Between September 2016 and October 2017, MiningMax LLC solicited approximately 270 billion Korean won — equivalent to $250 million — from roughly 18,000 investors across 54 countries by selling access to Ethereum mining rigs and pool contracts that promised monthly returns of $800 to $1,200 per machine. The company, registered in Las Vegas but operated primarily by South Korean nationals, ran a seven-tier multi-level marketing structure in which investors were rewarded for recruiting additional participants. Of the $250 million collected, roughly $80 million was actually spent on mining hardware; approximately $110 million was diverted to offshore accounts controlled by the scheme’s organizers. The chairman identified in South Korean prosecutions as Daniel Park (Nam Ho Park) and several other top executives fled South Korea and were placed on Interpol’s wanted list. By December 2017, South Korean prosecutors had indicted 21 individuals and arrested 14 on charges of fraud and violations of the country’s door-to-door sales laws. California’s Department of Financial Protection and Innovation issued a desist-and-refrain order against MiningMax in 2020. As of the filing date, the chairman and vice chairman remain fugitives; the 14 individuals arrested in South Korea faced prosecution there.
The MiningMax scheme is distinguished by its geographic scale — 54 countries affected, including approximately 2,600 US investors — and by the sophistication of its cover story. Unlike some cloud mining frauds that sold entirely nonexistent hardware, MiningMax actually purchased mining equipment and operated it at a fraction of the scale it represented. This partial reality — real machines, real hashing, inadequate returns, fabricated performance figures — made the fraud harder to detect at the individual investor level and illustrated how a cloud mining scheme can operate with genuine physical infrastructure while still being systematically fraudulent in its representations to investors.
VBit Technologies Corp., a South Philadelphia-based company founded in 2018 by Danh C. Vo, raised more than $95.6 million from approximately 6,400 investors across the United States by selling “hosting agreements” that promised customers passive income from Bitcoin mining machines Vo claimed to purchase, house, and operate on their behalf. Between December 2020 and November 2021, Vo transferred approximately $48.5 million of investor funds to personal accounts, distributed millions to family members, and lost an estimated $32 million gambling on other cryptocurrency positions. Vo left the United States in November 2021 after learning of a federal investigation and was believed to be in Vietnam as of the SEC’s December 2025 complaint. He had not retained legal representation as of publication. The SEC filed suit in the U.S. District Court for the District of Delaware on December 17, 2025.
VBit sold its hosting agreements as a largely hands-off investment: customers paid upfront for a mining machine that Vo promised to procure, maintain, and connect to favorable low-cost electricity. In practice, VBit operated a fraction of the rigs its contracts implied. In 2020, the company sold agreements covering 3,325 machines while running approximately 920. By 2021, VBit had sold contracts for nearly 8,500 rigs while operating fewer than 1,700. The online investor portal that displayed customer mining earnings and account balances showed figures the SEC alleges were fabricated — hypothetical returns unrelated to any actual Bitcoin production. The Bitcoin that VBit’s machines did mine went exclusively to accounts Vo controlled.
VBit ceased operations in 2022. The investor portal eventually went offline. Customers who had paid sums as high as $100,000 for individual hosting packages had no means of verifying whether their machines had ever been purchased or switched on. No criminal indictment had been returned as of this filing, but the SEC’s civil complaint described a scheme whose factual pattern — inventory fabrication, portal manipulation, self-dealing at scale, and flight — is consistent with the wire fraud and securities fraud charges brought in contemporaneous cloud mining cases.
The case is notable for two regulatory developments that extend beyond the immediate investor harm. The SEC’s complaint explicitly characterizes third-party Bitcoin mining hosting agreements — long treated as service contracts outside the securities framework — as securities offerings subject to registration and anti-fraud provisions. That characterization, if upheld by the Delaware court, would significantly expand the regulatory reach over an industry that has used the service-contract framing as a persistent regulatory shield.
Geosyn Mining, LLC, a Fort Worth, Texas-based company founded by Caleb Ward, raised more than $4.5 million from dozens of investors across the United States between November 2021 and January 2023 by selling hosting contracts for Bitcoin mining machines that the company either never purchased, never powered on, or misrepresented as belonging to individual customers. Ward promised investors low-cost electricity at 4.5 cents per kilowatt-hour, told them their machines were operational and actively mining, and sent photographs of hardware that belonged to other customers as proof of delivery. The company’s co-founders and sales leadership redirected tens of thousands of dollars of investor funds to personal expenses including nightclub bills, luxury watches, and firearms. Ward was convicted on November 20, 2025, by a federal jury in Fort Worth on one count of conspiracy to commit wire fraud and three counts of wire fraud. His sentencing was scheduled for March 12, 2026, with a maximum exposure of 20 years per count. Co-founders Jeremy McNutt and Jared McNutt entered plea agreements.
