Compromised Advisor Credentials Used in Pump-and-Dump Schemes
The Department of Justice used civil forfeiture to seize about $19.5 million in proceeds from the pair of alleged market manipulation schemes that caused share prices to skyrocket.
The Justice Department is seizing back over $19.5 million in the wake of a pair of pump-and-dump schemes. In one case, the criminals manipulated share prices by using the compromised credentials of a financial advisor.
The schemes involved two Hong Kong-based companies, CTRL Group Limited and Dreamland Limited, both of which were listed on Nasdaq.
According to U.S. Attorney for the Southern District Jay Clayton, the schemes were driven by “Asia-based small-cap foreign issuers seeking to manipulate share prices and exploit American investors,” and “pose serious risks to those who place their trust in our financial system.”
“Investors should exercise caution when dealing with thinly traded foreign issuers, as these companies can be especially vulnerable to manipulation and can expose investors to significant, often hidden, risks,” Clayton said.
According to court documents, Dreamland was incorporated in the Cayman Islands while purporting to operate as a Hong Kong-based event management business. The company began trading on Nasdaq under the ticker TDIC on July 23, 2025.
However, on May 13 and 14 of this year, the company’s share price jumped more than tenfold, allegedly due to social media campaigns promoting it as a “short squeeze” (a big jump in a stock’s price resulting from shorting it, rather than from the company itself).
From January to May, the stock traded between $0.57 and $2.36 per share, with a daily trading volume of about 2.6 million. On May 13, the share price jumped to a high of $30 per share, with about 109 million shares traded. By the end of the 14th, the price had fallen back down to $0.80.
As the share price surged, an unnamed U.S. brokerage contacted the Financial Industry Regulatory Authority. The firm claimed that the credentials of a third-party financial advisor who used the brokerage’s trading firm had been compromised, enabling access to eight client accounts, and that the attacker had successfully accessed three of them.
The schemers purportedly attempted to purchase 1,361,488 shares of Dreamland for approximately $22.9 million (at an average price of $16.81 per share). The brokerage firm supposedly canceled the transactions, but suspected someone was trying to manipulate the stock price through unauthorized trades.
As this occurred, a brokerage account purporting to be a Hong Kong-based investment fund incorporated in the Caymans allegedly sold about 1,486,841 shares of TDIC, pocketing about $17.69 million in proceeds (it had previously purchased the TDIC shares directly from Dreamland). Last month, the DOJ seized about $8.4 million from the brokerage account.
Unlike Dreamland, CTRL Group was registered in the British Virgin Islands and claimed to offer marketing and advertising services in Hong Kong; it began trading on Nasdaq under the symbol MCTR on January 22, 2025, according to the complaint unveiling the civil forfeiture.
In late May of that year, social media accounts purportedly began posting hundreds of identical comments claiming MCTR would increase in value, including claims such as “$MCTR Here We Go” or “$MCTR New alerts have been posted in the last hours,” linking to a Discord group chat claiming to offer financial advice.
Starting on June 3, MCTR rose quickly. The stock opened at $7.12 per share (up from the previous day) and hit a high of $33.69 per share, with more than 70,000% more shares traded than the day before. The run continued for the next few days, but once the social media push ended, the stock price dropped, eventually hitting $2.82 per share by the end of June.
However, as this unfolded, 10 U.S. brokerage accounts allegedly traded a combined 1,065,313 shares of MCTR, with proceeds totaling over $11.96 million.
According to the DOJ, the 10 accounts were opened by individuals in China and Hong Kong. Though they were presumed to be different people, the DOJ claimed eight of the accounts logged in to the brokerage accounts using the same IP or Media Access Control address as at least one other account.
Last month, the DOJ seized about $10.3 million from these brokerage accounts through civil forfeiture.