Ten Fraudsters from Four Financial Services Firms Charged in Different Cryptocurrency Market Manipulation Schemes Out of Northern District of California

Key takeaways

• Three indictments announced on March 30, 2026, in the Northern District of California charged ten foreign nationals across four cryptocurrency firms with wire fraud and conspiracy to commit wire fraud as part of Operation Token Mirrors.
• FBI and IRS-CI led the investigations, which included blockchain analysis as well as undercover operations whereby the government created its own token projects for manipulation. 
• Multiple executives from multiple firms were arrested and/or extradited to the US, including multiple arrests in Singapore.
• The executives and their firms are international in nature, including arrests of Taiwanese, Russians, Serbians, and Indian nationals.
• The individuals were indicted on wire fraud related charges without having to explore or apply nuanced Securities fraud law.

{{horizontal-line}}

Three indictments, ten defendants, one coordinated enforcement action

On March 30, 2026, the US Attorney's Office for the Northern District of California announced three indictments charging ten foreign nationals across four cryptocurrency firms GOTBIT, Vortex, Antier, and Contrarian, as part of Operation Token Mirrors, the DOJ's undercover investigation into cryptocurrency market manipulation. 

The indictments, filed separately between March and September 2025 and announced together, represent one of the most comprehensive enforcement actions against professional wash trading services in the history of crypto markets.

TRM is proud to have supported law enforcement in this investigation.

The GOTBIT indictment charged Antoine Tsao (a/k/a Chung Tien Tsao), a Taiwanese national and Business Development Manager at GOTBIT; Ian Sofronov, a Russian national and Sales Manager at GOTBIT; and Nemanja Popov, a Serbian national and Global Account Manager at GOTBIT, with conspiracy to commit wire fraud and two counts of wire fraud under 18 U.S.C. §§ 1349 and 1343. Tsao was arrested at John F. Kennedy International Airport on March 30, 2025.  On June 2, 2025, Tsao pled guilty to conspiracy to commit wire fraud and was sentenced by U.S. District Court Judge Araceli Martínez-Olguín in Oakland, California. Nemanja Popov was arrested at San Francisco International Airport, and pled guilty and was sentenced on February 10, 2026.

The Vortex indictment charged Russian nationals Gleb Gora,Sergei Ryzhkov, and Michael Vogel with conspiracy to commit wire fraud and wire fraud under 18 U.S.C. §§ 1349 and 1343. Gora was arrested in Singapore on October 2, 2025, at the request of the United States. Gora made his initial appearance before the U.S. Magistrate Judge today in Oakland following his extradition from Singapore.

A Contrarian/Antier Solutions Private Limited indictment charged Indian nationals Manu Singh, Kushagra Srivastava, Vasu Sharma, 26, and Sabby Singh with wire fraud and wire fraud conspiracy for a scheme to pump up the price of a cryptocurrency token. Singh and Sharma were arrested in Singapore on October 2, 2025, at the request of the United States, and made their initial appearances in Oakland on Monday. 

A market manipulation firm hiding in plain sight

GOTBIT Consulting LLC, also known as GotBit Hedge Fund, was registered in Belize and publicly advertised "market making" services through its website at gotbit.io. By 2021, the firm claimed more than 100 team members. On the surface, GOTBIT presented itself as a professional cryptocurrency trading and consulting firm offering legitimate services such as price monitoring, liquidity management, and exchange analytics.

In reality, according to the indictment, GOTBIT operated as a wash trading service. Individuals, entities, and token projects paid GOTBIT approximately USD 5,000 per month to generate artificial trading volume in their tokens, creating the false appearance of organic market activity to induce retail investors to buy, and then profiting from the sale of those tokens at artificially inflated prices.

GotBit on-chain activity showed tokens being created then trades made between related parties

The FBI and IRS-CI were able to quickly trace the transactions on multiple blockchains (depending on project) and show the circular nature of transactions between related parties. In fact, the investigators showed that 1,209 of 1,221 transactions (99%) traced back to the GotBit wallets.

The undercover sting confirmed what investigators had already tracked on-chain. After undercover Agents approached GotBit executives related to market-making for their token project “Lexobit,”, the GotBit executives explained how and why GotBit could use wash trading to pump (and potentially dump) the tokens:

One exchange between undercover Agents and GotBit executives was included in the indictment.

As the GotBit executives told agents, they “take 2% from liquidations and don’t judge.” The market manipulations turned into very lucrative enterprises for all of the indicted individuals. 

