← back to the index
HS-013 Cloud mining fraud · United States 2021

Green United LLC — Utah Founders Sold $18 Million in Fake Mining Boxes That Mined Bitcoin for Themselves

cloud-miningat-largedefi-era
Operation
Green United LLC
Investor Losses
$18M raised (ongoing civil action)
Contracts Sold
"Green Boxes" and "Green Nodes"
Status
Charged

Summary

Between April 2018 and at least December 2022, Utah-based Green United LLC and its two principals — founder Wright W. Thurston and lead promoter Kristoffer A. Krohn — raised at least $18 million from retail investors by selling devices they called "Green Boxes" and accompanying software subscriptions called "Green Nodes." Investors were told the hardware would mine a proprietary cryptocurrency called GREEN on a purpose-built "Green Blockchain," with GREEN's value expected to increase as the company developed what it described as a public global decentralized power grid. None of that infrastructure existed. According to a complaint filed by the Securities and Exchange Commission in the District of Utah on March 3, 2023, the Green Boxes were commercially available S9 Antminers that Thurston purchased and used to mine Bitcoin for his own benefit; the bitcoin produced was never distributed to investors. The GREEN token itself was not created until several months after sales began, and the returns investors received came from pre-mined token distributions staged by Thurston to simulate active mining.

Green United deployed a multilevel marketing structure in which Krohn and affiliated promoters earned commissions for recruiting new buyers. Investors were promised monthly returns of forty to fifty percent, framed as proceeds from an active mining operation. No secondary market for GREEN tokens existed for more than two years after sales began; when one eventually formed, the token traded at a fraction of its promoted value. Apparent positive performance among early recipients suppressed skepticism and kept new capital entering through 2022.

The SEC filed its civil complaint on March 3, 2023, charging the defendants with selling unregistered securities under Sections 5(a) and 5(c) of the Securities Act and with fraud under Section 17(a) and Exchange Act Section 10(b)/Rule 10b-5. After defendants moved to dismiss, Judge Ann Marie McIff Allen ruled on September 23, 2024 that Green Boxes were sufficiently alleged to be investment contracts under Howey and that the fraud claims would proceed to trial. As of this dossier's filing date, no trial date has been set and no criminal charges have been filed.

Timeline

April 2018
Green United launches
Thurston and Krohn begin selling "Green Boxes" in Utah at approximately $3,000 each, promising monthly returns of 40–50% from mining a proprietary token called GREEN on a purpose-built blockchain. Neither the token nor the blockchain yet exists.
Mid-2018
GREEN token created after the fact
Thurston deploys GREEN as a standard Ethereum token — not on any proprietary chain — several months after investor sales begin. No dedicated blockchain is ever built.
2018–2019
Hardware bait-and-switch
Rather than purchasing hardware for GREEN, Thurston buys S9 Antminers and uses them to mine Bitcoin for his own benefit. Investors receive periodic pre-mined GREEN distributions staged to simulate returns.
Late 2020
Secondary market appears — below target price
GREEN tokens begin trading in fall 2020, more than two years after sales began, opening far below the promoted value of $0.02.
2021–2022
Sales continue through MLM network
GREEN token price deteriorates toward approximately $0.004. Later-enrolled investors receive little to no effective return.
December 2022
Last documented fundraising
December 2022 is established as the final date of active investor solicitation.
March 3, 2023
SEC files civil complaint
Charges filed in the U.S. District Court for the District of Utah (Case No. 2:2023cv00159) against Green United LLC, Thurston, and Krohn for unregistered securities offering and fraud.
May–June 2023
Motions to dismiss filed
Defendants argue SEC lacks crypto jurisdiction and that Green Boxes are not investment contracts.
September 23, 2024
Motions to dismiss denied
Judge Ann Marie McIff Allen finds Green Boxes sufficiently alleged to be investment contracts under Howey; fraud allegations proceed to trial.
2025 (pending)
Trial preparation ongoing
No trial date announced; no criminal referral publicly confirmed; defendants remain in the United States.

The Product They Built: A Token Looking for a Blockchain

Thurston established his sales premise before any supporting infrastructure existed: $3,000 per Green Box, forty to fifty percent monthly returns, paid in GREEN tokens that would appreciate as the company built a global decentralized power grid. Neither the token nor its blockchain existed when sales opened in April 2018. Thurston created GREEN several months into the fundraising period, deploying it on Ethereum rather than on any proprietary chain. The "Green Blockchain" — whose future development was supposed to underpin token value — was never built at any stage.

What investors purchased was, in the SEC's framing, a passive investment in a common enterprise whose returns depended entirely on Thurston's managerial decisions, not on any hardware the investor could monitor or verify. The Green Nodes — software subscriptions sold alongside the boxes — completed the product line. Described as software running on the Green Blockchain and generating GREEN through its operation, they were in reality basic packages that performed no mining function. GREEN tokens credited to Node holders, like those credited to Box holders, came from Thurston's pre-mined supply. Both product tiers shared the same underlying lie: that a blockchain existed and the hardware was working.

How Forty Percent Monthly Returns Are Paid When No Mining Occurs

Investors who received GREEN tokens during the early period saw nominal positive returns — a characteristic feature of pre-mined-token distribution fraud. Because Thurston controlled the supply, distributions could be timed and sized to match the promised return schedule without any computational work. The simulation was not contingent on mining; it was an accounting entry against the operator's token reserve.

Maintaining it required two conditions: a continuing supply of pre-mined GREEN, and a secondary market thin enough that investors would not liquidate in volume. No exchange listing existed for more than two years after sales began, denying investors any independent price signal. When trading eventually began in fall 2020, GREEN opened below its promoted initial value of $0.02 and settled near $0.004 — an eighty percent discount to expectations.

