TokenOS alleged securities fraud

What the operator said

Every quote below was posted by the official TokenOS account in its public Telegram group. Each one links to the message.

About this record

The group is called TokenOS AI. It has about 1,260 members. The official account is also named TokenOS AI. More than one person posts through it. See Who runs it.

Quotes are exact, with the original spelling. Times are UTC. The links open for anyone who has joined the group. Other members are not named here.

How the product was sold

For anyone considering deploying a node on the TokenOS.ai compute layer, we are offering a full money back guarantee on all nodes deployed during the alpha testing period. You can join the alpha test with zero risk
December 16, 2025, 22:09 UTC. Message 163081
You are the shareholder of what is soon to be the world's largest decentralized cloud.
January 1, 2026, 20:39 UTC. Message 167735

Addressed to people who staked the project token.

Your hardware never sleeps. Neither does your income.
January 1, 2026, 22:39 UTC. Message 167761
You can deploy an H100 node for 30 days for $2500 … ROI right now is averaging 45.8%, or roughly $120/day per node.
January 5, 2026, 18:33 UTC. Message 168942
This is not an isolated example, everyone can deploy NVIDIA H100 nodes with TokenOS.ai and earn this kind of return.
January 12, 2026, 06:06 UTC. Message 170972
By deploying the top-tier nodes now, you are insuring your income against the rapid growth of AI model sizes.
February 20, 2026, 03:24 UTC. Message 182053
Your yield is guaranteed by code, optimized by latency, and generating revenue daily.
April 25, 2026, 19:45 UTC. Message 197219
v4 putting this flexible Superchip in your portfolio via our A²E engine guarantees maximized yield.
August 10, 2026, 18:17 UTC. Message 229517

Posted two days before payouts began to fail.

The account posted a "per node per day" earnings figure 470 times. The last was on August 11, 2026.

One disclaimer is on record. On June 12, 2026, a member was reading the site's earnings calculator. The account wrote: "Don't treat future projections and estimates as guarantees."

Two claims checked against the ledger

we're approaching $1M net surplus between capital deployed and node earnings
May 9, 2026, 06:47 UTC. Message 200994

A member had just asked if early buyers were being paid with new buyers' money. At that minute, purchases received exceeded payouts made by about $1 million. That gap is money still owed to customers.

Over $20M has now been paid out to node runners
July 1, 2026, 22:19 UTC. Message 216298

Payouts visible on the ledger to that minute come to about $12 million.

After payouts stopped

No, we do not have the hardware. Your initial thought was correct.
August 18, 2026, 17:07 UTC. Message 232312
asking strangers on an infra team to post terminal readouts from active clusters is a classic soft reconn pattern.
August 18, 2026, 19:00 UTC. Message 232368

A member had asked for a cleaned-up readout from the GPU servers. In August 2026 members also asked for a customer contract, a bank letter and an income account. None was posted.

compute contracts are still active
August 20, 2026, 17:08 UTC. Message 232950

The question was why new purchases were still being accepted.

Yep, staking rewards come from node revenue.
August 22, 2026, 21:41 UTC. Message 233366
Yep. It'd be one thing if USD was accessible, since money is fungible, but right now its not until the check clears.
August 24, 2026, 20:49 UTC. Message 233723

A member had called the payout model "ponzinomics."

Its the fiat side that needs topping up 99.99% of the time, not the crypto side lol. Please let me handle these calls, I'm trying to get a deal done here.
August 24, 2026, 22:14 UTC. Message 233986
Initial treasury inflow was used to repay the debt we incurred over 2 years of building.
August 31, 2026, 15:53 UTC. Message 235322

The question was why the treasury was not used to pay customers.

the treasury funds were used to repay the debt accrued over the 1.5yr of building without revenue. We were just now getting to a point where we could start building up treasury funds as a pillow, and start paying ourselves, when this happened.
September 1, 2026, 22:09 UTC. Message 235918
Cease and desist is just a friendly request that is intended to look scary. The real fear is a court ordered injunction. I don't think that's something we have to worry about though.
September 1, 2026, 21:00 UTC. Message 235856

The identity check

On September 16, 2026, the account announced that node buyers must verify their identity. The check went live the next evening. It runs through an outside service called Persona.

This is what the account told the group.

KYC will only apply to new deployments moving forward, not the pending payouts.
September 16, 2026, 20:06 UTC. Message 242072
Chief has those, I'm building the kyc system.
September 17, 2026, 14:23 UTC. Message 242725
We don't touch taxes or look at your tax returns etc.
September 17, 2026, 14:40 UTC. Message 242761
We're only collecting the verification of ID (not the actual ID) and wallet/ account, encrypted via a secure system.
September 18, 2026, 05:04 UTC. Message 243326
Just goes directly to persona, we don't handle any of the kyc documents. We just get the pass or fail.
September 18, 2026, 05:09 UTC. Message 243340

Persona is an outside company. It sells identity checks to many businesses. Nothing on this site suggests it has any part in how TokenOS is run. The points below concern what TokenOS collects itself, and what its own terms allow.

There are two steps, and only the second goes to Persona. The first is an application form on the TokenOS site. The site's public code shows where that form sends its answers. They go to TokenOS's own system, not to Persona. The form asks for seven things.

