How the money moved

Customers paid one account. The ledger shows where the money went next.

The picture

Boxes with a red outline are operator accounts. Each was created or funded by another operator account. The addresses are on Verify it yourself.

Money in, money out

To buy a node, a customer sent SOL or USDC to a single account. This site calls it the treasury. Payouts to customers left from the same account.

TokenOS said payouts came from compute income. The ledger does not show that income. Payout money came from customer purchases.

The operator account has said the GPUs are rented, not owned. Rent has to be paid to someone. No payment to a data center or cloud provider appears in these accounts. No payment from a compute buyer appears either. The account has said that side of the business runs through a bank, off the ledger.

Most payouts did not leave for long. The next section sets out why that mattered.

On August 24, 2026, a member put this to the operator account. The member said new purchases came in and old payouts went out, with no bank involved. The member called it "ponzinomics." The reply began: "Yep."

Redeployment: how it ran without outside income

A node lasted 30 days. At the end, the treasury sent the customer the purchase price plus the return. The customer could keep the money or buy new nodes with it. TokenOS called buying again "redeploying."

Most customers redeployed. Measured across the payouts on the ledger, about nine of every ten dollars paid out came back as new purchases. Most of it came back within hours.

That is how the payouts were met. Take $100 that came due. About $90 went out to customers and came straight back in. About $10 left for good. Purchases by new customers covered that $10. No compute income was needed for any of it. None appears on the ledger.

So the whole operation ran on its customers' money. Payouts were paid from node purchases. So were the fees, the weekly payments, the trading account and the cash sales described below. The only other money found entering the treasury came from operator accounts. Those accounts had received far more from the treasury than they sent back. No income from outside was found at any point.

The money going around was mostly the same money. The debt was not. Each 30-day round added 27% to 40% to what TokenOS owed. A debt that grows by a third each month doubles in under three months.

TokenOS's own purchase records show the result. Purchases are at list price. Payouts due are valued at what each GPU type paid on the ledger.

Purchases about doubled every month through July. Much of each month's buying was the month before's payouts coming back. The amount coming due followed one month behind, and grew faster.

The arrangement holds only while customers keep redeploying and new buyers cover those who leave. On August 12, 2026, about $2.7 million came due in one day. About $570,000 of purchases arrived. Payouts began to fail that day.

The operator account promoted redeployment for months. After the stop, it described the payout side in its own terms.

The staking pool

TokenOS also paid "staking rewards" on its token. Its site said these were tied to real node earnings.

The pool's income shows otherwise. About 94% of it came from the operator's own accounts. No outside payer appears.

On August 22, 2026, the operator account confirmed the link. It wrote: "Yep, staking rewards come from node revenue."

Customers that were not customers

Two "customer" accounts were created and funded by operator accounts.

The first appeared on March 30, 2026. The token account sent it $11,000 and paid its set-up cost. It had no other source of money. It went on to buy 67 nodes, about $355,000 of activity. About $39,000 came back out of it.

The second appeared on August 13, 2026, after payouts had stopped. The first operator account created it. It received about $7,600 from Binance. It sent that to the treasury the next day as a new purchase.

To other customers, both looked like demand.

Money sent to a trading account

Money left Solana through bridges. A bridge moves money from one blockchain to another. All of it arrived at one Ethereum account. That account received about $2.2 million.

From there, about $1.5 million went on to the reserve account. The reserve account fed a leveraged trading account on GMX, a derivatives exchange.

GMX publishes every trader's results. For this account it shows a loss of about $490,000. About $426,000 of that was lost in 2026. Average leverage was about 25 times.

Fees and a fixed weekly payment

Every node purchase paid a fee to a separate account. That account collected about $412,000 before it was replaced in July 2026. A second fee account then took $80 per node.

Since June 2026, the treasury also sent a fixed $10,000 about once a week to one account. That account forwards to a payout service. This site calls it the weekly payment account.

The payments did not stop when customer payouts stopped. $10,000 went out on August 15, 2026. Another $10,000 went out on August 24. The second came 26 minutes after a new customer's purchase arrived.

On September 10, 2026, the operator account wrote: "We aren't getting paid during this situation either."

Out through cash, and back in

An operator account on Ethereum sold ETH for cash. It used a peer-to-peer exchange. By July 13, 2026, about $563,000 had been sold this way.

Four of those sales have a twin. Within a day of each sale, a similar amount of USDC arrived on Solana. It came from a third-party trading desk. It went to an operator pass-through account, then to the treasury. Each time the amount was about 4% smaller than the sale.

The pass-through account is an operator account. The treasury paid its network fees one minute before its first transfer. The same account later carried the $172,500 payment described below.

On August 24, 2026, a member asked where compute income arrives on the ledger. The operator account replied with a picture. It showed a statement from an on-ramp service. It listed eight USD-to-USDC purchases, about $324,000 in total. Four of the eight equal the USDC amounts in the table, down to the cent. The statement shows the operator buying USDC. It does not show a customer paying for compute.

August 21, 2026: the whole treasury to one investor

Nine days after payouts began to fail, the treasury held about $172,500. On August 21 all of it moved. It went from the treasury to the vault. It went from the vault to the pass-through account. It went from there to one large investor.

Regular payouts had always gone straight from the treasury to the customer. This one took two extra steps through operator accounts.

What left after payouts stopped

Between August 13 and August 24, 2026, regular customers received nothing from the treasury. Other money still moved.

• About $25,000 went off Solana through a bridge on August 16.
• About $5,000 left through a one-day account the same day.
• $1,300 went to exchange deposit addresses in three small transfers.
• $20,000 went to the weekly payment account in two payments.
• $172,500 went to one investor.

New purchases were still accepted during this time. They came to more than $190,000 by August 24.