The Linqto SPV Stack: A Forensic Autopsy of a $430 Million Pre-IPO Fraud

Hook

On October 9, 2026, the SEC's San Francisco Regional Office filed a complaint that most crypto-native desks skimmed past. Two names. Not a protocol. Not a token. Two individuals — Sarris and Endoso — former executives of Linqto, a platform that sold pre-IPO equity in unicorns to retail buyers through a lattice of special purpose vehicles.

The headline number is $430 million. That is the aggregate volume the government attributes to the scheme. But the number is not the anomaly. The anomaly is the architecture of the charges. The SEC is not suing Linqto the company alone. It is suing the humans directly, and it is doing so on two independent legal tracks at once: unregistered securities under Section 5 of the Securities Act of 1933, and unregistered investment company status under Section 7 of the Investment Company Act of 1940. Neither track requires proof of fraud to succeed. Both are strict-liability paths.

That is the tell. When a regulator stacks a strict-liability count underneath a fraud count, it is signaling something about its confidence in the fraud case. The strict-liability path is insurance. The fraud count is the message. The government wants a conviction it cannot lose, wrapped around a narrative it wants the market to remember.

I have spent years tracing wallets for a living. I have watched a hundred projects promise decentralization while quietly retaining admin keys in a Gnosis Safe only three signatures deep. This case is different in one respect: it is not a DeFi primitive. It is a legal wrapper — an SPV stack — dressed up as a technology platform. And the forensic signature of an SPV stack is identical to the forensic signature of a fragmented liquidity pool. Both are engineered to make the flow hard to follow.

Liquidity didn't disappear in the Linqto case. It was routed. And routing is a design decision, not an accident.

Context

To understand why this complaint matters beyond its own facts, you have to understand what Linqto actually was, and what the pre-IPO retail platform category has become.

The premise is seductive. Retail investors have historically been locked out of the most explosive phase of a company's valuation curve — the private growth stage before an IPO. By the time a company lists, the early institutional money has already captured the asymmetric upside. Platforms like Linqto promised to flatten that access gap. Buy a slice of a unicorn before it goes public. The pitch writes itself: democratized access, tokenized fractions, low minimums.

The mechanics are less glamorous. You cannot legally sell a private company's shares to the public without a registration statement or a valid exemption. So the industry invented the SPV — the special purpose vehicle. A platform forms a Delaware or Cayman entity, that entity acquires a block of pre-IPO shares, and retail investors buy membership interests in the SPV. On paper, the investor owns a piece of an LLC that owns a piece of the unicorn. In practice, the investor owns a claim on a legal wrapper whose underlying asset is illiquid, opaque, and priced by the platform itself.

Here is the legal hinge. Under SEC v. W.J. Howey Co. (1940), an investment contract exists when there is an investment of money in a common enterprise with an expectation of profits derived from the efforts of others. SPV membership interests clear that bar easily. They are securities. Full stop. That means every SPV interest sold to a retail investor is a securities transaction, and every such transaction requires either registration or a qualifying exemption.

The most common exemption is Regulation D. Rule 506(b) and 506(c) allow private placements — but 506(b) prohibits general solicitation, and both depend on the buyers being accredited investors under Rule 501. There is a second structural limit: the Investment Company Act exempts private funds under Section 3(c)(1) only if the fund has 100 or fewer beneficial owners. Cross that threshold and you are operating an unregistered investment company.

The entire pre-IPO retail model lives or dies on two questions: who is the buyer, and how many of them are there. Answer those honestly and the model works, thinly. Answer them creatively and you have built a fraud — not because anyone lied about a token price, but because the wrapper itself was a lie.

The SEC has been circling this category for years. The 2021 National Defense Authorization Act codified the agency's disgorgement authority into Section 21(d)(3) of the Exchange Act and established a ten-year limitations period for it — a direct legislative response to Kokesh v. SEC (2017), which had capped disgorgement at five years by classifying it as a penalty. That change matters enormously here. A ten-year lookback on a sales program that ran continuously from roughly 2021 through 2024 means the entire $430 million is potentially recoverable, not just the tail end.

