On 23 July 2026 a federal judge in Maryland sentenced Rodney Burton, a Miami man who promoted HyperFund, to 32 months in prison, according to the Justice Department’s case page. HyperFund promised members 0.5% to 1% a day from crypto blockchain and earns a reward, which makes rewriting history very expensive.">mining, the kind of fixed return a crypto Ponzi scheme typically sells. Prosecutors put the money it took in at $1.89 billion. Its founder, Sam Lee, has been charged but not tried. Three months earlier, on 29 April 2026, Italian police announced they had seized more than $7.5 million in crypto in a still-open investigation into a solar-energy “investment” that, according to the Polizia di Stato, paid about 6,000 savers out of newer savers’ money.
Both cases follow the oldest pattern in financial fraud. A crypto Ponzi scheme is a promise of steady, high returns in which the payouts come from new deposits, not from any business, trade or blockchain. The coin, the trading bot or the mining farm is the costume. The label a court or a regulator picks (Ponzi, pyramid, wire fraud) matters less than three signs you can check yourself: a promised return, no real source of income outside the scheme, and payouts that depend on new money coming in.
This lesson goes deep on that one family of scams. Our overview of crypto scams covers every type briefly, and the previous lesson of this path explained pump-and-dump groups. Here you will see how the cash moves inside a Ponzi or a pyramid, why OneCoin and Bitconnect worked for years, what courts have actually decided in recent cases, and how to read an offer in five minutes.
How a crypto Ponzi scheme works: new deposits pay the old investors
The US Securities and Exchange Commission gives the plainest definition on its investor site: “A Ponzi scheme is an investment fraud that pays existing investors with funds collected from new investors,” Investor.gov says. The organisers usually claim they will invest the money for high returns at little or no risk. In many cases they invest nothing. They pay the earlier investors, keep a share and wait for the next wave of deposits.
The name comes from Charles Ponzi, who drew investors into a postage-stamp speculation scheme in the 1920s. A century later the mechanism is the same. What changed is the packaging and the speed: a wallet address replaces a bank account, a Telegram group replaces the dinner party, and a story about technology replaces the story about stamps.
A toy example shows why the arithmetic always breaks. Say 100 people each deposit $1,000, so the operator holds $100,000. The website promises 10% a month. Paying everyone their monthly return costs $10,000, so with no real income the pot runs dry after ten months, before a single dollar of principal has been returned. The operator now needs at least $10,000 of fresh deposits every month just to keep the promise alive.
It gets worse when investors reinvest, which these schemes encourage. At 10% a month compounded, each $1,000 account shows about $3,138 after a year. The dashboards of the 100 investors now display $313,843, while the operator still holds at most the original $100,000, minus whatever was spent or moved. To honour the numbers on screen, the scheme needs more than 200 new investors, each of whom is promised the same 10%. The gap between what is shown and what exists grows every month.
That is why the SEC writes that Ponzi schemes “require a constant flow of new money to survive”. They tend to collapse when recruiting slows or when many investors try to cash out at once, which often happens together: a market crash, a regulator’s warning or a bad news story makes people want their money back exactly when new money stops arriving.
Crypto adds a few features that help the operators. Payments are fast and cross borders without a bank asking questions. Promoters can recruit worldwide through YouTube videos and group chats. And the technology gives a plausible-sounding source of profit to people who cannot check it: a trading bot, an arbitrage engine, a mining farm, a “DeFi” protocol. None of this needs a blockchain to be hacked or broken; as our lesson on whether a blockchain can be hacked explains, the ledger can work perfectly while the people around it lie about what it records.
A pyramid scheme pays for recruiting, and it hits a mathematical wall
A pyramid scheme is the cousin of a Ponzi. In the classic version described on Investor.gov’s pyramid page, participants try to make money solely by recruiting new participants. The promoter promises a high return in a short time, no genuine product or service is sold, and the main activity is bringing in the next layer of members. In a Ponzi, investors may never recruit anyone; the central operator does the selling. In a pyramid, every member is also a salesperson, paid on the people below them.
