The fraud rarely begins with an obvious lie
The largest crypto scandals did not initially look alike. OneCoin travelled through hotel conferences and multilevel-marketing meetings. FTX presented itself as institutional market infrastructure. Terra wrapped a reflexive financial mechanism in the language of decentralisation. Celsius offered a polished savings app. SQUID lasted only days. What connected them was not one technology but one recurring transfer of trust: users were asked to believe a story precisely where an independent control should have existed.
This investigation therefore follows two records at once. The first is the public narrative—returns, safety, liquidity, transparency and community. The second is the control record—who held the money, who could change the rules, whether liabilities were visible, whether customers could exit, and what prosecutors, courts or regulators later established. The distance between those two records is where the damage accumulated.
The figures in this report are deliberately not added into a single “total loss.” A court-ordered forfeiture, customer shortfall, market-capitalisation collapse and amount deposited are different measurements. Treating them as interchangeable would create a dramatic number but a weak investigation. The useful comparison is structural: which safeguard was missing, how long the absence remained hidden and what finally forced the truth into the open.
How to read the evidence
Established
A conviction, guilty plea, final civil finding or formal regulator conclusion supports the description.
Alleged
A prosecutor or regulator has filed a claim, but the relevant person has not been finally convicted on that claim.
Unresolved
On-chain evidence or contemporaneous reporting describes the event, but the operators have not been identified in a final judgment.
How we use the word “scam”
A hack, insolvency or failed token is not automatically fraud. We use firm language only where a court, regulator or guilty plea supports it. Allegations and unresolved cases are labelled as such. The figures below are not directly comparable: some describe money raised, some customer losses, some market value destroyed and some court-ordered forfeiture.
Ten cases at a glance
Not a strict loss ranking. Values are rounded historical figures from court records, regulators and contemporaneous reporting.
| Case | Model | Reported scale | Legal status |
|---|---|---|---|
| OneCoin | Fake cryptocurrency · MLM | ≈ US$4B | Convictions · founder remains wanted |
| FTX | Centralised exchange fraud | US$8B+ | Criminal conviction · 25-year sentence |
| Terra / UST / LUNA | Algorithmic stablecoin · fraud | ≈ US$40B | Guilty plea · 15-year sentence |
| PlusToken | Wallet and investment Ponzi | US$2B+ | Organisers convicted in China |
| BitConnect | Lending Ponzi · exchange token | ≈ US$2.4B | Founder indicted · promoter convicted |
| Celsius Network | Crypto lender · token manipulation | ≈ US$4.7B | Guilty plea · 12-year sentence |
| Mirror Trading International | Bitcoin trading Ponzi | 29,000+ BTC | Court judgment · regulatory findings |
| QuadrigaCX | Exchange misappropriation | ≈ C$169M | Regulator concluded fraud |
| SafeMoon | Liquidity-pool theft · token | US$7.5M | Criminal conviction and sentence |
| SQUID token | Meme-token rug pull | US$3M+ | Anonymous operators · unresolved |
A decade of collapses, convictions and recoveries
The schemes overlapped. While courts were still untangling one failure, the next platform was using a new interface to sell an old promise.
OneCoin launches
A supposed cryptocurrency is distributed through educational packages and a global recruitment network.
BitConnect expands
A secret trading bot and a closed BCC lending loop turn extraordinary returns into a mass-market pitch.
Ignatova disappears
OneCoin co-founder Ruja Ignatova boards a flight from Sofia to Athens and vanishes from public view.
BitConnect closes
The lending programme shuts down; BCC loses almost all of its value. PlusToken begins spreading across Asia.
PlusToken and QuadrigaCX
PlusToken withdrawals fail. Canada’s QuadrigaCX enters insolvency after its founder’s death.
MTI unravels
Mirror Trading International stops meeting withdrawals; its chief executive disappears.
The fastest rug pull
SQUID rises on pop-culture attention, blocks ordinary selling and collapses when liquidity is removed.
Terra, Celsius and FTX
A stablecoin death spiral, frozen lender accounts and an exchange run expose three different forms of hidden fragility.
Court record catches up
Major convictions, pleas, civil findings and sentences establish conduct that marketing once concealed.
Recovery is still unfinished
OneCoin remission opens with more than $40 million available; other estates and enforcement processes continue.
