Sounds very clearly that JPMC was defrauded, and at the same time did a very poor job of due diligence in a 9 figure acquisition. How did a financial audit not uncover the dramatic mismatch in actual vs. purported activity? How does a transaction value of $41 per user (x 4.25M users) not translate to an auditable revenue stream? This doesn't look good on either party.
Bottom line it's human to trust. It will always be very hard to uncover deceit when it's part of your business to make sure it continues and work hard to cover it up. Looks to me like the auditors never had a chance.
I'm surprised that the founder didn't just grab the money and moved to a country where there's no extradition. Last I read she was still claiming that the business was 100% legitimate.