Geosyn operated during one of the most active periods for retail participation in Bitcoin mining hosting: the 2021–2022 bull market, when Bitcoin prices peaked above $60,000 and the economics of small-scale hosted mining appeared attractive to individual investors. The company targeted clients nationwide through direct outreach and referral, describing itself as a turnkey solution for investors who wanted mining exposure without the technical demands of self-hosted hardware. The SEC charged Geosyn, Ward, and Jeremy McNutt in April 2024, and Ward was separately indicted in May 2024 by the U.S. Attorney’s Office for the Northern District of Texas.
The scheme combined inventory fraud — selling contracts for machines that were never acquired — with a Ponzi payment structure, in which earlier investors received distributions sourced from newer investors’ capital rather than actual mining proceeds. The combination of fake hardware and recycled investor funds sustained the scheme for approximately 14 months before investor complaints forced it into collapse.
The Geosyn conviction is one of a cluster of mid-scale US cloud mining prosecutions following BitClub Network and HashFlare, demonstrating that DOJ and SEC have embedded mining fraud within their standard enforcement framework regardless of dollar amount.
On June 11, 2024, law enforcement agencies from Germany, Switzerland, Austria, Czechia, Lithuania, and Liechtenstein — coordinated by Eurojust and supported by Europol — arrested six individuals and executed 29 search warrants in connection with a multi-country cryptocurrency machine leasing pyramid that caused losses of up to EUR 113 million to thousands of victims across Europe. The organised crime group had operated a scheme based on the leasing and subleasing of cryptocurrency machines, including mining hardware and crypto exchange kiosks, promising investors returns of 70 percent before tax. The central fraud was that the leased equipment and systems that investors paid for did not exist. The scheme’s revenue for earlier participants came not from any actual equipment output but from the investment funds of newer entrants — a structure that Eurojust’s press release explicitly characterised as pyramidal.
The operation was led by German and Swiss prosecutorial authorities, who established a joint investigation team (JIT) with Eurojust support. Two coordination meetings at Eurojust preceded the June 11 action day, at which more than 280 officers participated across the six participating countries. Assets belonging to the suspects were frozen on the action day. The platform name and suspect identities were not disclosed in the Eurojust press release; operator names and charges had not entered public court record as of this filing.
The EUR 113 million loss figure places this scheme among the largest documented cloud mining and crypto machine fraud cases in European history — comparable in scale to multinational cases like MiningCity, which raised approximately $300 million globally before SEC charges in 2022, but within a specifically European jurisdictional footprint. The joint investigation team structure and the Eurojust coordination model employed in this case have become the standard architecture for European crypto fraud enforcement, with this action representing one of its largest single-day results.
The case illustrates how the structural template of cloud mining fraud — phantom hardware, guaranteed returns, subleasing layers — was adapted into a multi-country European operation targeting retail investors who believed they were acquiring stakes in physical crypto infrastructure.
Between April 2018 and at least December 2022, Utah-based Green United LLC and its two principals — founder Wright W. Thurston and lead promoter Kristoffer A. Krohn — raised at least $18 million from retail investors by selling devices they called “Green Boxes” and accompanying software subscriptions called “Green Nodes.” Investors were told the hardware would mine a proprietary cryptocurrency called GREEN on a purpose-built “Green Blockchain,” with GREEN’s value expected to increase as the company developed what it described as a public global decentralized power grid. None of that infrastructure existed. According to a complaint filed by the Securities and Exchange Commission in the District of Utah on March 3, 2023, the Green Boxes were commercially available S9 Antminers that Thurston purchased and used to mine Bitcoin for his own benefit; the bitcoin produced was never distributed to investors. The GREEN token itself was not created until several months after sales began, and the returns investors received came from pre-mined token distributions staged by Thurston to simulate active mining.
Green United deployed a multilevel marketing structure in which Krohn and affiliated promoters earned commissions for recruiting new buyers. Investors were promised monthly returns of forty to fifty percent, framed as proceeds from an active mining operation. No secondary market for GREEN tokens existed for more than two years after sales began; when one eventually formed, the token traded at a fraction of its promoted value. Apparent positive performance among early recipients suppressed skepticism and kept new capital entering through 2022.