The SEC’s verdict is blunt: “All pyramid schemes eventually collapse, and most investors lose their money.” The reason is arithmetic. If every participant has to find six new recruits, and each of them six more, the eleventh layer alone would need 6 to the power of 11 people, which is 362,797,056. That is more than the population of the United States, as the SEC points out. Long before that layer, recruiting stalls, and everyone in the bottom layers, who are the large majority, loses what they paid in.
Pyramid promoters often dress the scheme as multi-level marketing (MLM). The test the SEC offers is where the money comes from. Legitimate MLM companies earn revenue mainly by selling products to customers outside the network. If the commissions come mostly from new members’ joining fees, or if the “product” is hard to value (an e-book, an online course, a “tech” licence, a token that only trades inside the network), the structure is a pyramid wearing a sales badge.
Ponzi, pyramid and MLM side by side
Real crypto cases rarely fit one box. Regulators have called the same scheme a pyramid in one filing and a Ponzi in another, and some mix both. The table shows the pure forms, with real cases placed where the authorities put them.
| Model | Where payouts come from | Who recruits | Real product sold outside the network | Example in crypto (as described by authorities) |
|---|---|---|---|---|
| Ponzi scheme | New investors’ deposits, routed by a central operator | The operator and paid promoters | No, or a fake one | Bitconnect: “a textbook Ponzi scheme” (US Justice Department) |
| Pyramid scheme | Joining fees of new members, paid up the chain | Every member, paid per recruit | No, or hard to value | OneCoin (“cryptocurrency pyramid scheme” in SDNY releases); HyperFund (SEC) |
| Ponzi and pyramid at once | New deposits, split automatically among uplines | Every member | No | Forsage: “pyramid and Ponzi scheme” (SEC, 2022) |
| Legitimate MLM | Sales of goods to outside customers | Members, but pay follows sales | Yes | None: a crypto token that only trades inside the network does not count |
Why guaranteed returns are the clearest red flag
Of all the warning signs, the promise of a fixed, high return is the one that gives a scheme away most often. The SEC’s list begins with “high returns with little or no risk” and adds: “Be highly suspicious of any ‘guaranteed’ investment opportunity.” Every real investment carries risk, and higher returns normally mean more risk. A crypto market that can fall 50% in a year cannot, on its own, produce a guaranteed 1% a day.
Think about what could actually guarantee a return. A government bond pays a fixed coupon because a state collects taxes. A bank deposit pays interest because the bank lends at a higher rate and is supervised. A trading bot that “guarantees” profits has no such source: trading is a contest against other traders, and nobody wins every day. When a platform promises a fixed yield anyway, the only income that can honour it on schedule is the next deposit.
The numbers look absurd once you add them up. HyperFund’s 0.5% a day is more than 180% a year without any compounding, and the Justice Department says members were promised those daily rewards until their stake doubled or tripled. Bitconnect, according to the SEC’s 2021 complaint as reported at the time, told investors its “volatility software trading bot” could earn as much as 40% a month. Figures like these are there to impress the next recruit, not to describe a trading result.
The other signs on the SEC’s list follow from the same logic:
- Returns that stay positive and smooth whatever the market does. Real investments go up and down; a balance that grows the same amount every week through a crash is a number someone typed.
- An investment or a seller that is not registered with any regulator, and a strategy described as secret, proprietary or too complex to explain.
- Errors in statements, and above all trouble withdrawing. The SEC notes that promoters sometimes offer even higher returns to people who agree to leave their money in.
- Pressure to recruit: bonuses, ranks and “leadership pools” for bringing in friends and family.
