OneCoin sold itself as the cryptocurrency that would replace Bitcoin. Between 2014 and 2017 it took in billions of dollars from buyers in more than a hundred countries. The catch, which most of them never understood, is that there was no cryptocurrency. OneCoin had no real blockchain behind it. The coins people thought they owned existed only as numbers in a database the company controlled and could change at will.
The public face of the operation was Ruja Ignatova, who held a doctorate and spoke to packed arenas about a financial revolution. She co-founded the company with Karl Sebastian Greenwood. Underneath the branding was a straightforward pyramid: members earned commissions for recruiting new members, and the money paid to early participants came from the people who joined after them.
How the scheme worked
OneCoin ran as a multi-level marketing operation. You did not really buy coins. You bought education packages, tiered from cheap to very expensive, that came with tokens you could supposedly mine into OneCoins. The price of a coin was not set by any market. The company set it internally and only ever moved it up, which gave members the impression their holdings kept growing. When some tried to cash out, they found there was almost nowhere to sell and the company throttled withdrawals.
The recruiting engine was the real product. Commissions rewarded people for bringing in others, so the network grew fast and the incoming cash covered the payouts, for a while. Ignatova disappeared in 2017 and has not been seen since. Greenwood was later arrested and convicted in the United States. Estimates of the total lost run into the billions.
Where forensic auditing comes in
A scheme like OneCoin hides behind volume. Money moves through shell companies and across borders until the trail looks impossible to follow. Untangling it is the work of forensic auditors. They pull financial records, bank transfers, and corporate filings and trace where the money actually went, as opposed to where the marketing said it went. In a fake-cryptocurrency case, one of the first things that analysis shows is the absence of the thing being sold: no functioning blockchain and no genuine trading behind the claimed valuations.
That gap between the story and the ledger is what builds a case. Once auditors can show that new investor money was the only source of the returns paid out, the label changes from failed venture to fraud, and prosecutors have something to work with.
What it teaches investors
OneCoin worked because it borrowed the excitement around real cryptocurrency and wrapped it in a recruiting scheme, which is an old structure in new packaging. A couple of plain questions would have exposed it. Can you sell the asset to a stranger on an open market? Do the returns come from real activity, or from the deposits of the next group of buyers? When the answer to the first is no and the answer to the second is the next group of buyers, the name on the product does not matter.
Seeing red flags like these in your own numbers?
A confidential consultation costs nothing and tells you where you stand.
What it means for your matter
Most engagements are not Enron. But the pattern is the same at every scale: a diverted vendor payment, a related party that shouldn't exist, revenue booked before it was earned, a reserve fund that never quite reconciles. The methods used to expose a multibillion-dollar fraud are the same methods that expose a bookkeeper skimming from a small business or a managing agent taking kickbacks from a co-op.
If something in your financial picture doesn't add up, the earlier a forensic accountant looks, the more of the trail survives. Documents get lost, memories fade, and money moves. The record is easiest to reconstruct while it is still fresh.
Think something's wrong with your numbers?
Talk to a forensic accountant. It's confidential, and there's no obligation.