On 30 July 2026 the owner of Paradigm Peptides was sentenced to 70 months in federal prison, having admitted the company forged laboratory certificates while advertising 99% purity and third-party testing to 54,000 customers. The case establishes something the industry usually only speculates about: a certificate on a vendor's own website is a document the vendor controls, and it can be manufactured. The checks that survive this failure mode are the ones that do not route through the vendor at all. Resolve the certificate on the issuing lab's server, match the lot number on your vial to the lot on the record, and check the vendor name against the FDA Warning Letter database.
A peptide seller advertised 99% purity, third-party testing, US manufacturing and research-use-only status. Every one of those was false, the lab certificates were forged, and on 30 July 2026 he was sentenced to 70 months in federal prison.
Matthew Kawa, owner of Paradigm Peptides, admitted in his guilty plea that the company forged laboratory certificates. Prosecutors established that products were imported from China and India rather than made in the company's own labs, that they were not tested before sale, and that six compounds sold as SARMs all contained testosterone when the government tested them. The business ran from 2019 to 2024, reached roughly 54,000 customers across all 50 states and more than 80 countries, and continued after FDA warning letters in 2020 and 2022.
The interesting question is not what Paradigm did. It is what any of the usual buyer checks would have caught, and the answer is uncomfortable: most of them, nothing.
What does a forged COA actually look like?
It looks correct. That is the whole point of forging one.
A certificate of analysis is a PDF. It carries a laboratory letterhead, a report number, a compound name, a purity figure, a chromatogram image, a date, and often a signature. Every one of those elements is an image or a string in a document. None of them is cryptographically bound to anything. A vendor producing a convincing certificate needs a real certificate to copy, an image editor, and a willingness to do it.
So the certificate itself carries no evidentiary weight. What carries weight is whether a record exists somewhere the vendor does not control.
| What you are looking at | What it proves |
|---|---|
| "99% purity" on a product page | nothing |
| "Third-party tested" badge | nothing |
| A COA PDF hosted on the vendor's site | the vendor produced a file |
| A COA PDF emailed by the vendor | the vendor produced a file |
| A lab-hosted record returning matching fields | the test happened |
| That record's lot matching your vial's lot | your vial came from the tested batch |
The line falls between rows four and five, and it falls there because rows one through four all route through the seller.
Which checks survive a seller who is willing to forge?
Three, and they are ordered by how much they cost you.
One. Resolve the report number on the lab's own site. Take the identifier off the certificate and enter it yourself at the laboratory's verification page. Don't follow a "verify" link the vendor supplied, because a link is also something a vendor controls. If the lab returns a record whose compound, purity, measured content and date match your document, the test happened. If it returns nothing, you are holding a picture. Our COA verifier does this lookup against the issuing lab rather than the vendor, and the manual version of the same procedure is in how to verify a Janoshik COA.
Two. Match the lot number on the vial to the lot on the record. This is the check almost nobody does and it closes the gap a genuine certificate leaves open. A vendor can publish a completely real certificate for a batch that was tested, then ship you a different batch that was not. If the vial's lot and the certificate's lot do not match, the certificate is describing someone else's product.
Three. Search the vendor in the FDA Warning Letter database. It is public, free, and takes about a minute. Paradigm's letters from 2020 and 2022 were sitting in it while the company kept selling for another two years. This check costs nothing and would have flagged this specific case years before the shutdown.
Why "research use only" did not protect anyone
Paradigm carried the disclaimer that its products were for research use only. Kawa admitted in his plea that this was false and that he knew products were being sold for human consumption.
That admission is the load-bearing part of the whole case. The research-use label is what the entire gray market uses to explain why unapproved compounds can be sold to individuals. It did not function as a legal shield here, and prosecutors treated it as part of the misrepresentation rather than as a mitigating factor. A healthcare attorney quoted after the sentencing put the industry read plainly: this was actual prison time rather than a cease-and-desist.