Crypto schemes also borrow real vocabulary. “Staking”, “liquidity mining” and “arbitrage” exist and can produce income, but that income floats with the market and the protocol, and it can turn negative. Our introduction to DeFi and the glossary entry on staking explain where genuine yields come from. If a platform quotes a fixed daily rate for any of them, and you cannot see the smart contract or the trades that are supposed to produce it, treat the word as decoration.
OneCoin: a pyramid scheme selling a coin with no true blockchain
OneCoin started in 2014 in Sofia, Bulgaria, founded by Ruja Ignatova and Karl Sebastian Greenwood. It did not sell coins directly. It sold “educational packages” through a global multi-level marketing network, and each package came with tokens that members could supposedly “mine” into OneCoins and later cash out. US prosecutors say that between the fourth quarter of 2014 and the fourth quarter of 2016 alone, at least 3.5 million victims put in more than $4 billion.
There was nothing behind the coin. According to the sentencing release reproduced by IRS Criminal Investigation, OneCoin “lacked a true blockchain” and OneCoins were “entirely worthless”. The balance members saw on their dashboard was a figure in a company database, set by the company. That is the key difference with a real cryptocurrency, which you can check on a public ledger that nobody controls alone; our lesson on what a cryptocurrency is shows what OneCoin was imitating. Members earned commissions on the packages their recruits bought, which is why the Southern District of New York (SDNY) titles its releases on the case with the words “cryptocurrency pyramid scheme”.
The court record so far, as of October 2026:
- Karl Sebastian Greenwood was arrested at his home on Koh Samui, Thailand, in July 2018 and extradited. He pleaded guilty and on 12 September 2023 Judge Edgardo Ramos (SDNY) sentenced him to 20 years in prison, with about $300 million in forfeiture.
- Mark Scott, a former partner at a US law firm, was convicted by a jury on 21 November 2019 of conspiracy to commit money laundering and conspiracy to commit bank fraud, for moving about $400 million of OneCoin money through fake investment funds. Judge Ramos sentenced him to 10 years on 25 January 2024.
- Irina Dilkinska, OneCoin’s head of legal and compliance, pleaded guilty in November 2023 to conspiracy to commit wire fraud and conspiracy to commit money laundering, and was sentenced to four years in prison on 3 April 2024 (SDNY).
- Ruja Ignatova, charged in New York in October 2017, flew from Sofia to Athens on 25 October 2017 and has not been seen in public since. The FBI added her to its Ten Most Wanted Fugitives list on 30 June 2022 with a reward of up to $100,000, and on 26 June 2024 the State Department offered up to $5 million for information leading to her arrest or conviction. Her whereabouts are unknown.
OneCoin also reached small towns in Europe through local distributors. In France, a 37-year-old former independent distributor was tried in Laval on 12 June 2025, accused of defrauding 22 people in Mayenne between 2016 and January 2024, with losses estimated at more than 120,000 euros, according to the regional broadcaster ICI. Appearing without a lawyer, he denied any wrongdoing and said people had bought the packs knowing what they were. The prosecutor asked for a three-year suspended sentence and a 50,000-euro fine. The decision was due on 3 July 2025; we found no published report of it as of October 2026, so he remains presumed innocent. The case shows how long the tail of a pyramid can be: OneCoin peaked in 2016, and local losses were still being argued in court nine years later.
Bitconnect: a lending bot, YouTube promoters and $2.4 billion
Where OneCoin sold a fake coin, Bitconnect sold a fake machine. Its “Lending Program” let investors deposit bitcoin, swap it for Bitconnect’s own token, BCC, and lend it to the platform. In return Bitconnect claimed its proprietary “BitConnect Trading Bot” and “Volatility Software” would trade crypto price swings and deliver “substantial profits and guaranteed returns”, according to the 2022 US indictment summarised by IRS Criminal Investigation. Prosecutors allege the operators took in about $2.4 billion; the SEC, in its civil case, put the figure at $2 billion.
