U.S. Attorney Seizes $19.5 Million After China and Hong Kong-Linked Accounts Allegedly Dumped Nasdaq Stocks on American Investors
Federal prosecutors in New York are seeking to recover more than $19.5 million connected to alleged pump-and-dump schemes involving two Hong Kong-based companies listed on the Nasdaq stock exchange. The cases offer a disturbing look at how foreign issuers, China and Hong Kong-linked brokerage accounts, coordinated social media promotion, and potentially compromised American investment accounts can be combined to extract millions of dollars from the U.S. financial system.
The U.S. Attorney’s Office for the Southern District of New York filed two civil forfeiture complaints involving CTRL Group Limited and Dreamland Limited. Federal authorities had already seized approximately $10.3 million from 10 brokerage accounts connected to the trading of CTRL Group shares, as well as roughly $8.4 million in cash and $850,000 in securities from an account that sold Dreamland shares during a sudden price surge.
The complaints contain allegations that must be resolved through the court process, but the trading patterns described by prosecutors are serious and highly specific. They show how thinly traded foreign stocks can be promoted aggressively online, driven to irrational prices, and then sold through accounts positioned to profit before ordinary investors understand what is happening.
CTRL Group is registered in the British Virgin Islands and claims to provide marketing and advertising services in Hong Kong. Its shares began trading on Nasdaq under the ticker MCTR in January 2025. By late May and early June of that year, numerous social media accounts began posting hundreds of nearly identical messages promoting the stock and directing users to a Discord group that claimed to provide investment advice.
On June 3, MCTR opened at $7.12 per share, more than 50% above the previous day’s level. It climbed as high as $33.69 and closed at $32.90. Approximately 44.2 million shares changed hands, representing a trading-volume increase of more than 70,000% from the previous day.
The promotional activity did not produce lasting value. Once the online campaign faded, the stock collapsed. By the end of June 2025, MCTR had fallen to $2.82 per share. Investors who entered near the manufactured peak faced devastating losses, while a small group of accounts had allegedly sold more than one million shares for nearly $12 million.
Those accounts deserve particular attention. Prosecutors said the 10 U.S. brokerage accounts were opened by individuals located in China or Hong Kong. Although they appeared to belong to different people, eight accessed their accounts using the same IP address or device address as at least one other account. That overlap allegedly indicated coordination rather than independent investment decisions.
This is precisely the kind of cross-border market abuse that American investors may struggle to detect. A company can present itself as a legitimate Nasdaq-listed business, promoters can manufacture online enthusiasm, and coordinated accounts can quietly prepare to sell into the demand created by unsuspecting buyers. By the time the stock collapses, the proceeds may already be moving through accounts controlled thousands of miles from the victims.
The allegations involving Dreamland reveal an even more aggressive threat. Dreamland, a Cayman Islands-incorporated company claiming to operate an event management business in Hong Kong, began trading on Nasdaq under the ticker TDIC in July 2025.
For months, TDIC generally traded below $2.36 per share. Then, on May 13, 2026, its price suddenly reached an intraday high of $30 and closed at $23.05, with approximately 109 million shares traded. One day later, the stock closed at just $0.80. By June 12, it had fallen to $0.23.
This was not an ordinary market correction. The stock increased more than tenfold and then lost nearly all of that inflated value within a matter of days. Social media accounts promoted TDIC as a supposed “short squeeze” opportunity, a phrase often used to create urgency and persuade retail investors that they must buy immediately before missing a major price surge.
At the same time, compromised login credentials belonging to a financial adviser were allegedly used to access client accounts at a U.S. brokerage firm. The credentials successfully reached three accounts and were used to attempt purchases of approximately 1.36 million TDIC shares worth nearly $22.9 million. The brokerage apparently canceled the purchases, potentially preventing major losses for the affected clients.
While those unauthorized purchases were being attempted, a Cayman Islands fund describing itself as Hong Kong-based sold approximately 1.49 million TDIC shares for nearly $17.7 million. The fund had previously obtained shares directly from Dreamland, placing it in a position to benefit from the sudden demand.
Taken together, the allegations describe a dangerous model: foreign-linked insiders or early shareholders hold large blocks of inexpensive stock, online promoters generate artificial enthusiasm, American brokerage infrastructure supplies liquidity, and valuable shares are sold before the price collapses. In the Dreamland matter, compromised American accounts may also have been used to manufacture buying pressure or create an exit opportunity for existing shareholders.
This is how a manipulation scheme can turn the credibility of the American stock market against American investors. Nasdaq listing status can create an impression of legitimacy, but an exchange listing does not guarantee that a foreign company has transparent operations, reliable governance, or shareholders whose interests align with the public.
The China and Hong Kong connections in these cases are not incidental. The CTRL Group accounts were allegedly controlled by people located in China or Hong Kong and showed signs of coordination. Both underlying businesses claimed Hong Kong operations, while the Dreamland share seller described itself as a Hong Kong-based investment fund. The alleged activity depended on access to American exchanges and brokerage systems while much of the apparent organization and financial benefit remained offshore.
American investors therefore need to treat thinly traded foreign small-cap stocks with extreme caution, especially when the companies have limited public histories and suddenly become the subject of identical promotional posts across social media. Claims of secret investment tips, guaranteed price increases, new alerts, or imminent short squeezes should be treated as warning signs rather than opportunities.
The schemes also demonstrate how social media has lowered the cost of manipulating American markets. Fraudsters no longer need a traditional boiler room filled with telephone salespeople. Hundreds of accounts can repeat the same message, create the illusion of widespread interest, and direct victims into private chat groups where promoters control the narrative and suppress skepticism.
U.S. regulators, exchanges, and brokerage firms should continue improving their ability to identify coordinated foreign trading, device-sharing across supposedly unrelated accounts, unusual pre-promotion stock accumulation, and sudden purchases made through compromised credentials. Foreign companies seeking access to American capital should face rigorous scrutiny regarding beneficial ownership, related-party transactions, pre-IPO allocations, and offshore funds that may sell into promotional campaigns.
The government’s recovery of $19.5 million is important because investor protection should not end with identifying a suspicious chart after the money disappears. Seizing alleged proceeds creates a path toward compensating victims and removes some of the financial reward that makes these schemes attractive.
Nevertheless, the amount recovered may represent only part of the damage. Retail investors who purchased shares near the peaks may have lost retirement savings, emergency funds, or money intended for their families. Even investors who were not directly involved suffer when repeated foreign-linked manipulation weakens confidence in U.S. exchanges.
America benefits from open capital markets, but openness cannot mean allowing overseas actors to use Nasdaq listings, coordinated brokerage accounts, stolen credentials, and social media deception as tools for extracting wealth from American households. Access to U.S. financial markets is a privilege built on disclosure, honest trading, and enforceable accountability.
These two cases should serve as a clear warning. When obscure China or Hong Kong-linked companies suddenly soar without credible business news, while anonymous online accounts insist that buyers must act immediately, American investors should assume that someone else may already be preparing to sell. The most dangerous moment is often not when a stock looks weak, but when manufactured excitement makes it appear unstoppable.
