What the operator said
Every quote below was posted by the official TokenOS account in its public Telegram group, and each one links to the message. Read in order, they are the story of the scheme told by the people running it.
About this record
The group is called TokenOS AI and had about 1,260 members in October 2026. The official account is also named TokenOS AI, and more than one person posts through it; see Who runs it. Quotes are exact, with the original spelling, and times are UTC. The links open for anyone who has joined the group. Other members are not named here.
How the product was sold
For anyone considering deploying a node on the TokenOS.ai compute layer, we are offering a full money back guarantee on all nodes deployed during the alpha testing period. You can join the alpha test with zero risk
You are the shareholder of what is soon to be the world's largest decentralized cloud.
Addressed to people who staked the project token.
Your hardware never sleeps. Neither does your income.
You can deploy an H100 node for 30 days for $2500 … ROI right now is averaging 45.8%, or roughly $120/day per node.
This is not an isolated example, everyone can deploy NVIDIA H100 nodes with TokenOS.ai and earn this kind of return.
By deploying the top-tier nodes now, you are insuring your income against the rapid growth of AI model sizes.
Your yield is guaranteed by code, optimized by latency, and generating revenue daily.
v4 putting this flexible Superchip in your portfolio via our A²E engine guarantees maximized yield.
Posted two days before payouts began to fail.
The account posted a "per node per day" earnings figure 470 times, the last of them on August 11, 2026, the day before payouts began to fail. Against those 470 posts, the account warned once not to treat the figures as guarantees. On June 12, 2026, while a member worked through the earnings calculator on the TokenOS site, it wrote: "Don't treat future projections and estimates as guarantees." On May 9, 2026, pressed by a member, it agreed twice that "there's always a risk."
Two claims checked against the ledger
we're approaching $1M net surplus between capital deployed and node earnings
A member had spent an hour pressing on whether payouts depended on new money and on the operator's word, and had just described how a Ponzi pays early buyers. This was the reply. The ledger shows what the "surplus" was. Customers had paid in about $1 million more than TokenOS had paid out. That is not profit. It is customers' money, still owed back to them.
Over $20M has now been paid out to node runners
Payouts visible on the ledger to that minute come to about $12 million.
After payouts stopped
No, we do not have the hardware. Your initial thought was correct.
A member had asked whether the team owned hardware or rented compute. Eight minutes later the account said customer money bought GPU time from other companies. See The GPU claim.
asking strangers on an infra team to post terminal readouts from active clusters is a classic soft reconn pattern.
A member had asked for a cleaned-up readout from the GPU servers. In August 2026 a member also asked for the account where compute income arrives. No address was posted.
compute contracts are still active
Posted on the ninth day of the stoppage. New purchases were still being accepted.
Yep, staking rewards come from node revenue.
Yep. It'd be one thing if USD was accessible, since money is fungible, but right now its not until the check clears.
A member had called the payout model "ponzinomics."
Its the fiat side that needs topping up 99.99% of the time, not the crypto side lol. Please let me handle these calls, I'm trying to get a deal done here.
Initial treasury inflow was used to repay the debt we incurred over 2 years of building.
The question was why the treasury was not used to pay customers.
Cease and desist is just a friendly request that is intended to look scary. The real fear is a court ordered injunction. I don't think that's something we have to worry about though.
A member had joked that the money might arrive with a cease-and-desist letter from the banks. None had been sent at that date.
the treasury funds were used to repay the debt accrued over the 1.5yr of building without revenue. We were just now getting to a point where we could start building up treasury funds as a pillow, and start paying ourselves, when this happened.
we have to accept that we were noncompliant on some levels until now
The question was whether existing customers would be held to the new rules.
LOL Payouts were going fine for 8 months and venture capital was still extremely demanding and controlling.
A member had suggested venture capital would come once payouts restarted.
The identity check
On September 16, 2026, the account announced that node buyers must verify their identity, a check it calls KYC, short for know your customer. The check went live the next evening through an outside service called Persona. On September 24 the account said the provider had changed, and the terms on the TokenOS site now name Didit Identity, Inc. This is what the account told the group.