The bot was the cover story. “BitConnect operated as a Ponzi scheme by paying earlier BitConnect investors with money from later investors,” the Justice Department alleged when it announced the indictment. After the top US promoter’s guilty plea, it went further and called it “a textbook Ponzi scheme”. The SEC alleges that Bitconnect paid a worldwide network of promoters commissions for bringing in deposits, and hid much of that from investors. The most visible of them filmed themselves on YouTube showing daily “interest” landing in their accounts, and those testimonial videos did more selling than any website.
The end came quickly. In early January 2018 the Texas State Securities Board and then, on 9 January, North Carolina’s securities regulator ordered Bitconnect to stop selling unregistered investments in their states. On 16 January 2018 the company said it was shutting its lending program and its exchange, Bloomberg reported, and the price of BCC collapsed. Investors were left holding a token that only had value as long as new money kept buying it.
The founder, Satish Kumbhani, was indicted by a federal grand jury in San Diego on 25 February 2022 on charges including conspiracy to commit wire fraud, conspiracy to manipulate a commodity price, operating an unlicensed money transmitting business and international money laundering conspiracy. He is at large, and the charges are allegations he has never answered in court.
The top US promoter did face a judge. Glenn Arcaro pleaded guilty in September 2021 to conspiracy to commit wire fraud, and on 16 September 2022 he was sentenced in San Diego to 38 months in prison, according to the sentencing release. He admitted earning at least $24 million from the scheme. The Justice Department counted 4,154 victims from 95 countries, and on 12 January 2023 announced that a judge had ordered $17,646,801 in restitution to about 800 of them in more than 40 countries, per the restitution release. “Putting a technical sheen on a vintage scheme will not stop this office’s pursuit of a just outcome,” US Attorney Randy Grossman said in the sentencing release.
The practical lesson for readers is about promoters. The people who recruited you are often investors who believed, then earned commissions, then kept recruiting. Their enthusiasm and their screenshots prove only that the scheme was still paying on that day.
Recent crypto Ponzi cases and what the courts decided
Since Bitconnect, US prosecutors and regulators have brought a steady line of cases against crypto schemes that promised fixed returns. The table sums up where the main ones stand. An indictment or a regulator’s complaint is an accusation; only a guilty plea or a verdict is a finding.
| Case | What was promised | Charge or label | Status (dated, as of October 2026) |
|---|---|---|---|
| Forsage | Payouts for recruiting, run by smart contracts on Ethereum | SEC complaint, 1 Aug 2022: pyramid and Ponzi, more than $300 million; DOJ indictment of four founders, Feb 2023, about $340 million | Founders, Russian nationals, charged; no criminal conviction reported |
| HyperFund / HyperVerse | 0.5% to 1% a day from crypto mining | SEC, 29 Jan 2024: pyramid scheme, more than $1.7 billion; DOJ: $1.89 billion fraud | Brenda Chunga pleaded guilty, sentencing set for 7 Jan 2027; Rodney Burton sentenced to 32 months on 23 Jul 2026; Sam Lee’s case pending |
| Forcount | Profits from crypto mining and trading | Wire fraud conspiracy (SDNY) | Promoter Juan Tacuri sentenced to 20 years in Oct 2024 |
| IcomTech | Profits from mining and trading | Wire fraud conspiracy (SDNY) | Founder David Carmona sentenced to 121 months on 4 Oct 2024 |
| NovaTech | About 2% to 4% a week from trading | New York Attorney General (state civil case): pyramid scheme, more than $1 billion deposited | Default judgment against the founders, Aug 2025; state asked the court for about $1.3 billion on 22 Oct 2026 |
| Braiscompany (Brazil) | Monthly returns on “rented” crypto | Brazilian federal court, Feb 2024 | Founders sentenced at first instance to 88 years 7 months and 61 years 11 months; arrested in Argentina at the end of Feb 2024 |
| Celsius | High yields on deposits | Securities fraud and commodities fraud, not a Ponzi charge | Alex Mashinsky sentenced to 12 years on 8 May 2025 |
Forsage shows that a smart contract does not make a scheme honest. The SEC alleged in 2022 that Forsage used new investors’ money to pay earlier ones “in a typical Ponzi structure”, through smart contracts on Ethereum, Tron and Binance’s chain. When the Justice Department indicted the four founders in February 2023, it described a global Ponzi and pyramid scheme and said blockchain analysis showed that more than 80% of investors got back less ether than they put in, while more than half never received a single payout. Code that pays uplines automatically is a pyramid that cannot be switched off, not a business.
