How the FBI Caught the Kings of Rigged Markets: The Complete Story of Operation Token Mirrors

From the 20-year-old who confessed everything in a public interview in 2019, to the honeypot coin that dismantled a billion-dollar industry — and the six fugitives still on the run.

By Thomas Voss | Section: Investigation | Updated: June 26, 2026

The 20-Year-Old Who Admitted Everything in 2019

In the summer of 2019, CoinDesk published an interview with Aleksei Andriunin, then an applied mathematics student in Moscow. Andriunin had founded Gotbit straight out of his teens and by the time of the interview was already managing contracts with approximately 30 projects simultaneously, all positioned within the top 200 to 500 by global market capitalization.

In that conversation — which would come back to haunt him five years later in American federal courts — Andriunin was explicit about everything:

• Fees to generate artificial volume: $6,000 per month per token
• Fees to secure a CoinMarketCap listing with two exchanges included: $15,000 per month
• Stated objective: climb CoinMarketCap rankings and gain access to second-tier exchanges through artificially inflated volumes
• One client had already reached the top 100 thanks to his services

"I think FATF will shut it down quickly: cryptocurrency exchanges will be regulated like NASDAQ and pumping fake volumes will be banned," Andriunin said in that interview.

The DOJ document issued in June 2025 at the time of the final sentencing explicitly cited that interview: Andriunin had publicly described how he had developed code to execute wash trading on cryptocurrencies for the specific purpose of artificially inflating trading volumes and securing CoinMarketCap listings.

TRM Labs, the blockchain analytics firm that supported the FBI's investigation, added an even more damning documented detail: Gotbit's founder had publicly acknowledged that the company's clients knowingly participated in deceptive schemes, and that it was "investors and those who believe in the crypto sector who lose" from the operation.

That statement is in American court records. But between that public declaration and the first arrest warrant, five years passed — two oceans and an entire industry that continued to operate as normal.

NexFundAI — The FBI's Honeypot Coin (Phase 1, October 2024)

On October 11, 2024, the U.S. Department of Justice for the District of Massachusetts unveiled the operation that would redraw the boundaries of crypto enforcement: Operation Token Mirrors.

To catch the market makers rigging the market, the FBI had built an elaborate trap: a fictitious cryptocurrency called NexFundAI (ticker: NEXF), launched on the Ethereum blockchain. The agency presented itself to the market as a legitimate project seeking market-making services — and offers poured in.

Eighteen individuals and entities were indicted in the first phase of the operation. The firms involved were the dominant players in the sector:

Gotbit (Russia/Portugal): the flagship firm. Pricing: $5,000 per month per token to generate artificial volumes. In transactions related to NexFundAI alone, Gotbit executed 1,209 circular transactions out of 1,221 total — 99% of declared volume was artificial, generated through 36 distinct wallet addresses controlled by the same entity.

CLS Global (UAE): executed over 80,000 wash trading operations on Uniswap for the NexFundAI token alone, generating $600,000 in entirely fictitious volume. During a video call recorded by FBI agents, a company employee stated: "I know this is wash trading and I know people might not be happy about this." He said it — and continued anyway. Settlement terms: $428,059 fine, three years probation, three-year U.S. ban.

ZM Quant (China) and MyTrade MM: also indicted for similar services.

Antoine Tsao, Gotbit's business development manager based in Taiwan, was arrested at New York's JFK airport in March 2025. Seizures identified 1.2 million USDT at the same address where the FBI had deposited $15,000 as a "test client" — plus 5 ETH for bot deployment. He pleaded guilty in June 2025.

The Real Tokens That Wiped Out Investors — Saitama ($7 Billion to Zero) and Robo Inu

NexFundAI was the centerpiece, but the investigation dug much deeper. The DOJ documented manipulation of over 60 real cryptocurrencies — tokens bought by real investors who had no idea they were operating in a market rigged from the ground up.

Saitama Inu: From Seven Billion to Zero

Saitama Inu is the most documented and most brutal example in the entire dossier. At its peak in November 2021, the token had reached a market capitalization of $7 billion. It was one of the most talked-about meme coins, with a community of tens of thousands of holders and an aggressive marketing campaign.

That November 2021, the team had organized an event at the MGM Grand in Las Vegas: private jets, influencers, a convention with thousands of attendees. According to evidence that emerged from subsequent investigations, some developers were visibly intoxicated on stage. In a single night the token lost 50%. Then it kept falling. Today it is worthless.

SEC investigations (complaint LR-26155, October 2024) reconstructed what was happening behind the scenes: Saitama's promoters — Russell Armand (Texas), Maxwell Hernandez (Massachusetts), Manpreet Singh Kohli (India/England), and Nam Tran (Washington) — had simultaneously hired both ZM Quant and Gotbit to manipulate the market.

