The investigation in Japan has detained two Chinese nationals suspected of orchestrating the largest known market-manipulation scheme involving hijacked brokerage accounts. The men are accused of violating the law prohibiting unauthorized access and of orchestrating securities-price manipulation: according to investigators, they seized control of ten retail investors’ accounts and used them to aggressively inflate the stock price of a company listed on the Tokyo Stock Exchange Standard.
The probe by police and financial regulators began after a broker’s trade logs revealed signs of anomalous, seemingly illogical trading activity. By tracing the IP addresses used to access the compromised accounts, investigators discovered that the logins originated from household devices and networks unconnected to the suspects — leading police to conclude that the perpetrators relied on pre-compromised or proxy devices to mask their tracks. Meanwhile, the Securities and Exchange Surveillance Commission identified dozens of accounts that appeared to have sold shares at artificially elevated prices and passed this intelligence to the police. Interrogations and searches eventually led investigators to the account of a precious-metals import–export firm through which critical transactions had been routed.
According to the prosecution’s version of events, preparations began in early March: the attackers obtained victims’ usernames and passwords — likely through phishing — and quietly liquidated their portfolios. They then deposited 30 million yen (~$192,800) into one of the hijacked accounts to bolster the scale of the forthcoming buy orders, and through L&H, a company owned by one of the suspects, generated artificial demand for the stock. On 17 March, they issued a large market order from the corporate account, followed by a series of trades designed to sustain upward pressure, while nine compromised accounts simultaneously purchased the same shares at inflated prices. Authorities classify such synchronized activity as matched orders, a classic tactic for price manipulation. The entire operation lasted roughly two hours.
Shares of the illiquid company chosen for the scheme surged from 84 yen (~$0.50) to 110 yen (~$0.70) in a single day — enabling the perpetrators to unload 700,000 pre-acquired shares for a profit of about 8.6 million yen (~$55,300). The victims, by contrast, suffered combined losses of roughly 11 million yen (~$70,700), while total manipulated trading volume exceeded 2.6 million shares. Police note that between December 2024 and October 2025, they received over 3,500 reports of brokerage-account compromises, and several victims confirmed they had indeed fallen prey to phishing attempts.
Investigators are also examining whether the operation forms part of a broader network: in addition to the identified case, traces of similar suspicious trades appear across transactions involving more than a hundred other companies. The suspect entrepreneur’s accounts also received unusually large transfers from other financial institutions during the same period. Parallel inquiries are analyzing transactional histories of potentially related accounts and reviewing electronic devices seized from the suspects.
The name of the company whose shares were manipulated in March has not been disclosed, though market observers have pointed to securities that exhibited an unusually sharp spike in volume on the relevant day — followed by repeated bursts of liquidity in subsequent sessions. On social media, users openly speculate that at least some of these anomalies may be tied to the same fraud group, though no official confirmation has yet been issued.