KYC will only apply to new deployments moving forward, not the pending payouts.
Chief has those, I'm building the kyc system.
A member had asked for the amounts being converted to USDC. "Chief" is how one poster refers to the other; see Who runs it.
We don't touch taxes or look at your tax returns etc.
We're only collecting the verification of ID (not the actual ID) and wallet/ account, encrypted via a secure system.
Just goes directly to persona, we don't handle any of the kyc documents. We just get the pass or fail.
We can't access anything you submit to Persona. Technically you could put anything you want on the TokenOS application side, it's not that important. The only thing that really matters is your wallet address, that has to be correct, and obviously the info you submit to Persona has to be legitimate.
If you already KYC'd with Persona, please do it again. We had to switch to a different, more responsive provider.
Yes, we had to switch KYC providers. Persona moves too slow.
Persona and Didit are outside companies. Both sell identity checks to many businesses. Nothing on this site suggests either has any part in how TokenOS is run. The points below concern what TokenOS collects itself, and what its own terms allow.
There are two steps, and only the second goes to the provider. The first is an application form on the TokenOS site. Its public code shows where that form sends its answers: to TokenOS's own system, not to the provider. The form asks for six things, and a seventh, the state, from United States residents.
- Full name
- Email address
- Date of birth
- Country, and state for United States residents
- Telegram username
- Wallet address
Together these tie a real name to a wallet and to a Telegram account. The form says the application "will be reviewed by our team."
New terms of service appeared on the TokenOS site at about the same time, captured on September 17, 2026. They say something different.
| Subject | What the account said | What the terms say |
|---|---|---|
| Pending payouts | The check is for new purchases, "not the pending payouts." | "No payout is released to an existing Node Operator until Gate 1 and Gate 2 are complete." |
| What TokenOS holds | "We're only collecting the verification of ID (not the actual ID) and wallet/ account." | Its own form collects name, email, date of birth, location, Telegram username and wallet. |
| Documents | "We just get the pass or fail." | The second gate needs "receipt of required tax documentation." |
| Taxes and finances | "We don't touch taxes." | TokenOS may carry out "review of Internal Revenue Service forms, bank or brokerage statements, appraisal reports and consumer credit reports." |
The terms also ask every customer for a declaration. The customer must qualify as an accredited investor, or be a business that sells computing services. They set a penalty for a false attestation: "forfeiture of accrued payouts and referral to the relevant authorities." For nine months anyone could buy a node. No such test applied.
Two more points from the same terms. Payouts held for verification are "held, not forfeited," and the terms say verification "does not change the amounts owed." Disputes go to private arbitration, with no class actions. A customer may opt out of arbitration by email within thirty days of first accepting the terms.
The wires
From late August the account said payouts waited on bank wires from a lender. By October the story had moved to over-the-counter desks, firms that convert large sums between dollars and crypto, and their compliance checks. On October 22 the account announced approval by a desk, with payouts to resume "early next week". No wire had been received.
Chase bank has a $250k limit on wire transfers. Anything above that has to undergo a "fraud prevention and compliance review", whatever that means. We are now in the "review" process.
That is the plan
Eighteen seconds earlier a member had advised sending varied amounts under $250,000, so that bank software would not block the wires.
$1.5M. Our recipient bank recommended breaking up the amount, for obvious reasons, so the plan was to do $1.5, then $1.2, then $1.3, basically $1-1.5 amounts back to back to back
This was recommended by someone with the recipient neobank - not to avoid reporting thresholds or regulatory scrutiny, but simply to speed it up.
the speculation is that the investor telling the bank they were breaking it up into multiple transactions triggered a SAR. If that's the case, the bank isn't legally allowed to inform the customer
A SAR is a suspicious activity report, a confidential filing a bank makes to regulators.
In this fiasco, none yet.
The question was the largest amount converted to USDC so far.
We're currently doing kyb with 8 otc desks and institutional businesses and the first one that gives us the okay gets a full wire for all of the funds so we avoid any and all AML issues.