While promoting the token to retail investors, they falsely claimed to be holding their own tokens while secretly dumping them on the market. The V2 migration of 2022 — presented as a "technical upgrade" — was designed to allow insiders to exit before retail holders.

Russell Armand, one of the founders, allegedly used project funds to purchase cocaine and a black Lamborghini. He later pleaded guilty. Sanction terms are still being determined.

Gotbit was generating, for the Saitama account alone, more than one million dollars of artificial volume per day.

Robo Inu Finance

Robo Inu Finance is the second documented case. Promoter Vy Pham had hired Gotbit under a contract the DOJ described without mincing words as "market-manipulation-as-a-service": Gotbit's bots generated artificial volumes for Robo Inu, building an inflated CoinMarketCap ranking that led unsuspecting investors to interpret the activity as organic market interest.

Gotbit's director responsible for this contract, Fedor Kedrov, was indicted in October 2024. He has never been arrested. He is still at large.

The Sentence — June 2025 (Only 8 Months? Here's Why)

On June 16, 2025, Aleksei Andriunin received his sentence before a U.S. federal court. He was 26 years old.

The sentence: 8 months in prison, $23 million in forfeitures, one year of post-incarceration supervision. Gotbit LLC: five years probation and permanent cessation of operations. The firm that had manipulated dozens of cryptocurrencies for six years shut its doors by federal court order.

Eight months. Many found the sentence inadequate given the scale of harm caused. The explanation is procedural, not ideological: Andriunin actively cooperated with the DOJ, providing information that enabled subsequent phases of the operation and the identification of new networks. His testimony carried probative value in investigations that remain ongoing. Sentence reduction for cooperation is standard practice in the American federal system.

The Gotbit co-founder — one of the rare cases where the founder of a $23 million criminal enterprise ends up with eight months effective — spent nearly four months in pretrial detention in Portugal before extradition in February 2025.

Nemanja Popov, Gotbit's Serbian account manager, was arrested at San Francisco International Airport and sentenced in February 2026. Antoine Tsao (business development, Taiwan), arrested at JFK, pleaded guilty in June 2025 with 1.2 million USDT confiscated.

Still at large: Fedor Kedrov and Qawi Jalili, both Gotbit directors, indicted in October 2024, never arrested. Ian Sofronov, Gotbit's Russian sales manager: indicted, status unknown.

Lexobit — The FBI's Second Honeypot (Phase 2, March 2026)

On March 30, 2026, the U.S. Department of Justice for the Northern District of California — based in Oakland — unveiled Phase 2 of Operation Token Mirrors.

This time the honeypot token was called LEXOBIT. Ten foreign nationals were indicted in three separate indictments, filed before U.S. District Judge Araceli Martínez-Olguín. The charges: wire fraud, carrying a maximum sentence of 20 years in prison.

The most significant arrests had occurred months earlier, in Singapore in October 2025 — demonstrating that the FBI's operation had been running long before the public announcement:

Vortex Capital:

• Gleb Gora, 24, Russian, CEO: arrested in Singapore in October 2025, extradited to Oakland on March 30, 2026
• Sergei Ryzhkov (CFO, Russian): indicted, not arrested
• Michael Vogel (business development, Russian): indicted, not arrested

Contrarian Trading / Antier Solutions:

• Manu Singh, 34, Indian, CEO Contrarian: arrested in Singapore, extradited to Oakland on March 30, 2026
• Kushagra Srivastava (CFO, Indian): indicted, not arrested
• Vasu Sharma, 26, Indian, business development Contrarian: arrested in Singapore, extradited to Oakland on March 30, 2026
• Sabby Singh (business development Antier, Indian): indicted, not arrested

A clear pattern emerges from the data: criminal market-making firms operated with deliberately distributed structures across multiple jurisdictions. CEOs and founders were based in Russia or in countries with limited extradition agreements. Operational profiles — those who spoke directly with clients — were positioned in Asia, within easy reach of Singapore.

The total across the entire operation: 28 individuals and entities indicted, $25 million in cryptocurrencies seized, over 60 tokens manipulated. Chainalysis estimates that the volume of wash trading in the crypto market was at least $2.6 billion — and that is an undercount, built only on detectable on-chain patterns.

The Trump Paradox: Enforcement Without Regulation

In April 2025, the Trump administration's Department of Justice — through a memorandum from Deputy Attorney General Todd Blanche — dissolved the National Cryptocurrency Enforcement Team (NCET). The official rationale: to end the "regulatory weaponization against digital assets."

The message seemed unambiguous: the era of systematic crypto enforcement was over. The new administration would let the market self-regulate, removing the constraints that — according to the Republican narrative — were stifling American innovation in the blockchain sector.

Operation Token Mirrors disproved that narrative with hard facts.