The regulatory backdrop is a "return to core mission" cycle. After several years of the SEC's enforcement bandwidth being consumed by crypto asset registration battles, the pendulum has swung back toward traditional securities fraud and retail investor protection. Linqto sits exactly at the intersection: a fintech-flavored platform, a retail-facing product, and a private-market wrapper that the agency can dismantle using doctrine that predates the internet.

Core

Let me lay out the evidence chain the way I would lay out a wallet cluster: start with the structure, then follow the flow, then test the claims.

The SPV Stack Is the Crime Scene

The complaint alleges Linqto sold SPV interests to non-accredited retail investors and, in doing so, operated as an unregistered investment company. Read that carefully. The government is not primarily arguing that Linqto mispriced a share. It is arguing that the container was illegal.

The Section 3(c)(1) exemption caps a private fund at 100 beneficial owners. If a platform wants to sell to thousands of retail buyers while still claiming 3(c)(1) status, it has exactly one tool: proliferation. Spin up a new SPV for every tranche, keep each one under 100 holders, and layer them so that no single entity crosses the line. On paper, each SPV is compliant. In aggregate, the platform is running a distributed investment company with thousands of beneficial owners — the exact structure the statute was written to prevent.

This is the structural violation hiding in plain sight, and it is why the SEC charged ICA §7 alongside §5. It is not a marketing problem. It is a corporate-architecture problem. The SPV stack is not a compliance workaround. It is the alleged offense.

From an on-chain forensics standpoint, this is the same pattern I have documented in DeFi for years. When a team wants to evade a concentration limit or a governance threshold, it fragments holdings across dozens of wallets. The aggregate position is unchanged; only the visible footprint is chopped up. I audited three Southeast Asian utility token launches in 2017 by manually tracing Ethereum distribution logic, and two of them promised decentralization while retaining admin keys that could mint, pause, or drain at will. The fragmentation was the tell then. It is the tell now — just expressed in corporate entities instead of addresses.

The Three False Claims

Beyond the structural counts, the SEC alleges affirmative misrepresentation. Three claims stand out, and each has a distinct evidentiary profile.

First, pricing. The complaint alleges investors were told they were buying pre-IPO equity at a discount to market value, when in fact the pricing was set above fair value. This is the hardest claim to prove and the easiest to defend, because pre-IPO companies have no public market price. "Fair value" is an opinion, and opinions are not fraud unless they are knowingly false.

Second, sold-out inventory. The complaint alleges the platform represented offerings as sold out to create urgency, when allocation remained available. This is a classic scarcity-fabrication tactic, and it is checkable against internal allocation records.

Third, and most damning, the algorithm. The complaint alleges Linqto represented that its pricing was driven by an algorithm when the pricing was in fact set manually. This is the count that should worry any defense team. A claim about a specific technical mechanism is falsifiable by the system's own logs. If there was no pricing engine, there is no log, and the absence of the log is itself the proof. If there was a pricing engine but humans overrode it, the override records are the proof.

This is where my 2020 work becomes relevant. When I built Python scrapers to map Uniswap and Curve liquidity pools and cluster over 500 wallet addresses, I found that roughly 60% of the "organic" volume in early yearn.finance forks was wash trading by insiders. The insight did not come from the volume number. It came from clustering — from noticing that the wallets buying and selling were the same wallets. Raw volume lies. Address structure tells the truth.

The same principle applies to a claimed algorithm. A real algorithmic pricing system leaves a deterministic trail: input feeds, computation logs, output records, timestamps. A fabricated one leaves nothing, or leaves human edits where machine decisions should be. The forensic question is not "was the price right?" It is "does the mechanism described in the marketing exist in the logs?"

The Strict-Liability Trap

Here is the part that most coverage will underweight. Section 5 of the Securities Act is a strict-liability provision. To win a Section 5 claim, the SEC does not need to prove intent, materiality, or scienter. It needs to prove that a security was sold without an effective registration statement and without a valid exemption. That is it.

