The operation is simple enough for a single scammer to be behind the hundreds of fake tokens, according to the investigation’s author.