The SEC filed its civil complaint on March 3, 2023, charging the defendants with selling unregistered securities under Sections 5(a) and 5(c) of the Securities Act and with fraud under Section 17(a) and Exchange Act Section 10(b)/Rule 10b-5. After defendants moved to dismiss, Judge Ann Marie McIff Allen ruled on September 23, 2024 that Green Boxes were sufficiently alleged to be investment contracts under Howey and that the fraud claims would proceed to trial. As of this dossier’s filing date, no trial date has been set and no criminal charges have been filed.
Between June 2017 and at least March 2022, siblings John Albert Loar Barksdale and JonAtina (Tina) Barksdale raised more than $124 million from thousands of retail investors worldwide by selling a cryptocurrency token called Ormeus Coin on the false claim that it was secured by one of the largest and most profitable bitcoin mining operations in the world. According to a Securities and Exchange Commission complaint filed in March 2022 and a simultaneously unsealed criminal indictment against John Barksdale in the Southern District of New York, neither claim was true: Ormeus Coin’s mining operation generated less than $3 million in total revenue across its entire lifespan and was abandoned in 2019.
The scheme operated through two vehicles. The first was Ormeus Global, a multi-level marketing organization through which investors purchased enrollment packages — priced up to thousands of dollars — that included Ormeus Coin and access to a purported crypto trading program. The second was a series of public ORME token offerings. Across both channels, the Barksdales sustained the fiction of a $250 million mining operation generating $5–8 million per month in revenue. To make the fiction concrete, they published a wallet address on the Ormeus Coin website appearing to hold more than $190 million in crypto assets. That wallet belonged to an unrelated third party; Ormeus wallets held less than $500,000.
The SEC filed civil fraud charges against both Barksdales on March 8, 2022; the DOJ simultaneously unsealed a criminal indictment against John Barksdale in the SDNY on four counts — securities fraud, conspiracy to commit securities fraud, wire fraud, and conspiracy to commit wire fraud — carrying a combined statutory maximum of 65 years. John Barksdale had been arrested by Thai authorities before the US charges were unsealed but escaped to Dubai before extradition could be completed and remains a wanted fugitive. On March 15, 2023, the SDNY entered a final civil judgment of approximately $82 million against both Barksdales, including disgorgement, prejudgment interest, and civil penalties. John Barksdale faces a separate criminal judgment of approximately $79 million.
From at least May 2018 through July 2021, Joy I. Kovar and her son Brent C. Kovar operated Profit Connect Wealth Services, Inc., a Las Vegas-based company that raised at least $12 million from more than 277 retail investors — and, by the time criminal charges were filed in February 2025, a documented total of approximately $24 million from at least 400 investors — by falsely claiming that an artificial intelligence supercomputer was generating extraordinary returns through cryptocurrency mining and securities trading. No functional supercomputer existed. No cryptocurrency mining operation backed the promised returns. More than ninety percent of Profit Connect’s revenue came directly from investor deposits, which were used to pay earlier investors, fund Kovar family expenses, and support Brent Kovar’s personal lifestyle — a Ponzi structure running without any productive underlying activity.
Profit Connect marketed its product as an investment in the output of a proprietary AI-powered supercomputer that, the Kovars claimed, could consistently generate fixed annual returns of between fifteen and thirty percent, with monthly compounding and a one-hundred-percent money-back guarantee. These promises were delivered through in-person seminars, online presentations, and direct investor solicitation across a network concentrated in Nevada but reaching investors nationally. Investors who joined early and received distributions could have been paid only with capital collected from later arrivals, not with any trading or mining proceeds.
On July 8, 2021, the Securities and Exchange Commission filed an emergency action in the US District Court for the District of Nevada and obtained a temporary restraining order and asset freeze against Profit Connect Wealth Services, Joy Kovar, and Brent Kovar. The court granted emergency relief on July 14, 2021, halting all operations. The SEC’s complaint charged the defendants with violating the antifraud provisions of the Securities Act and the Exchange Act through a fraudulent unregistered securities offering. A federal grand jury subsequently indicted Brent Kovar on February 13, 2025 on twelve counts of wire fraud, three counts of mail fraud, and three counts of money laundering, with the scheme’s total documented investor losses recalibrated at approximately $24 million. A jury trial was scheduled to begin April 8, 2025 in the District of Nevada before United States District Judge Jennifer A. Dorsey. As of the date of this dossier, Brent Kovar’s criminal case status remains pending.