The label also tells you nothing about what a vendor believes. Paradigm's customers were treated by the company as consumers, and the harm the court documented was consumer harm: chronic acne, suppressed natural testosterone requiring replacement therapy, cardiac problems, and psychiatric effects up to suicidal ideation. One customer was later diagnosed with steroid-induced psychosis after independent testing of a retained bottle showed testosterone.
Where fabricated testing sits among vendor failure modes
Forged certificates are one entry in a longer list, and they are among the hardest to catch from outside because the artefact you are handed looks exactly like a real one. Our vendor failure taxonomy covers the full set, and the two neighbours worth knowing here are the captive lab, where a real certificate comes from a laboratory the vendor effectively controls, and the stale certificate, where a genuine old test is used to vouch for new material.
The structural test that separates a credible laboratory from a captive or fictional one is breadth and honesty of output. A real multi-vendor lab serves many unrelated clients and publishes failures alongside passes. We apply that framework to Janoshik and to Kovera Labs, and it is the reason we mirror lab corpora rather than collecting vendor-supplied PDFs.
What this case does not prove
Two things, and stating them keeps the argument honest.
It does not show that most vendors forge certificates. Paradigm is one prosecuted business, and we have no basis for estimating how common the practice is. What the case establishes is that the practice exists and is commercially viable at scale for years, which is enough to make vendor-hosted certificates non-evidence regardless of frequency.
It also does not show that peptide products are inherently contaminated. The six compounds that tested as testosterone were sold as SARMs, a parallel product line. The peptide catalog carried the same forged-certificate practice, but the specific adulteration finding in the court record concerns the SARMs.
The short version
A certificate proves a test happened only if you can retrieve the record from the party that ran the test. Everything upstream of that, including the purity number, the badge, the PDF and the link, is content the seller wrote.
Three checks, in order: resolve the report number at the lab, match the lot on your vial to the lot on the record, and search the vendor in the FDA Warning Letter database. All three are free. Two of them would have flagged Paradigm Peptides years before a court did.
Sources
- US Attorney's Office, Northern District of Indiana - sentencing announcement, 30 July 2026 - primary source for sentences, customer counts, false claims and testing findings
- United States v. Matthew Kawa - DOJ case page
- CBS News - Judge sentences peptide vendor to nearly 6 years in prison - 30 July 2026
- FDA Warning Letters database
- Internal: Paradigm Peptides vendor profile, how to verify a Janoshik COA, how peptide vendors fail, FDA peptide enforcement 2024-2026
Frequently asked
Can a peptide COA be faked?
Yes, and it has been proven in federal court. Matthew Kawa of Paradigm Peptides admitted in his guilty plea that the company forged laboratory certificates. A PDF is an editable document, so a certificate hosted on a vendor's own site proves only that the vendor produced a file. What resists forgery is a record held on the issuing laboratory's server.
How do you tell if a certificate of analysis is real?
Take the report or test number from the certificate and look it up directly on the issuing laboratory's own site rather than following a link the vendor supplied. If the lab returns a record whose compound, purity, content and date match the document in front of you, it is real. If there is no record, or the fields disagree, the document is not evidence of anything.
What did Paradigm Peptides actually sell?
Products advertised as research peptides and SARMs, imported from China, India and elsewhere while marketed as manufactured in the company's own US laboratories. Government testing of six compounds sold as SARMs found all six contained testosterone, a Schedule III controlled substance, rather than the labelled compound.
Does a COA prove the vial I received is pure?
No. A certificate covers a specific batch tested on a specific date. A vendor can publish a genuine certificate and ship a different, untested batch under the same product name. The check that closes that gap is matching the lot number printed on your vial against the lot number on the certificate record.
Is "third-party tested" on a product page worth anything?
On its own, no. Paradigm advertised third-party testing and 99% purity while forging the certificates and not testing products at all. The phrase becomes meaningful only when it is attached to a specific lab, a specific report number, and a record on that lab's server that you can retrieve yourself.
How do I check if a peptide vendor has been warned by the FDA?
Search the vendor's company name and website domain in the FDA Warning Letters database, which is public and free. Paradigm's owner received letters in 2020 and 2022 and kept selling until 2024. The letters were sitting in that database the entire time.