Operation Token Mirrors: How the FBI Built a Fake Crypto Token to Trap the Wash Trading Industry
When the FBI wants to catch a drug dealer, they send in an undercover agent. When the FBI wanted to catch crypto wash traders, they built their own cryptocurrency.
That's the story behind Operation Token Mirrors — a multi-year DOJ sting that culminated on March 30, 2026 with indictments against 10 foreign nationals across four firms, the unsealing of one of the most sophisticated crypto fraud investigations in U.S. history. The operation didn't just expose individual bad actors. It revealed an entire professional ecosystem of market manipulation-for-hire that, according to prosecutors, touched over 60 different cryptocurrencies and generated millions in fees for firms willing to make fake volume look real.
The Honey Pot That Launched 10 Indictments
In 2024, the FBI took an unprecedented step: it created its own cryptocurrency. The token, dubbed NexFundAI, was deployed on Ethereum with all the trappings of a legitimate project — a website, tokenomics documentation, an active online presence, and a convincing backstory positioning it as an AI-powered financial services token.
Undercover agents posed as NexFundAI's project team and approached professional market-making firms, pitching the classic small-cap token problem: we have a promising project but nobody's trading it. Can you help us build volume?
The firms said yes.
What followed was a real-time recording of the wash trading industry in action. Automated bots would execute simultaneous buy and sell orders across centralized exchanges, with the same entity acting as both buyer and seller. No actual value changed hands, no genuine market demand existed — but the order books lit up with activity, trading volume spiked on CoinMarketCap and CoinGecko, and from the outside, NexFundAI looked like a legitimate project with organic interest.
Prosecutors documented everything: contracts, payment records, digital communications, and the blockchain transactions themselves. The honey pot didn't just catch perpetrators — it produced an ironclad evidentiary record.
Four Firms, Ten Defendants, One Operation
The March 30 indictments charged executives and employees across four firms operating from Russia, India, Serbia, and Taiwan:
Gotbit was the most high-profile target. Founded by Russian national Aleksei Andriunin, Gotbit operated as a market manipulator-for-hire from 2018 through 2024, offering wash trading services to crypto projects that wanted artificially inflated volume and prices. Andriunin had already pled guilty in March 2025, agreeing to forfeit approximately $23 million in cryptocurrency — nearly $14 million in Tether and $9 million in USDC — and was sentenced to eight months in prison. The March 2026 indictments charged three additional Gotbit employees: Antoine Tsao (Taiwan), Ian Sofronov (Russia), and Nemanja Popov (Serbia), who had already pled guilty and was sentenced in February 2026.
Vortex saw three Russian nationals — Gleb Gora, Sergei Ryzhkov, and Michael Vogel — charged with conspiracy to commit wire fraud. Gora was arrested in Singapore in October 2025 at U.S. request and extradited, making his Oakland court appearance in early 2026.
Contrarian and Antier Solutions faced charges against four Indian nationals: Manu Singh, Kushagra Srivastava, Vasu Sharma, and Sabby Singh. Singh and Sharma were arrested in Singapore in October 2025 and appeared before a U.S. magistrate in Oakland on March 30, 2026 — the same day the indictments were unsealed.
In total, the operation identified manipulation across more than 60 different cryptocurrencies and resulted in seizure of over $25 million in digital assets. If convicted, defendants face up to 20 years imprisonment per charge.
The Scale of the Problem They Exposed
Operation Token Mirrors didn't just prosecute four firms. It put a spotlight on how endemic wash trading has become across crypto markets.
CoinDesk's April 2, 2026 analysis called it "far more common than investors think," a characterization backed by market data. Research has estimated that fake volume on unregulated crypto exchanges averages around 77.5% of reported figures, meaning the majority of trading activity on many platforms is fabricated. Blockchain analytics firm Chainalysis has tracked $1.87 billion in detected wash trade volume across major chains, with the largest single operator executing over $313 million in suspected fake trades.