Court record
Documentary image · source and licence shown in caption
Three systems, three ways customer money became trapped
These diagrams simplify the mechanics without pretending the cases were identical. They show the point at which the public story and the actual control of money separated.
OneCoin: a database presented as a blockchain
A genuine public blockchain lets outsiders verify issuance, transfers and consensus rules. OneCoin offered members balances and a price, but prosecutors said there was no real public blockchain behind the product. The units were distributed after people bought “education packages,” while the organisation—not an open market—controlled the displayed value. The technical vocabulary performed the role that audited accounts or independently verifiable code should have played.
The second engine was distribution. Multilevel-marketing commissions rewarded members for recruiting new buyers, so personal relationships became the sales channel. A participant did not need to understand cryptography; they needed a persuasive local leader, a stage presentation and the belief that early entry would produce life-changing wealth. As money moved upward, social proof moved downward: photographs of crowds and successful promoters made scale look like validation.
The case did not end when the product stopped expanding. Ruja Ignatova remains wanted. Co-founder Karl Sebastian Greenwood received a 20-year sentence and forfeiture order. In 2026, the U.S. Justice Department announced a remission process backed by more than $40 million in forfeited assets. That sum matters to victims, but it also exposes the asymmetry of fraud recovery: billions can be collected quickly while compensation is traced and distributed over many years.
Control failure: buyers could not independently verify the asset, the market or the route taken by their money.
Case files · OneCoin ↓FTX: an account balance without segregated assets
FTX was dangerous precisely because it did not resemble a conventional Ponzi pitch. It had professional investors, naming-rights deals, sophisticated trading products and a founder repeatedly presented as an advocate of responsible regulation. Customers saw a liquid exchange. Inside the group, Alameda Research had access and privileges unavailable to ordinary users, and customer assets were used to support trading, investments, political donations and other spending.
The balance displayed on a customer screen was therefore not the same thing as a segregated asset held solely for that customer. This distinction stayed abstract while deposits and confidence were growing. It became decisive when doubts about the group’s balance sheet triggered withdrawals. An exchange can meet routine outflows with a fraction of assets on hand; it cannot survive a run if a large share of customer property has been loaned, pledged or spent elsewhere.
Sam Bankman-Fried was convicted and sentenced to 25 years, with an $11 billion forfeiture order. The bankruptcy estate later recovered enough value to begin substantial distributions. That recovery is not evidence that the original conduct was harmless. Claims were valued in dollars at the bankruptcy date, after crypto prices had fallen, and the recovery depended on liquidation, investments and litigation—not on customer assets having remained intact. FTX is the clearest warning that solvency after years of legal work is not the same as custody at the moment a user clicks withdraw.
Control failure: the interface suggested custody while related-party access defeated meaningful segregation.
Case files · FTX ↓Terra: when confidence was the collateral
TerraUSD was designed to hold one dollar through conversion with LUNA rather than through a full reserve of dollars. If UST traded below one dollar, arbitrageurs were expected to exchange it for one dollar’s worth of LUNA; if it traded above, the reverse trade should expand supply. The mechanism looked self-correcting while demand for both tokens was strong. Anchor’s high yield helped create that demand and made UST feel like a savings product rather than a reflexive market structure.
The weakness appeared when confidence reversed. Redemptions created more LUNA, the added supply pressured LUNA’s price, and the lower price required still more LUNA to absorb each dollar of UST. What had been sold as an algorithmic stabiliser became an accelerator. The important deception was not simply that an algorithm could fail. Authorities established that claims about how the peg had previously been restored and how the technology was used were materially misleading.
A U.S. civil jury found Terraform Labs and Do Kwon liable for fraud, followed by a multibillion-dollar settlement. After extradition to the United States, Kwon pleaded guilty to criminal fraud charges and in December 2025 received a 15-year sentence. The sequence matters: a real blockchain, public code and visible market prices did not make the surrounding representations true. Transparency at the token layer could not compensate for opacity in promotion, intervention and risk.
Control failure: a market-confidence loop was described like durable backing, while critical interventions were obscured.
Case files · Terra / UST / LUNA ↓OneCoin
How it worked
OneCoin was sold through a global multi-level marketing network as a revolutionary cryptocurrency. Buyers paid for educational packages and received OneCoin units, yet prosecutors said the project had no genuine public blockchain and prices were set internally rather than discovered on an open market.