Anatomy of a wash trading scheme

Wash trading in cryptocurrency markets refers to the practice of generating artificial transaction volume by acting as both buyer and seller in the same transaction or series of transactions, with no change in beneficial ownership. These transactions serve no legitimate economic purpose — they are designed solely to generate misleading market signals and create the false impression of investor interest to induce others to buy or sell.

Wash trading is a relatively common criminal and civil violation in traditional securities law. As the GotBit executives alluded, because specific crypto tokens are not defined as securities (generally), the Securities Exchange Act of 1934 likely does not apply. That being said, the statements made by the GotBit executives provided clear knowledge and understanding that their service was offered specifically to create a false market, which made traditional wire fraud charges appropriate. 

Forfeiture: 1.2 million in USDT seized from the GOTBIT wallet

On June 3, 2025, the Court entered a Preliminary Order of Forfeiture against Antoine Tsao covering 1.2 million in USDT tokens that he held as a result of his scheme. The forfeited address was the same address to which the undercover agents transferred USD 15,000 to retain GOTBIT's services and later sent 5 ETH to fund the deployment of GOTBIT's trading bots:

The evidence spoke for itself

The power of this prosecution rests not only on recorded statements from the defendants — though those are striking — but on the immutable record of the blockchain itself. Every transaction GOTBIT's bots executed was permanently recorded on the Ethereum blockchain. The 36 wallet addresses GOTBIT disclosed to its undercover client became a roadmap for investigators, allowing analysts to reconstruct the full scope of the artificial activity and confirm that the claimed organic market interest was entirely fabricated.

This convergence of documented communications and on-chain evidence illustrates why blockchain transparency is such a structural asset for law enforcement. Defendants can obscure their intent, route transactions through multiple wallets, and obfuscate ownership — but they cannot alter or delete the public ledger. When investigators know where to look and have the tools to follow the data, wash trading leaves an unmistakable footprint.

Broader context: Operation Token Mirrors and the future of market integrity enforcement

Operation Token Mirrors, launched by the DOJ in October 2024, has now produced three coordinated indictments spanning four firms and ten defendants across multiple countries. The scope and coordination of this action signal a sustained commitment by federal prosecutors to treat cryptocurrency market manipulation — not just theft or fraud against individual victims — as a federal enforcement priority.

The statements captured during this investigation underscore why that priority matters. GOTBIT's founder acknowledged in public interviews that the firm's clients were knowingly participating in deceptive schemes, and that it was "the investors and those who believe in the crypto industry who are losing." Wash trading at scale does not just affect the individual token projects involved, it corrodes the price discovery mechanisms that all participants in cryptocurrency markets depend on.

As enforcement agencies continue to build expertise in blockchain analytics and deepen international partnerships, the cost of operating professional market manipulation services is rising. The Lexobit sting demonstrates that law enforcement can meet sophisticated crypto fraud on its own terms — infiltrating operations, documenting schemes in real time, and using the blockchain's own transparency to build airtight cases.

{{horizontal-line}}

Freuently asked questions (FAQs)

1. What is Operation Token Mirrors?

Operation Token Mirrors is a DOJ undercover investigation launched in October 2024 targeting cryptocurrency market manipulation. It produced three indictments charging ten foreign nationals across four firms — GOTBIT, Vortex, Antier, and Contrarian — using FBI-created token projects to infiltrate wash trading schemes.

2. What is wash trading, and why is it illegal?

Wash trading means generating fake transaction volume by acting as both buyer and seller, creating a false impression of market interest to lure retail investors into buying at inflated prices. Prosecutors used wire fraud charges since the tokens aren't clearly defined as securities.

3. How did law enforcement build the case?

Investigators combined blockchain analysis with undercover operations. On-chain tracing showed 99% of GOTBIT's transactions were circular, and undercover agents posing as clients recorded GOTBIT executives openly describing their wash trading methods.

4. Who was charged, and what has happened so far?

Ten foreign nationals from Taiwan, Russia, Serbia, and India were charged. Multiple defendants have been arrested — including in Singapore — with several already pleading guilty. A forfeiture order seized 1.2 million USDT from a GOTBIT wallet.

5. Why were wire fraud charges used instead of securities fraud?

Because crypto tokens generally aren't classified as securities, the Securities Exchange Act likely doesn't apply. The defendants' own admissions of knowingly creating false markets made wire fraud charges under 18 U.S.C. §§ 1349 and 1343 a cleaner fit.