This means that even if the fraud counts partially collapse — if the pricing claim is defeated as opinion, if the sold-out claim is softened as puffery — the Section 5 count survives independently. The defendants can lose on the strict-liability track alone and still face disgorgement of the entire sales base plus civil penalties plus an officer-and-director bar.

The scienter requirement is the government's real burden, and it attaches only to the fraud counts under Section 17(a) and Rule 10b-5. Proving that Sarris and Endoso knew the pricing was fake, knew the inventory was not sold out, and knew the algorithm was a fiction requires internal evidence: emails, Slack messages, board minutes, system configurations. Modern enforcement almost always turns on this documentary record. The "hard fraud" of a fake algorithm is easier to prove than the "soft fraud" of an inflated valuation, because the fake algorithm contradicts an objective, verifiable fact about how the company operated.

The Disgorgement Math

The remedy stack the SEC is seeking is comprehensive: injunction, disgorgement plus prejudgment interest, civil penalties, and an officer-and-director bar.

The disgorgement figure is where the numbers get interesting. Under Liu v. SEC (2020), disgorgement cannot exceed the wrongdoer's net profits and must be directed to investors. This gives the defense its most valuable lever: argue that operational costs, legitimate business expenses, and amounts already returned to investors should be netted out. If Linqto spent $200 million on actual share purchases and operations, the disgorgement base could shrink substantially.

But Liu has a limit. If the SPV funds were cycled in a Ponzi-like fashion — new investor money used to pay earlier investors or to cover platform overhead rather than to acquire underlying equity — the net-profit defense collapses. *Ponzi flow destroys the Liu shield.* This is the single most important factual question in the entire case, and it is answerable by tracing the flow of the $430 million: how much actually reached the unicorn shares, and how much stayed inside the machine.

The officer-and-director bar is the non-monetary remedy that signals how the SEC views the defendants. It is an industry-exclusion sanction, reserved for cases where the agency believes there is a risk of recurrence and demonstrated harm. The SEC does not routinely seek it against first-time, low-level defendants. It seeks it against people it wants permanently removed from the capital markets.

Control Person Liability and the Criminal Overlay

The decision to name Sarris and Endoso personally, rather than only the corporate entity, invokes control-person and aiding-and-abetting doctrines. Under Section 20(a) of the Exchange Act, a person who controls a violator can be jointly liable. Under Section 20(e), a person who knowingly provides substantial assistance can be liable as an aider and abettor.

Naming individuals is a deliberate strategy. If the corporate entity is insolvent — and a platform facing a $430 million disgorgement claim almost certainly is — then the individuals' personal assets are the only meaningful recovery pool. Suing the humans is not a moral statement. It is an asset-recovery decision.

And then there is the criminal layer. The presence of the Southern District of New York and the FBI in the investigation is the loudest signal in the entire matter. The SEC does not invite federal prosecutors and the Bureau into a pure civil registration dispute. Their involvement indicates the government is evaluating charges under the securities fraud statute (18 U.S.C. §1348) and the wire fraud statute (18 U.S.C. §1343), which carry statutory maximums of 25 years and 20 years respectively.

This is the dimension the market consistently misprices. Civil disgorgement is a balance-sheet problem. Criminal exposure is a liberty problem. The most severe exposure in the Linqto matter is not the $430 million. It is the possibility of prison time.

The Collateral Damage Map

A case like this radiates outward. Three secondary effects matter.

First, third-party liability. SPV structures involve layers of intermediaries — administrators, distributors, auditors, counsel, custodians. The SEC can pursue aiding-and-abetting claims against them, though the post-Lorenzo v. SEC (2019) framework narrowed the path for private aiding-and-abetting suits. Still, professional negligence exposure is real, and the reputational cost of being named is immediate.

Second, private class action. A $430 million retail sales program with thousands of harmed, similarly situated investors is textbook class-action material: numerosity, commonality, typicality. Once the SEC establishes fraud facts in its civil case, private plaintiffs will cite those findings, and the aggregate private recovery could dwarf the SEC's disgorgement. The SEC complaint is not the end of the liability. It is the opening bell.