What happened next
Co-founder Ruja Ignatova disappeared in 2017 and remains on the FBI’s most-wanted list. Other senior figures pleaded guilty or were convicted. Authorities have described roughly $4 billion invested worldwide, making OneCoin one of the clearest examples of technology theatre used to disguise an old recruitment fraud.
The lesson
Verify the blockchain, independent market access and custody—not conference stages, celebrity branding or member growth.
FTX
How it worked
FTX looked like a sophisticated international exchange with major investors, sponsorships and its own token. The decisive risk was hidden inside the group: customer assets were routed to affiliated trading firm Alameda Research, which received privileges ordinary users could not see.
What happened next
FTX collapsed after confidence in its balance sheet disappeared and withdrawals surged. A U.S. jury convicted Sam Bankman-Fried on fraud and conspiracy counts; he received 25 years in prison and an $11 billion forfeiture order. Later asset recoveries do not erase the misuse that produced the failure.
The lesson
Brand size, famous investors and proof of assets cannot replace segregation, liabilities and independent governance.
Terra / UST / LUNA
How it worked
TerraUSD promised a dollar peg maintained through an algorithmic relationship with LUNA, while Anchor offered unusually high yields. The system depended on confidence, incentives and the market value of connected tokens. When the peg broke, the feedback loop accelerated instead of absorbing the shock.
What happened next
Tens of billions of dollars in market value disappeared. A U.S. civil jury found Terraform Labs and Do Kwon liable for fraud, followed by a multibillion-dollar SEC settlement. After extradition, Kwon pleaded guilty to U.S. fraud charges and received a 15-year prison sentence in December 2025.
The lesson
Ask what supports a stablecoin when confidence falls—not only how it behaves during growth.
PlusToken
How it worked
PlusToken presented itself as a crypto wallet and investment programme paying high returns for depositing Bitcoin, Ether and other assets. Recruitment commissions and daily reward claims helped it spread across Asia. Returns depended on incoming funds rather than a transparent source of profit.
What happened next
Withdrawals stopped in 2019 and large wallets connected to the scheme became the subject of law-enforcement and blockchain-analysis investigations. Chinese courts convicted organisers and described billions of dollars in crypto collected from participants.
The lesson
A wallet should secure assets; when it also promises passive yield for recruitment, verify where every return actually comes from.
BitConnect
How it worked
BitConnect promised extraordinary returns from a secret trading bot and “volatility software.” Users converted Bitcoin into the platform’s BCC token and lent it back to the programme. The closed loop made balances look productive while limiting investors’ ability to convert them back into liquid assets.
What happened next
The lending platform shut in 2018 and BCC lost almost all value. U.S. prosecutors alleged about $2.4 billion was obtained from investors. A leading promoter pleaded guilty, while the founder was indicted; those allegations must be distinguished from a final conviction against him.
The lesson
Secret algorithms plus fixed high returns are not an investment thesis. If profits cannot be independently reproduced, assume the risk is hidden.
Celsius Network
How it worked
Celsius marketed itself as a safer, fairer alternative to banks and offered high yields on deposited crypto. Customers were encouraged to “unbank” themselves while the company took investment, liquidity and counterparty risks that were far harder to see than the simple app interface suggested.
What happened next
Celsius froze withdrawals and entered bankruptcy in 2022. Founder Alex Mashinsky later pleaded guilty to fraud and was sentenced to 12 years. Prosecutors said he misled customers about the business and profited while promoting the CEL token.
The lesson
Yield is created by risk. If a platform cannot explain the borrower, collateral, duration and loss waterfall, the advertised rate is not the full story.
Mirror Trading International
How it worked
Mirror Trading International claimed a proprietary automated trading bot generated consistent Bitcoin profits. Participants sent Bitcoin to a pooled programme and were rewarded for recruiting others. The promised trading evidence did not match the scale of funds entering the operation.
What happened next
The scheme collapsed after withdrawals failed and its chief executive disappeared. U.S. regulators obtained a major default judgment, while South African proceedings treated MTI as an unlawful scheme. More than 29,000 Bitcoin had been transferred into the programme according to the CFTC case.
The lesson
Demand broker statements, verifiable trades and custody evidence. Screens inside the promoter’s dashboard are not independent proof.