HyperFund is the clearest recent example of how a case unfolds over years. The SEC filed its civil complaint in Maryland on 29 January 2024, describing “membership” packages sold with claims of mining income and ties to a Fortune 500 company; the regulator alleged that HyperFund had no real source of revenue other than investors’ money, and it collapsed in 2022. The criminal case followed the same day. Two and a half years later, one promoter has been sentenced, one has pleaded guilty and is awaiting sentence, and the founder has not been tried, according to the DOJ case page updated on 29 July 2026. Burton pleaded guilty in June 2026 to conspiracy to operate an unlicensed money transmitting business, not to fraud; prosecutors said he personally received at least $7.85 million, according to the plea release.
Forcount, which prosecutors said mainly targeted Spanish-speaking investors in the United States, claimed to mine and trade crypto and did neither. Its senior promoter Juan Tacuri pleaded guilty to conspiracy to commit wire fraud and was sentenced in October 2024 to 240 months, or 20 years. IcomTech told the same kind of story; prosecutors said it never mined or traded for investors and used their money to pay other investors and its founders. Judge Jennifer Rochon sentenced its founder, David Carmona, to 121 months on 4 October 2024.
NovaTech shows the civil route. New York’s Attorney General, who calls it a pyramid scheme that advertised trading profits of about 2% to 4% a week, won a default judgment in August 2025 against its founders, Cynthia and Eddy Petion, after the couple fled the country, the Attorney General’s office says. On 22 October 2026 the state asked the court for about $1.3 billion in damages and disgorgement, and four promoters agreed to pay nearly $6 million, as our report on the NovaTech filing details. A request is not an award, and nothing has been recovered from the founders so far.
Outside the United States, Brazilian courts have handed down very long sentences. In February 2024 a federal court in Campina Grande, Paraíba, convicted the founders of Braiscompany, Antônio Ais and Fabrícia Farias, and eight other defendants in a scheme that promised monthly returns on crypto “rented” to the company, Brazilian press reported. Ais received 88 years and 7 months, Farias 61 years and 11 months, in a first-instance ruling. The couple were arrested in Argentina at the end of that month.
Celsius: a collapse prosecuted as fraud, not as a Ponzi
Not every failed yield platform is a Ponzi in law. Celsius Network, a crypto lender that paid high interest on deposits, froze withdrawals in 2022 and went bankrupt. Its founder, Alex Mashinsky, was indicted on seven counts in July 2023. He pleaded guilty on 3 December 2024 to one count of commodities fraud and one count of securities fraud, and on 8 May 2025 Judge John Koeltl (SDNY) sentenced him to 12 years in prison, with forfeiture of $48,393,446 and a $50,000 fine, the CFTC recalled in June 2026.
Commentators have called parts of Celsius’s model Ponzi-like, but the criminal case was about lying to customers on how safe the platform was and manipulating the price of its CEL token. The distinction matters for readers: a platform can take real risks with your money, lose it and lie about it without running a Ponzi. The legal label follows what was promised and what was done with the deposits.
What a sentence tells you, and what it does not
Court outcomes look tough on paper. They rarely mean victims are made whole. Bitconnect’s $17.6 million restitution order covers less than 1% of the $2.4 billion prosecutors say the platform raised. Two of the best-known founders, Ruja Ignatova and Satish Kumbhani, have never stood trial. The same gap shows in the US campaign against scam networks: of the roughly $833 million in crypto restrained by US authorities, no public figure showed any returned to victims as of 21 October 2026.