Phase 2 was announced on March 30, 2026 — nearly a year after the NCET was dissolved. During the same period, the DOJ recorded some of the largest seizures in its crypto enforcement history:

• $15 billion in Bitcoin seized in the Chen Zhi case (international pig butchering) — the largest confiscation in DOJ history
• $61 million in Tether seized in North Carolina (pig butchering, February 2026)
• $263 million in Bitcoin stolen from a single victim through social engineering: 12 defendants, nightclub tabs of $500,000, 28 exotic cars confiscated

The distinction has become clear: no regulation of cryptocurrencies as an asset class, but fraud remains a federal crime. Wash trading, pump-and-dump, coordinated market manipulation: none of these activities found political cover under the new doctrine.

For those who hoped for a de facto amnesty, the FBI's message was explicit: they keep building honeypot tokens. They keep arresting people in Singapore. They keep extraditing them to Oakland.

The paradox of this political phase is that American crypto deregulation has made the market more hospitable for legitimate innovation while simultaneously concentrating enforcement on the most blatant frauds. The practical effect: those operating in regulatory gray areas have more freedom; those actively manipulating the market are more exposed.

CoinMarketCap — The Glaring Omission

CoinMarketCap's name appears explicitly in DOJ documents. Not as a defendant, but as the target infrastructure of the manipulation.

The criminal logic was simple and well-described by Andriunin himself back in 2019: CoinMarketCap rankings determine market perception. A token in the top positions by volume is interpreted as legitimate by retail investors. Major exchanges list it. Funds consider it. The community talks about it.

Gotbit had a specific fee for this: $15,000 per month to guarantee CMC ranking appearances through artificial volumes on at least two partner exchanges. Andriunin had said so publicly in 2019. The DOJ confirmed it in 2024 as a central element of the fraudulent mechanism.

CoinMarketCap, acquired by Binance in 2020, published an informational article about the CLS Global fine in its Academy section. It reported the case as a regulatory news story.

It did not release official statements on how its own volume data is verified today. It did not announce policy changes in response to the federal operation. It provided no public explanation of how its ranking system responds to identified wash trading.

This is not an accusation against CoinMarketCap. It is a question that anyone using the platform to make investment decisions deserves to have answered.

The problem of falsified volume — documented by Bitwise as early as 2019 (95% of CMC volume was fake), by Forbes in 2022 (51% of declared exchange volume was non-economic), by Chainalysis in 2025 ($2.57 billion in wash trading detected on DEXs alone) — has not been solved. It has become more sophisticated.

The data that appears on CoinMarketCap today comes from hundreds of exchanges, many of which operate without regulatory oversight and without any obligation of verifiability. The mechanism Andriunin was exploiting in 2019 — generating artificial volumes on minor exchanges to climb aggregator site rankings — remains structurally available today.

Who Is Still At Large — The Story Isn't Over

The list of defendants never arrested is significant, and reflects a structural limitation that American authorities know well.

From the Phase 1 Indictment (October 2024):

• Fedor Kedrov (Gotbit director, Russia): indicted in October 2024, never arrested. He was responsible for the Robo Inu Finance contract.
• Qawi Jalili (Gotbit director): indicted in October 2024, never arrested.

From the Phase 2 Indictment:

• Ian Sofronov (Gotbit sales manager, Russia): indicted, status unknown
• Sergei Ryzhkov (Vortex CFO, Russia): indicted, not arrested
• Michael Vogel (Vortex business development, Russia): indicted, not arrested
• Kushagra Srivastava (Contrarian CFO, India): indicted, not arrested
• Sabby Singh (Antier business development, India): indicted, not arrested

Many of the unnarrested defendants are Russian citizens. Extradition from Russia to the United States is virtually impossible in the current geopolitical context: there is no bilateral extradition treaty, and diplomatic relations between the two countries do not permit this form of judicial cooperation. This is a structural limitation that Russia-based market manipulation firms exploited knowingly as a form of protection.

For Indian and Singaporean defendants the situation is different: Singapore demonstrated full cooperation in October 2025, enabling the arrests of Gora, Manu Singh and Vasu Sharma. Extradition agreements between Singapore and the United States are operational and judicial cooperation works.

Federal prosecutors have stated that investigations continue. New arrest warrants can be executed at any moment in any country with active extradition agreements with the United States.

What is certain is that the market for fraudulent market making did not stop with Operation Token Mirrors. The firms involved are closed or downsized. But the business model — generating artificial volumes to climb rankings and obtain listings — is replicable by anyone with sufficient capital and technical infrastructure. The FBI's operation eliminated some operators, not the market.

The question that remains unanswered — and which prosecutors have deliberately left open — is how many other firms are still operating, and how many of the exchanges publishing volumes on aggregator platforms are still part of this system.