QuadrigaCX
How it worked
QuadrigaCX was once Canada’s largest crypto exchange. Its failure was initially explained by the death of founder Gerald Cotten and the supposed loss of cold-wallet keys. The official investigation found a more damaging reality: customers’ assets had been used to cover withdrawals and finance Cotten’s trading and personal spending.
What happened next
OSC staff concluded in their review that fraud caused the collapse and estimated approximately C$169 million in customer losses. The report explicitly says its findings were not tested before an OSC panel or court. Its evidence challenged the lost-keys explanation and illustrated the danger of one-person control without operational checks.
The lesson
No exchange should depend on one individual for wallet access, accounting, execution and approval of transfers.
SafeMoon
How it worked
SafeMoon’s marketing claimed liquidity was locked and therefore protected. Prosecutors said insiders retained access, removed liquidity and used part of it for personal purchases while publicly describing the pool as unavailable to them.
What happened next
A federal jury convicted Braden Karony in May 2025. On February 10, 2026, he was sentenced to 100 months in prison and ordered to forfeit about US$7.5 million. The cited DOJ release says the restitution amount would be determined later; forfeiture is not proof of compensation paid to customers. The case demands verification of actual contract permissions behind the locked-liquidity claim.
The lesson
Read the contract permissions, upgrade keys and liquidity locks. A slogan is not an immutable control.
SQUID token
How it worked
SQUID borrowed the name and visual excitement of the television series without authorisation. The token rose spectacularly, but selling restrictions trapped many holders. Its website and social accounts disappeared as liquidity was removed.
What happened next
Blockchain observers estimated that the operators escaped with millions of dollars, but the people behind the token were not publicly established through a final court judgment. It belongs here as a compact example of a rug-pull pattern, not as a legally resolved billion-dollar case.
The lesson
Before buying a token, test whether ordinary holders can sell and inspect ownership concentration, contract controls and liquidity.
The control map: where each case failed
A mark means the weakness was central to the documented case—not merely that the project used a token or referral programme.
| Case | Opaque custody | Insider token | Recruitment | Return promise | Exit blocked | Key-person risk |
|---|---|---|---|---|---|---|
| OneCoin | — | ● | ● | ● | ● | ● |
| FTX | ● | ● | — | — | ● | ● |
| Terra / UST / LUNA | — | ● | — | ● | ● | ● |
| PlusToken | ● | — | ● | ● | ● | ● |
| BitConnect | ● | ● | ● | ● | ● | ● |
| Celsius Network | ● | ● | — | ● | ● | ● |
| Mirror Trading International | ● | — | ● | ● | ● | ● |
| QuadrigaCX | ● | — | — | — | ● | ● |
| SafeMoon | ● | ● | — | — | ● | ● |
| SQUID token | ● | ● | — | ● | ● | ● |
What the ten cases have in common
Trust was concentrated while the branding suggested a system
A blockchain, exchange interface or trading dashboard can look decentralised or automated while one founder, wallet, company or related party retains decisive control. The practical question is not whether a product uses crypto, but who can move assets, alter permissions, mint supply or override ordinary users.
Reported balances were mistaken for recoverable property
A number on a screen is an accounting claim generated by the platform. It becomes meaningful only when the underlying asset exists, belongs to the customer, is not pledged elsewhere and can be withdrawn. FTX, Celsius and QuadrigaCX failed in different ways, but each case punished the assumption that a visible balance was the same as protected custody.
Yield hid the source of risk
BitConnect invoked a trading bot; Celsius described lending; MTI claimed automated Bitcoin trading; Terra’s Anchor paid unusually high rates. In every yield product, the essential questions remain ordinary: who is the borrower, what collateral exists, what duration mismatch is created and who absorbs the first loss? If those answers are absent, the headline rate is marketing, not analysis.
Community became an enforcement mechanism
Recruitment networks and online tribes did more than advertise. They discouraged dissent, rewarded loyalty and turned criticism into a social offence. Calling every hard question “FUD” protects the promoter from the very scrutiny that capital requires. A healthy market does not need holders to silence evidence.
The final warning was usually an exit problem
Delayed withdrawals, changing verification rules, transfer limits and technical explanations often appeared before the formal collapse. By that stage, the economic failure may already have happened. A small test withdrawal is useful, but it proves only that the door is open now; it does not prove enough liquid assets exist for everyone to leave together.
After the collapse: what “recovery” really means
A guilty verdict and a customer repayment solve different problems. Criminal courts punish conduct; bankruptcy estates identify property and rank claims; forfeiture programmes distribute assets tied to crime. They move at different speeds and use different valuation rules.