The sentences also show who ends up in court most often: promoters. Arcaro, Tacuri and Burton were not the founders. They were people who sold the scheme to others and took a cut, and that is enough to make someone criminally liable.
Where US and UK readers can check an offer and report a scheme
For US readers: an investment offered to the public generally has to be registered with the SEC or a state, and the person selling it has to be licensed. Investor.gov lets you search the names of firms and individuals, and your state securities regulator handles local cases (Texas and North Carolina acted against Bitconnect months before federal charges). Schemes involving crypto as a commodity can be reported to the CFTC, and online fraud in general to the FBI’s Internet Crime Complaint Center at ic3.gov and to the FTC at reportfraud.ftc.gov. Tips about securities fraud go to the SEC directly.
British readers can check a firm on the FCA’s register and its Warning List, part of the regulator’s ScamSmart pages. Fraud is now reported to Report Fraud, the service run by the City of London Police that replaced Action Fraud in England, Wales and Northern Ireland (online, or on 0300 123 2040); it took reports from 4 December 2025 and launched fully in January 2026. In Scotland, contact Police Scotland on 101.
Across the European Union, crypto-asset service providers need a licence under MiCA, and the European Securities and Markets Authority publishes a register of them. Our guide to the MiCA regulation explains how to read it. A licence does not make every product safe, but a platform promising fixed daily returns without any licence anywhere is a strong signal on its own.
A five-minute checklist before you deposit
You do not need to read a smart contract or a balance sheet to spot most schemes. These questions take a few minutes and cost nothing:
- Where does the return come from? Ask for the source in one sentence. “Our bot”, “our mining farm” or “arbitrage” without verifiable trades, addresses or audited accounts is not an answer.
- Is the return fixed, daily or “guaranteed”? A fixed rate on a volatile asset is the clearest sign of a scheme paying from deposits.
- Who holds the money? If you must send crypto to the platform and can only see a balance on its website, you are trusting a database the operator controls, as OneCoin members did. Our lesson on how centralised exchanges hold customer funds shows what a custodian should disclose.
- Is the firm licensed? Search the name, and the website address, on the SEC, FCA or ESMA registers and on regulators’ warning lists.
- Do you earn more by recruiting than by investing? Ranks, levels and bonuses for bringing in friends point to a pyramid.
- Can you withdraw, and are there new conditions every time you try? Fees to “unlock” a withdrawal, minimum holding periods added after the fact, or bonuses for staying in are signs that the cash is not there.
- Who is telling you about it? A friend, a YouTube channel or a group chat with screenshots of daily income proves only that early members are being paid.
Never hand over a seed phrase to a platform that “needs it to activate your account”: that is a different theft, covered in our lesson on seed phrase security. And none of these checks is investment advice.
Already inside a scheme? Stop recruiting and keep records
If you recognise the signs in a platform where you already have money, the first step is the hardest: stop bringing in new people, even if that is the only way to get paid. Every new deposit you encourage is a future victim’s loss, and the cases above show that promoters can face prison, restitution and forfeiture just as founders do.
Then gather evidence while the website still works: screenshots of your balance, the terms you were shown, chat messages, the wallet addresses you sent funds to, and the transaction IDs on the blockchain. Report to the authorities listed above. US victims of some cases can register with the Justice Department’s victim programmes, which is how the Bitconnect restitution reached about 800 people.
Be very careful after a loss. Victims of collapsed schemes are prime targets for “recovery” services that promise to trace and return stolen crypto for an upfront fee. Genuine law-enforcement or court-appointed recovery does not ask you to pay to get your money back. The next lesson of this path covers pig butchering, a scam that often combines a relationship built over weeks with a fake trading platform of the same kind.