The S9 Antminers Thurston purchased with investor proceeds were not idle; they mined Bitcoin actively. That bitcoin was real, quantifiable, and deposited into accounts Thurston controlled — none of it reached investors. The scheme therefore ran two parallel operations: a pre-mined token distribution that simulated GREEN returns, and a genuine bitcoin mining business whose revenues flowed exclusively to the founder. Investors subsidized the latter while receiving a token of declining value in exchange.

The MLM Distribution Network and Krohn's Prior Record

Kristoffer Krohn's role in Green United was structural. An experienced multilevel marketing promoter, Krohn built a layered commission network in which recruiters brought in investors and earned fees at each level, creating strong incentives to suppress concerns and maximize enrollment speed. More than a decade before Green United, Krohn had faced SEC enforcement action for violations connected to a real estate investment program — a prior record that, the complaint implies, should have precluded him from serving as lead promoter of another unregistered offering.

Promoters recruited through existing social networks — family, friends, church communities — deploying the relationship-trust dynamics characteristic of affinity fraud. Investors enrolled through a known contact were less likely to conduct due diligence or attribute early negative signals to fraud rather than market conditions.

The Five Factors

01
The Non-Existent Blockchain as Infrastructure Claim
Green United named its promised infrastructure — the Green Blockchain — explicitly and made its prospective development central to the GREEN token value proposition. Investors were told GREEN would appreciate as the company built a global decentralized power grid. No such blockchain was ever constructed. The named-infrastructure promise gives investors a concrete future milestone to wait for rather than a present obligation to audit; by the time its non-existence becomes apparent, the scheme has already disbursed the capital it needed.
02
Pre-Mined Token Distributions as Performance Simulation
When an operator controls both the token supply and the distribution schedule, the appearance of active mining returns can be maintained without any computational work. Investors receiving periodic credits in a proprietary token cannot determine whether those credits reflect actual mining or a transfer from a pre-existing reserve. The simulation is technically indistinguishable from genuine output for any investor lacking on-chain access to the operator's wallet activity.
03
Hardware Capture: Turning Investor Funds into Operator Assets
The S9 Antminers Thurston purchased with investor proceeds were real and profitable — he simply retained the output. Using investor capital to acquire productive hardware whose revenues flow exclusively to the operator is distinct from the pure Ponzi model: it does not require continuous new-investor intake because the hardware generates independent ongoing income. Investors held no equity in the physical equipment and, under the hosting agreement structure, had no legal claim to its bitcoin output.
04
Multilevel Marketing as Fraud Amplification
MLM compensation structures create financially motivated participants whose income depends on continuous enrollment rather than on investment performance. Green United promoters earned commissions on every recruit, an incentive that rewards suppression of skepticism and rapid enrollment before concerns spread. Recruitment through family and religious community networks imposes social costs on early withdrawal or public complaint, extending a scheme's operational life beyond what direct-sale distribution would have permitted.
05
Liquidity Absence as Valuation Control
The two-year gap between sales launch and any secondary market for GREEN tokens created a valuation vacuum that worked entirely in the operator's favor. Without a market price, investors could not independently assess whether their holdings were worth what they had been told. The only signal available was the distribution figure Thurston himself provided. Had a liquid market existed from launch, GREEN's inability to sustain its promised value would have been visible within months. The interval between fundraising commencement and secondary market formation is now treated by regulators as an indicator of token-based fraud: absent independent price discovery, the operator controls the investor's entire information environment.

Aftermath

As of the filing date of this dossier, SEC v. Green United, LLC (Case No. 2:2023cv00159, D. Utah) remains in active pre-trial proceedings. Judge Ann Marie McIff Allen's September 2024 ruling that Green Boxes constitute investment contracts under Howey was a significant procedural victory for the SEC and established a judicial record treating physical mining hardware sold with hosting agreements and return promises as securities — a classification with implications well beyond Green United's specific facts.

No criminal charges have been publicly announced. Krohn's prior SEC enforcement history did not prevent him from serving as promoter; it may affect any eventual civil penalty calculation. The approximately $18 million raised has not been subject to a court-ordered recovery mechanism as of this date. The SEC seeks permanent injunctions, disgorgement of ill-gotten gains plus prejudgment interest, and civil penalties.

The case is notable for its geographic profile: Utah has been a recurring site for affinity-based cryptocurrency and MLM fraud, and Green United's distribution network drew on the same close-knit social trust structures that characterize the pattern. The SEC's Salt Lake Regional Office, which brought the case, has developed significant enforcement experience with crypto-adjacent MLM structures, and the September 2024 Howey ruling is expected to inform its posture toward similar offerings.

Lessons

  1. Cloud mining hardware sold with hosting agreements and return promises may constitute investment contracts subject to securities registration requirements regardless of how the product is labeled; investors should treat the absence of SEC registration as a material red flag, not an administrative technicality.
  2. When a cloud mining operator creates its own proprietary token and distributes pre-mined supply as "returns," investors have no independent means of verifying whether distributions reflect actual mining output or a controlled release from a pre-existing supply; on-chain verification of mining wallet activity is the only reliable check.
  3. The absence of a secondary market for a token does not indicate that the token has no price — it indicates that investors have no independent price discovery mechanism, which benefits the operator and harms the investor; demand a market, or treat the stated value as entirely unverifiable.
  4. MLM distribution structures in investment offerings create a class of financially incentivized promoters whose interests are structurally misaligned with investor protection; commission-based recruitment rewards suppression of doubt and penalizes honest disclosure.
  5. A promoter's prior SEC enforcement history for similar conduct in adjacent industries is publicly searchable; investors and co-operators should verify the regulatory background of every named promoter before committing capital to any offering structured around that person's network.

References