Uncovering crypto market manipulation: Analyzing the hidden forces behind wash trading and price pumps

Original author: Dessislava Aubert, Anastasia Melachrinos

Original translation: Block unicorn

On October 9, 2024, three market makers - ZM Quant, CLS Global and MyTrade - and their employees were charged with wash trading and conspiracy on behalf of the cryptocurrency company and its token NexFundAI. Based on evidence collected by the Federal Bureau of Investigation (FBI), a total of 18 individuals and entities face charges.

In this in-depth analysis, we will analyze on-chain data of the NexFundAI cryptocurrency to identify wash trading patterns that can be extended to other cryptocurrencies and question the liquidity of certain tokens. In addition, we will explore other wash trading strategies in DeFi and how to identify illegal activities on centralized platforms.

Finally, we will also examine price pumping behaviors in the Korean market that blur the line between market efficiency and manipulation.

FBI Identifies Wash Trading in Token Data

NexFundAI is a token issued in May 2024 by a company created by the FBI to expose market manipulation in the crypto market. The accused companies engaged in algorithmic wash trading, pump and dump and other manipulative practices on behalf of their clients, often on DeFi exchanges such as Uniswap. These practices targeted newly issued or small-cap tokens, creating the illusion of an active market to attract real investors, ultimately driving up the price of the token and increasing its popularity.

The FBI investigation resulted in clear confessions, with those involved describing their steps and intentions in detail. Some even explicitly stated, "This is how we make markets on Uniswap." However, this case not only provides verbal evidence, but also shows the true face of wash trading in DeFi through data, which we will analyze in depth next.

To begin our data exploration of the FBI’s fake token NexFundAI (Kaiko: NEXF), we will first examine the token’s on-chain transfer data. This data provides a complete path from the token’s issuance, including all wallets and smart contract addresses holding these tokens.

The data shows that the token issuer transferred the token funds to a market maker wallet, which in turn distributed the funds to dozens of other wallets, which are identified in the chart by the dark blue cluster.

The funds were then used to conduct wash trades on the only secondary market created by the issuer, Uniswap, which is located in the center of the chart and is the intersection of almost all wallets that received and/or transferred the token (between May and September 2024).

These findings further support information revealed by the FBI through undercover "staging" operations. The accused companies used multiple bots and hundreds of wallets to conduct wash trades without attracting the suspicion of investors trying to seize early opportunities.

To refine our analysis and confirm that the transfers from certain wallets were fraudulent, especially those within the cluster, we recorded the date when each wallet received the first transfer, looking at the entire on-chain data rather than just NexFundAI token transfers. The data shows that 148 of the 485 wallets in the sample, or 28%, first received funds in the same block as at least 5 other wallets.

Such a trading pattern is unlikely for such a relatively unknown token. Therefore, it is reasonable to speculate that at least these 138 addresses are related to the trading algorithm and may be used for wash trading.

To further confirm wash trading involving this token, we analyzed market data from its only existing secondary market. By aggregating daily trading volume on the Uniswap market and comparing buy and sell volumes, we found a surprising symmetry between the two. This symmetry suggests that market maker firms hedge the total amount between all wallets participating in wash trading on this market every day.

After drilling down to the individual transaction level and coloring transactions by wallet address, we also found that some addresses executed the exact same single transaction (same amount and timestamp) in a month of trading activity, indicating that these addresses used wash trading strategies and also implying that these addresses are related to each other.

Further investigation showed that by using Kaiko’s Wallet Data solution, we found that both addresses, despite never interacting directly on-chain, were funded with WETH from the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. The wallet itself was funded through a smart contract from Railgun. According to the Railgun website, “RAILGUN is a smart contract for professional traders and DeFi users that aims to add privacy protection to crypto transactions.” These findings suggest that these wallet addresses may have some behavior that needs to be hidden, such as market manipulation or even worse.

DeFi Fraud Beyond NexFundAI

Manipulative behavior in DeFi is not limited to the FBI investigation. Our data shows that many of the more than 200,000 assets on Ethereum decentralized exchanges lack practical use and are controlled by a single individual.

