Federal Investigators Focus on Ian Macalinao's Elaborate Solana DeFi Scheme

Prosecutors from the U.S. Department of Justice are examining the activities surrounding Ian Macalinao and his brother Dylan, the architects behind several interconnected Solana-based financial projects, according to sources familiar with the probe. The examination centers on how the brothers orchestrated a complex network of schemes to artificially inflate key metrics within Solana’s DeFi ecosystem during the market’s explosive 2021 expansion.

Earlier investigations by CoinDesk revealed that Ian Macalinao and Dylan engineered an intricate operation involving at least 11 different anonymous personas to construct a series of overlapping financial protocols. By systematically moving assets between these facades, they achieved what’s commonly known as TVL inflation—counting the same cryptocurrency multiple times as it cycled through their ecosystem. This tactic became increasingly common as developers competed to showcase impressive growth metrics during the bull market surge.

The TVL Inflation Strategy Behind Saber Labs

Ian Macalinao’s mastermind behind the scheme was explicit about the intent. In an unpublished blog post acquired by CoinDesk, he outlined his optimization methodology: “The metric to optimize for in Summer 2021 was [total value locked (TVL)],” he wrote. “TVL can only count if protocols are built separately, so I devised a scheme to maximize Solana’s TVL: I would build protocols that stack on top of each other, such that a dollar could be counted several times.”

This strategy went beyond simple metric manipulation. By artificially boosting Solana’s TVL by billions of dollars, Macalinao and his collaborators created the illusion of a thriving ecosystem that attracted both developers and investors. The manufactured legitimacy of growth figures rippled through the industry, influencing market perception and potentially contributing to SOL’s price movements during the period.

Cascading Projects and Hidden Identities

The investigation focuses on multiple Solana projects controlled through these pseudonymous accounts. Ian Macalinao secretly built the foundational code for Sunny Aggregator, a yield-farming protocol, while also creating Cashio, a stablecoin project that later suffered a catastrophic hack in early 2022, resulting in millions in losses. The brothers justified their use of fake personas as a necessity: “If an ecosystem is all built by a few people, it does not look as authentic,” Macalinao explained. “I wanted to make it look like a lot of people were building on our protocol rather than ship 20+ disjoint programs as one person.”

This approach represented a fundamental deception of the DeFi community, which traditionally values decentralization and distributed development. By manufacturing false evidence of widespread developer participation, the Macalinao operation subverted core principles of the ecosystem they were building within.

Market Impact and Industry Response

The exposure of these practices triggered significant ripple effects across the DeFi sector. Data analytics platform DefiLlama restructured how it calculates and displays TVL following the revelations, implementing safeguards to prevent double-counting. The Macalinao brothers subsequently abandoned plans to migrate Saber to the Aptos blockchain and exited their crypto venture capital firm, Protagonist VC.

Additionally, they transferred ownership of certain pseudonymously-created projects to Marinade, a competing Solana-based DeFi protocol, appearing to distance themselves from direct control. The broader incident sparked critical conversations about measurement integrity in decentralized finance and exposed vulnerabilities in how the industry validates growth claims.

Current Status of the Ecosystem

While Saber Labs continues nominal operations as an exchange platform, its vitality remains questionable. Recent data indicated $4.4 million in 24-hour trading volume, though this figure predates the scandal by years. As of February 2026, SOL trades at $88.16, reflecting Solana’s ongoing market presence despite historical controversies surrounding ecosystem governance.

The projects attached to Ian Macalinao’s original vision tell a starkly different story. Sunny Aggregator and Cashio have largely become abandoned networks, with their Discord communities filled with frustrated users demanding accountability from developers who have largely vanished. The tokens issued by these projects have stagnated, retaining minimal trading activity or community engagement.

Separately, unrelated pressures have beset other crypto lending platforms. Blockfills, a Chicago-based crypto lender that processed over $60 billion in 2025 trading volume, recently experienced senior leadership changes when co-founder Nicholas Hammer stepped down as CEO. Some clients faced liquidity constraints when the platform restricted deposit and withdrawal capabilities in February, circumstances attributed to broader market stress and ongoing strategic reviews.

Neither Ian Macalinao, Dylan Macalinao, nor the Justice Department responded to requests for detailed commentary on the investigation’s scope or timeline.