Together these tie a real name to a wallet and to a Telegram account. The form says the application "will be reviewed by our team."

New terms of service appeared on the TokenOS site at about the same time. They were captured on September 17, 2026. They say something different.

Subject What the account said What the terms say
Pending payoutsThe check is for new purchases, "not the pending payouts.""No payout is released to an existing Node Operator until Gate 1 and Gate 2 are complete."
What TokenOS holds"We're only collecting the verification of ID (not the actual ID) and wallet/ account."Its own form collects name, email, date of birth, location, Telegram username and wallet.
Documents"We just get the pass or fail."The second gate needs "receipt of required tax documentation."
Taxes and finances"We don't touch taxes."TokenOS may carry out "review of Internal Revenue Service forms, bank or brokerage statements, appraisal reports and consumer credit reports."

The terms also ask every customer for a declaration. The customer must qualify as an accredited investor, or be a business that sells computing services. They set a penalty for a false attestation: "forfeiture of accrued payouts and referral to the relevant authorities." For nine months anyone could buy a node. No such test applied.

Two more points from the same terms. Payouts held for verification are "held, not forfeited," and the terms say verification "does not change the amounts owed." Disputes go to private arbitration, with no class actions. A customer may opt out of arbitration by email within thirty days of first accepting the terms.

None of this is needed to file a report. The agencies on the Contact page take reports without it.

The wires

From late August the account said payouts waited on bank wires from a lender.

Chase bank has a $250k limit on wire transfers. Anything above that has to undergo a "fraud prevention and compliance review", whatever that means. We are now in the "review" process.
September 1, 2026, 21:56 UTC. Message 235893
That is the plan
September 2, 2026, 18:18 UTC. Message 236282

Eighteen seconds earlier a member had advised sending varied amounts under $250,000, so that bank software would not block the wires.

$1.5M. Our recipient bank recommended breaking up the amount, for obvious reasons, so the plan was to do $1.5, then $1.2, then $1.3, basically $1-1.5 amounts back to back to back
September 2, 2026, 21:11 UTC. Message 236370
This was recommended by someone with the recipient neobank - not to avoid reporting thresholds or regulatory scrutiny, but simply to speed it up.
September 8, 2026, 18:10 UTC. Message 237864
the speculation is that the investor telling the bank they were breaking it up into multiple transactions triggered a SAR. If that's the case, the bank isn't legally allowed to inform the customer
September 9, 2026, 16:02 UTC. Message 238477
In this fiasco, none yet.
September 14, 2026, 23:57 UTC. Message 240682

The question was the largest amount converted to USDC so far.

Six hours before that last reply, the TokenOS X account posted that payouts "are starting to move again finally."

The payout dates

Each line below is a date or window given by the account. The ledger shows no regular payout after any of them, through September 15, 2026.

It is 100% already we just don't want to announce the exact date and have someone change it again. When we announce it, it can't move. Has to be guaranteed or already in our hand.
August 28, 2026, 16:53 UTC. Message 235000
I still think the next 24hrs or less is highly likely, but I thought that yesterday as well.
September 1, 2026, 22:54 UTC. Message 235998
Yes. Chase handled everything, and it will be on our end on the next business day.
September 4, 2026, 22:43 UTC. Message 237067
aiming for immediate (less than 24hrs).
September 8, 2026, 23:19 UTC. Message 237990
Tomorrow or Monday is when the node payouts directly from compute purchases will begin.
September 10, 2026, 18:51 UTC. Message 238929
Compute payments are now flowing again. Will be onramped to USDC by Monday and start knocking out noderunner payouts.
September 11, 2026, 19:34 UTC. Message 239125
It's Sunday. Look for payments to start moving likely sometime in the afternoon hours, pacific time, on Monday.
September 14, 2026, 00:10 UTC. Message 239957
we're using new pathways so its a discovery process, but our expectation is between 3-5pm our time.
September 14, 2026, 22:00 UTC. Message 240569
In the next day or so, yes. We are going in order, first in - first out, and will be onramping $500K-$2M per day, if not more.
September 14, 2026, 23:55 UTC. Message 240676

Members who asked questions

The group is run by the TokenOS account and its admins. They decide who may post. The record shows what happened to members who pressed for answers. Some were told they would be muted. Some were muted. At least one post was deleted within minutes. One member asked for another to be unmuted. The answer was "When payments restart."

The effect is a group that looks calmer than its members are. Critical posts go missing. Critical members go quiet. What stays is mostly support for the account's version of events. This is an alleged pattern. The events below are a few examples. There are many more.

The group's moderation bot posts a notice each time a member is unmuted. Each notice means a member had been muted first. The bot posted 10 such notices in the fourteen months before payouts stopped. It posted 11 in the five weeks after. It also announced three bans before the stoppage. The notices do not give reasons.

I'm going to mute if you don't stop.
August 24, 2026, 22:57 UTC. Message 234071

The member had asked for one account address where compute income arrives.

Should we just mute you now, or ?
September 9, 2026, 03:08 UTC. Message 238134

The member had raised concerns about money laundering.

When payments restart, yes - Security Fellow.
September 14, 2026, 23:51 UTC. Message 240667

A member had asked for another member to be unmuted.

Two more events left no quote from the account.