Third, the labor-law shadow. Pre-IPO platforms frequently scale their sales forces using 1099 independent contractors rather than W-2 employees. In California — where the SEC's San Francisco office sits — the AB5 "ABC test" makes it very hard to classify a full-time sales representative as an independent contractor. If Linqto ran a large distributed sales operation on 1099s, that is a second enforcement exposure layered on top of the securities case: payroll tax liability, wage claims, and penalties. It is a secondary front, but it compounds the balance sheet damage.

Contrarian

Now the part the cheerleaders on both sides will not want to hear.

The temptation is to read this complaint as proof that the entire pre-IPO retail category is fraudulent. That is a correlation-causation error, and it is the exact error I have spent a career trying to avoid. The existence of one allegedly fraudulent SPV operator does not invalidate the legal structure that legitimate operators use. Regulation D exists precisely because private placements are a legitimate capital-raising channel. SPVs are used by sophisticated institutional investors every day without controversy.

The Linqto case is a case about execution within a legal structure, not about the illegality of the structure itself. The structure is legal when the buyers are accredited, the counts are honest, and the marketing does not fabricate mechanisms. It becomes illegal when any of those conditions fail. That is not a novel legal insight. It is the boring, load-bearing truth that the bear market doesn't want to hear, because "the whole category is a scam" is a cleaner story than "some operators cut corners and got caught."

The bear market doesn't need this case to be a category killer. It needs it to be a fraud. Those are different claims, and conflating them is how bad analysis gets written.

Here is the second contrarian point, and it is the one that should genuinely worry thoughtful readers. The most legally fragile allegation — the fake algorithm — may also be the most legally ambiguous. Plenty of fintech platforms describe human-assisted processes as "algorithmic" or "AI-powered" in marketing copy. The line between aggressive marketing language and material misrepresentation is not a bright line; it is a materiality judgment. If a court finds that "algorithmic pricing" was understood by reasonable investors as general shorthand rather than a precise technical warranty, the claim weakens.

But that defense has a poison pill. If Linqto's own internal documents show that executives knew the "algorithm" claim was false and used it specifically to induce purchases, then the ambiguity evaporates and the claim becomes the strongest count in the complaint. The fraud case will be won or lost on the tone of internal communications, not on the external marketing. That is where every modern securities case is decided. It is where my 2024 ETF attribution work taught me to look — not at the public narrative, but at the quiet, uncorrelated record beneath it.

And the deepest blind spot of all: this enforcement action may inadvertently entrench the incumbents. If compliance costs spike — accredited-investor verification systems, SPV governance infrastructure, licensed distribution partnerships, auditable pricing engines — then only the well-capitalized platforms can afford to operate legally. The small operators exit. The category consolidates. And the traditional broker-dealers, who have always had the licenses the fintechs were routing around, walk in to capture the market. The biggest commercial winner of the Linqto prosecution may be the incumbent investment banks it was built to disrupt.

That is the irony no one will write about: a case framed as retail protection may end up concentrating pre-IPO access among the very institutions the model promised to bypass.

Takeaway

Watch the flow, not the filing. The disgorgement number — and the criminal exposure — both turn on a single forensic question: of the $430 million raised, how much reached actual unicorn equity, and how much circulated back through the platform? That is traceable. That is where the case is actually decided.

The forward signal is not the Linqto defendants. It is the sweep that follows. When the SEC establishes that a parallel-SPV architecture can be attacked as an unregistered investment company, it creates a template. Expect the San Francisco office to apply that template to comparable platforms over the next twelve to eighteen months. The trigger will be retail complaint volume, and the tool will be the ICA §7 count that no one is currently pricing.

The mechanism to watch is internal. Every platform that describes its pricing, its risk, or its technology as "algorithmic" now has a new liability surface: the logs. If the mechanism is real, the logs exist. If the logs do not exist, the marketing was the crime. That is the standard this case sets, and it will outlive the two names at the top of the complaint.

The ledger is unforgiving. It remembers what the pitch deck forgets. And in the Linqto matter, the ledger is only now being read aloud.