Nothing as of yet.
The question was whether there were any new demands from the exchange that day.
Six hours before the September 14 reply above, "In this fiasco, none yet," the TokenOS X account posted that payouts "are starting to move again finally."
The payout dates
Each line below is a date or window given by the account, or a statement that one was certain. The ledger shows no regular payout after any of them. As of October 30, 2026, no regular payout has gone out since August 13. Since October the dates have been tied to an exchange's approval, then to a transfer clearing. The newest, given on October 30, is Monday, November 2.
My expectation now is that payouts will be caught up Monday/Tuesday. From that point on, there should be no further issues.
Very confident for Monday.
Things are on track for today. Expecting payouts to resume in the 2-5pm range this afternoon, pacific time.
That Monday ended with no payouts.
It is 100% already we just don't want to announce the exact date and have someone change it again. When we announce it, it can't move. Has to be guaranteed or already in our hand.
Expecting payout resolutions tomorrow
I still think the next 24hrs or less is highly likely, but I thought that yesterday as well.
Should be $1.75M by Friday
A funding date, not a payout date.
Yes. Chase handled everything, and it will be on our end on the next business day.
aiming for immediate (less than 24hrs).
Tomorrow or Monday is when the node payouts directly from compute purchases will begin.
Compute payments are now flowing again. Will be onramped to USDC by Monday and start knocking out noderunner payouts.
"Onramped to USDC" means converted from dollars into the dollar token the ledger records.
It's Sunday. Look for payments to start moving likely sometime in the afternoon hours, pacific time, on Monday.
we're using new pathways so its a discovery process, but our expectation is between 3-5pm our time.
In the next day or so, yes. We are going in order, first in - first out, and will be onramping $500K-$2M per day, if not more.
payouts will be starting sometime between the 30th and 3rd.
Monday we onramp.
"Onramp" means turning bank dollars into the dollar token used for payouts.
They told us we'll be approved Friday or Tuesday, most likely.
"They" is an exchange's over-the-counter desk.
Most likely is onramping occurs Tuesday
A funding date, not a payout date.
We have passed compliance checks and are now approved for OTC desk access. … Barring any further surprises, our ETA for payouts to resume is early next week, and we expect the queue to take approximately 3-4 days to clear out.
Posted in the group's Announcements topic and reposted in Discussion. The desk is not named.
If this goes smoothly, we could see payouts begin in the latter part of the day tomorrow.
If it clears before 2pm today or tomorrow, then payouts will begin immediately.
The window closed at 2 PM Pacific on October 30 with no payouts.
Monday is the max timeline.
Monday is November 2.
Yes
A member had asked whether it was looking like Monday. This is Friday evening, October 30, Pacific time.
Members who asked questions
The group is run by the TokenOS account and its admins, who decide who may post. The record shows what happened to members who pressed for answers. Some were told they would be muted. Some were muted. At least one post was deleted within minutes. When one member asked for another to be unmuted, the answer was "When payments restart."
The effect is a group that looks calmer than its members are. Critical posts go missing and critical members go quiet, so what stays is mostly support for the account's version of events. This is an alleged pattern; the events below are a few examples, and there are many more.
The group's moderation bot posts a notice each time a member is unmuted. Each notice means a member had been muted first. The bot posted 10 such notices in the fourteen months before payouts stopped. It posted 11 in the five weeks after. It also announced three bans before the stoppage. The notices do not give reasons.
I'm going to mute if you don't stop.
The member had asked for one account address where compute income arrives.
Should we just mute you now, or ?
The member had asked, with a joke, for the new payout date. Nine hours earlier the same member had questioned the plan to split the wires.
When payments restart, yes - Security Fellow.
A member had asked for another member to be unmuted. "Security Fellow" is a sign-off used by one of the people posting through the account; see Who runs it.
One more event left no quote from the account.
- September 13, 2026, 05:18 UTC. A member posted that the token's value had collapsed. The post was deleted. The member's posting rights were restricted within 20 minutes. Message 239588 was seen in the group at 05:18 UTC and is missing from the record afterward.