You may be focusing on the wrong question in this scenario, although the aspect of self-preservation, or worse, being made a possible scapegoat, is completely understandable.
To answer the original question: The devs can be held responsible if employees in positions of authority have the ability to modify records or cast others in a questionable manner "after the fact". If you suspect fraudulent activities may be happening, you may wish to:
1) Create and maintain a timeline or order of events as they occur.
2) Maintain records, preferably written, of whatever activity is taking place that you feel may be fraudulent.
3) If the startup has an HR department (or person), consider reaching out to them or reviewing whistleblower policies.
4) Consider quitting, even if this might occur before your vesting cliff.
Fraud is a strong accusation. Without evidence, this would have serious and negative repercussions that may not turn out well for you. You would need to tread even more carefully if you are not a well-connected or well-regarded developer to counter the presumably powerful or better-connected founders or executives in the startup.
Also consider plausible deniability. If you only suspect, but don't really know, then as long as you have a paper trail, you may be tempted to invoke the "I honestly didn't know something like that was happening."
However, all of the above pales in comparison to the real questions you should be considering, which are a) how to quit as quickly as possible and b) whether or not to become a whistleblower.
You should consider well-regarded law firms and think about an attorney to confide in for a couple of hours.
EDIT: iends advice gets to the point more quickly. "Ask a lawyer."
