDENCE

The NexFundAI undercover token provided investigators with an unusually strong controlled environment for testing alleged manipulation services.

The token was created under law-enforcement direction and subsequently used in dealings with multiple alleged market makers.

ASSESSMENT: MODERATE-TO-HIGH CONFIDENCE

Crypto market-data rankings and exchange-listing mechanisms can amplify manipulation where they rely heavily upon reported volume without sufficiently discounting wash activity.

The exact degree varies by platform and requires platform-specific analysis.

ASSESSMENT: MODERATE CONFIDENCE

The market-making industry’s compensation structures may create significant conflict where firms receive token inventory or performance-linked compensation while simultaneously controlling significant trading volume.

This requires transaction-specific verification.

ASSESSMENT: OPEN

The percentage of aggregate global crypto trading volume attributable to wash trading cannot be reliably inferred from these cases alone.

The charged schemes establish a serious risk.

They do not justify assuming that the entire crypto market is artificial.

THE KLEPTIK VIEW

Investors often say:

The market has spoken.

But markets do not speak.

People trade.

Algorithms trade.

Bots trade.

Controlled accounts trade.

And sometimes the person creating the appearance of demand is the same person waiting for a genuine investor to believe it.

That is what makes wash trading more than fake volume.

It is fake social proof.

The buyer sees:

$20 million traded today.

Price up 40%.

Token trending.

Liquidity rising.

Exchange listing secured.

Thousands of transactions.

The natural conclusion is:

Someone knows something.

Maybe the project is gaining traction.

Maybe institutional money is entering.

Maybe there is real demand.

But suppose the real explanation is:

the token’s promoter paid a service company.

The service company opened or controlled multiple accounts.

Bots bought from themselves.

Volume appeared.

The market-data service recorded it.

The token climbed rankings.

Retail investors noticed.

At that moment, artificial activity has created real economic consequences.

The fake market has produced genuine buyers.

That is where manipulation becomes profitable.

And it reveals a flaw in the way digital markets are often analysed.

Investors focus heavily on:

HOW MUCH IS TRADING?

They should also ask:

WHO IS TRADING WITH WHOM?

Volume without independent counterparties is not demand.

Liquidity that disappears when one market maker switches off is not deep liquidity.

A billion-dollar market cap based on tiny manipulated trades is not a billion dollars of accessible wealth.

Thousands of transactions produced by five controlled accounts do not represent thousands of investors.

The blockchain can show every transaction and still create an illusion.

Because transparency of transactions is not transparency of control.

The October 2024 cases therefore expose a different type of laundering.

Not money laundering.

MARKET-SIGNAL LAUNDERING.

Artificial activity enters an exchange.

The exchange reports volume.

Market-data platforms ingest it.

Rankings improve.

Charts rise.

Investors see the output and assume it came from independent market participants.

The fake signal has passed through enough legitimate infrastructure to acquire credibility.

The lesson is simple.

A market statistic is not evidence merely because it appears on a screen.

It is a claim about underlying economic activity.

And claims require verification.

DON’T JUST FOLLOW THE PRICE.

FOLLOW THE WALLETS.

FOLLOW THE MARKET MAKER.

FOLLOW WHO GETS PAID WHEN REAL BUYERS ARRIVE.

KLEPTIK METHODOLOGY

This dossier is dated 9 October 2024 and is intentionally fixed to the legal and evidentiary position existing on that date.

Later pleas, convictions, sentencing proceedings or settlements are not retrospectively incorporated into the historical status of defendants unless separately identified in a later Kleptik dossier.

The principal evidentiary sources are:

• the U.S. Attorney’s Office for the District of Massachusetts
• criminal charging materials arising from the October 2024 operation
• the Securities and Exchange Commission’s parallel civil cases
• and

primary complaints concerning the relevant purported market makers.

Kleptik distinguishes carefully between:

• guilty pleas
• agreements to plead guilty
• criminal charges
• civil allegations
• trading-pattern analysis
• and

Kleptik assessments.

Market manipulation should not be inferred solely from high trading volume.

Potential indicators include:

• self-trading
• common beneficial control
• circular flows
• repeated matched orders
• minimal net economic position change
• bot activity
• internal communications
• client instructions

and payments specifically linked to volume generation.

Wallet clustering should be assigned confidence levels.

CONFIRMED CONTROL
Supported by exchange records, court filings, admission or equivalent primary evidence.

STRONG ATTRIBUTION
Multiple independent indicators identify common control.

PROBABLE CLUSTER
Blockchain patterns suggest common control but identity is not independently confirmed.

UNKNOWN
No defensible beneficial-owner attribution.

Kleptik should not identify a wallet owner publicly based solely upon speculative clustering.

For exchange analysis, the fact that wash trades occurred on a venue does not itself establish complicity by the venue.

To criticise an exchange’s controls, Kleptik should seek evidence concerning:

• alert generation
• self-trade prevention
• account linkage
• API surveillance
• investigations
• customer identity

and management response.

For market-cap analysis, Kleptik distinguishes:

displayed market capitalisation

from

realizable market value.

For liquidity analysis, the preferred evidence includes:

• order-book depth
• independent counterparties
• slippage
• market-maker concentration

and organic-volume estimates.

For retail-loss analysis, correlation between manipulation and price decline is insufficient.

Where possible, analysis should identify:

• investor purchase periods
• insider sale periods
• artificial volume
• price effect

and realized proceeds.

Any individual, market maker, token promoter, exchange or other entity facing material criticism should receive a transaction-specific opportunity to respond before publication.

EVIDENTIARY LABELS

ESTABLISHED — GUILTY PLEA
Criminal conduct formally admitted in court.

AGREED TO PLEAD GUILTY
Defendant publicly identified as having reached an agreement to plead, where plea not yet formally entered as of the archive date.

CRIMINALLY CHARGED
Formal criminal allegation; not proof of guilt.

SEC ALLEGATION
Civil allegation asserted in SEC enforcement proceedings.

WASH-TRADE INDICATOR
Trading pattern potentially consistent with common or coordinated control.

ARTIFICIAL-VOLUME INDICATOR
Evidence suggesting reported activity does not reflect genuine independent market demand.

MARKET-MAKER CONCENTRATION
Dependence of token liquidity on a small number of service providers.

KLEPTIK VERIFIED
Fact independently corroborated through primary documentary or trading records.

KLEPTIK ASSESSMENT
Analytical conclusion derived from identified evidence.

INVESTIGATIVE LEAD
Trading pattern, wallet or relationship requiring additional attribution.

UNVERIFIED
Information insufficiently corroborated for factual publication.

DOCUMENT STATUS

KLTK-2024-011

Subject: Crypto Market Manipulation / Wash Trading / Gotbit / ZM Quant / CLS Global / MyTrade
Archive date: 9 October 2024
Status at archive date: Coordinated criminal charges and SEC civil enforcement announced; mixed plea and pending-defendant statuses
Historical treatment: Fixed to report date

© KLEPTIK — Investigations into Power, Money and the Systems Designed to Hide Both