The mechanics are straightforward enough that it became industrialized. A project team pays a market-making firm. The firm deploys bots that execute thousands of trades per day between wallets it controls. Volume numbers climb. The token appears active. Retail investors, seeing apparent demand, buy in. Insiders liquidate at the top. The wash traders collect their fee regardless of outcome.
What made Gotbit and its peers particularly brazen was the breadth of clients they served. Gotbit reportedly worked with hundreds of token projects, becoming effectively a turnkey manipulation service operating in the open under the label "market making."
Why the "Honey Pot" Approach Changes Everything
Previous crypto enforcement actions typically followed a reactive pattern: regulators observed suspicious activity, gathered evidence from exchange logs and on-chain data, and built cases retrospectively. The problem with that approach for wash trading specifically is that it's difficult to prove intent when the same bots that wash trade can theoretically also provide genuine liquidity.
Operation Token Mirrors flipped the script. By creating NexFundAI from scratch and approaching firms directly as a client, the DOJ generated evidence showing explicit intent: these firms were not providing market-making services that incidentally inflated volume. They were selling inflated volume as the product itself.
The operation also demonstrated that crypto enforcement has matured technically. The FBI's ability to deploy a credible ERC-20 token, monitor on-chain activity in real time, and coordinate global arrests across Singapore, the U.S., and multiple countries signals that the "wild west" framing for crypto markets is increasingly outdated.
The DOJ's National Cryptocurrency Enforcement Team (NCET) — ironically, the very team that a January 2026 memo sought to wind down — ran much of the groundwork for this investigation before the political winds shifted. The indictments themselves represent work that started in 2024, and the global arrest coordination reflects years of relationship-building with Singapore law enforcement.
Ripple Effects for Legitimate Market Makers
The indictments have sent a clear signal to the broader market-making industry. Firms like Wintermute, GSR, and Jump Crypto have long maintained that they provide genuine liquidity — real two-sided order books that tighten spreads and reduce slippage for legitimate traders. The Operation Token Mirrors prosecutions draw a bright legal line between that activity and what Gotbit and Vortex were selling.
DWF Labs, which has faced prior accusations of market manipulation (accusations it has denied as "competitor-driven FUD"), now operates in a regulatory environment where wash trading carries explicit criminal exposure. The industry-wide chilling effect is likely intentional.
For token projects that paid for market-making services without explicitly requesting wash trading, the legal exposure is murkier. Prosecutors have so far focused on the supply side — the firms providing manipulation services. But project teams who knowingly paid for fake volume may face scrutiny as well.
The broader implication is that the "liquidity theater" era of small-cap tokens — where projects bootstrapped apparent demand through paid volume to attract real investors — is approaching its end. Not because ethics improved, but because the cost of getting caught is now clearly documented: federal prison time, eight-figure forfeitures, and the kind of international arrest coordination that crosses borders.
What Comes Next
The March 30, 2026 announcements represent one phase of what appears to be a sustained enforcement push. Several defendants remain at large or in ongoing proceedings. The cooperative plea deals from Gotbit's founder and Contrarian employees suggest prosecutors are using those cooperators to build cases against additional targets.
Meanwhile, the SEC-CFTC March 17 joint taxonomy that classified 16 tokens as "digital commodities" is creating clearer jurisdictional ground for market manipulation charges under CFTC authority — historically more aggressive than SEC on manipulation cases. As market structure legislation advances through Congress, explicit wash trading prohibitions similar to those governing equities are likely to be codified into law for the first time.
The message from Operation Token Mirrors is unambiguous: the FBI can build a better fake crypto token than the market manipulators, deploy it as a trap, and coordinate global arrests when the bots start trading. For the wash traders who turned fake volume into a multi-million-dollar business, the honey pot that caught them wasn't NexFundAI. It was the assumption that crypto enforcement would never catch up.
It did.
BlockEden.xyz provides enterprise-grade APIs and node infrastructure for Ethereum and 20+ blockchains — the foundation developers need to build legitimate on-chain applications without the compliance risk that comes from fake liquidity shortcuts. Explore our API marketplace to access the tools that serious builders use.