FTX
The estate recovered and monetised assets sufficient for substantial creditor distributions. Many small allowed claims were projected to receive principal plus interest, but claims were measured in dollars at November 2022 prices. Someone who deposited crypto may therefore be legally repaid while still missing the later appreciation of the asset.
OneCoin
The 2026 U.S. remission process made more than $40 million in forfeited property available to eligible victims. Against more than $4 billion invested worldwide, it is meaningful but partial. Applicants still need to prove net loss and comply with the official deadline and documentation process.
QuadrigaCX
Bankruptcy distributions represented only a fraction of accepted claims. The case shows why identifying a shortfall is easier than rebuilding years of transfers across personal accounts, exchanges and wallets controlled by a dead founder.
The general rule
Recovery advertisements are themselves a fraud vector. A legitimate trustee, court, regulator or law-enforcement programme does not need a stranger on social media to “unlock” coins for an advance crypto payment. Preserve transaction hashes and account records, and verify every recovery route through the official case page.
The lesson is not “avoid crypto.” It is “locate the control.”
These ten cases cover fake coins, centralised exchanges, lending, a stablecoin, investment pools and a meme-token rug pull. Treating them as proof that every crypto product is fraudulent would be as inaccurate as treating one visible blockchain transaction as proof that an entire business is honest. The better conclusion is narrower and more useful: technology changes what can be verified, but it does not remove the need to verify the people and legal entities controlling everything outside the chain.
Before depositing, map five things: the legal counterparty, custody path, liabilities, power to change the rules and exit route under stress. If any answer depends only on the founder’s reputation, an internal dashboard or a token issued by the same group, the risk is not distributed—it is hidden. The moment a platform asks you to replace evidence with belonging, urgency or faith, the investigation should begin before the money moves.
Editorial method
MyProfitFactor reviewed court and regulator releases, bankruptcy findings, official wanted notices and carefully selected contemporaneous reporting. We distinguish convictions from allegations, and customer losses from market value, deposits, forfeiture and restitution. Rounded figures are used because exchange rates and crypto prices vary across the relevant dates.
This is a documentary synthesis, not a claim of original reporting or a substitute for legal advice. We did not interview victims or defendants for this edition. Links below are selected to let readers inspect the central record without turning the article into an unfiltered document dump.
Information and legal status are current as of 20 September 2026.
The pattern behind almost every major crypto fraud
The technology changes. The pressure tactics usually do not.
- Returns presented as guaranteed or unusually stable
- Recruitment rewards that matter more than a real product
- No verifiable legal entity holding customer assets
- A founder treated as a visionary who cannot be questioned
- Opaque reserves, liabilities or related-party transactions
- Withdrawals delayed while deposits and promotions continue
- An in-house token used as collateral for the same ecosystem
- Urgency, exclusivity and criticism dismissed as “FUD”
A five-minute defence before you deposit
- Identify the exact legal entity and jurisdiction.
- Check the regulator or court record—not a badge on the website.
- Ask who controls wallets, bank accounts and private keys.
- Look for independently verified liabilities, not reserves alone.
- Test a small withdrawal before increasing exposure.
- Avoid borrowing or using essential savings for speculative products.
- Keep records: terms, wallet addresses, receipts and support messages.
Frequently asked questions
Was every collapse in this article a Ponzi scheme?
No. The cases include fake cryptocurrencies, exchange fraud, misleading lending businesses, token-liquidity theft and classic Ponzi structures. The legal classification is shown separately for each case.
Why is Terra included if it had real blockchain technology?
A real blockchain does not prevent deceptive statements. Terra is included because a U.S. civil jury found Terraform Labs and Do Kwon liable for fraud; it is not described as a conventional Ponzi scheme.
Is proof of reserves enough to trust an exchange?
No. A reserve snapshot may omit liabilities, related-party loans, ownership disputes and off-chain obligations. It is one control, not a complete audit or guarantee.
Can victims recover crypto after a scam?
Sometimes, but recovery can take years and may be partial. Report quickly to law enforcement and the relevant regulator, preserve transaction evidence and be wary of “recovery agents” demanding an upfront fee.
Selected case records
A compact source list is used for the legal outcomes and core figures. Dates and recoveries can change, so every case is labelled with its evidential status.