Some issuers of tokens on Ethereum set up short-term liquidity pools on Uniswap. By controlling the liquidity within the pool and using multiple wallets for wash trading, they enhance the pool’s appeal and attract ordinary investors to enter, accumulate ETH, and sell their tokens. According to Kaiko’s Wallet Data, an analysis of four cryptocurrencies shows that this operation can achieve a 22x return on the initial ETH investment in about 10 days. This analysis reveals widespread fraud among token issuers, which goes beyond the scope of the FBI’s investigation of NexFundAI.

Data Pattern: Taking GIGA2.0 Token as an Example

A user (e.g. 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and activates) the entire supply of a new token from an address (e.g. 0x000).

The user immediately (within the same day) transfers these tokens and some ETH to create a new Uniswap V2 liquidity pool. Since all liquidity was contributed by the user, he received UNI-V2 tokens representing his contribution.

On average, after 10 days, the user would withdraw all liquidity, destroy the UNI-V2 tokens, and withdraw the additional ETH earned from trading fees.

When analyzing the on-chain data of these four tokens, we found that the exact same pattern repeated itself, indicating manipulation through automated and repetitive actions with the sole purpose of profit.

Market Manipulation Is Not Limited to DeFi

While the FBI investigation was effective in exposing these actions, market abuse is not unique to crypto or DeFi. In 2019, Gotbit’s CEO publicly talked about his unethical business of helping crypto projects “fake success”, taking advantage of small exchanges’ acquiescence to these practices. Gotbit's CEO and two of its directors were also charged in the case for similar manipulation of multiple cryptocurrencies.

However, it is more difficult to detect such manipulation on centralized exchanges. These exchanges only display order books and trading data at the market level, making it difficult to accurately identify fake trading. Nevertheless, comparing trading patterns and market indicators across exchanges can still help to detect problems. For example, if volume significantly exceeds liquidity (1% market depth), it may be related to wash trading.

The data shows that HTX and Poloniex have the most assets with more than 100x volume-to-liquidity ratios. Typically meme coins, privacy coins, and small-cap altcoins show abnormally high volume-to-depth ratios.

It is important to note that the volume-to-liquidity ratio is not a perfect indicator, as trading volume can be significantly increased by promotional activities on certain exchanges (such as zero-fee activities). To more confidently determine fake trading volume, we can check the correlation of trading volume between exchanges. Typically, the trading volume trends of an asset across different exchanges are correlated and consistent over time. Long periods of monotony, long periods of no trading, or significant differences between exchanges may indicate unusual trading activity.

For example, when we look at PEPE tokens on certain exchanges, we see significant differences in volume trends between HTX and other platforms in 2024. On HTX, PEPE volume remained high and even increased during July, while it declined on most other exchanges.

Further analysis of trading data shows active algorithmic trading in the PEPE-USDT market on HTX. On July 3, there were 4,200 buy and sell orders for 1M PEPE, an average of about 180 per hour. This trading pattern is in stark contrast to Kraken's trading during the same period, which was more organic and retail-driven, with irregular trade sizes and timing.

Similar patterns were seen on other days in July. For example, between July 9 and 12, more than 5,900 buy and sell trades of 2M PEPE were executed.

Signs point to possible automated wash trading, including high volume-to-depth ratios, unusual weekly trading patterns, fixed sizes of repeat orders, and fast execution. In wash trading, the same entity places buy and sell orders simultaneously to inflate volume and make the market appear more liquid.

The fine line between market manipulation and efficiency imbalance

Market manipulation in the crypto market is sometimes mistaken for arbitrage, which is the use of market efficiency imbalances to make profits.

For example, the phenomenon of "casting a net to catch fish" is common in the Korean market (after attracting retail investors to enter the market by pulling the market, the pool funds are emptied and run away). Traders take advantage of the temporary suspension of deposits and withdrawals to artificially raise asset prices and profit from it. A typical case occurred in 2023, when Curve's native token (CRV) was suspended from trading on several Korean exchanges due to hacker attacks.

The chart shows that when Bithumb suspended deposits and withdrawals of CRV tokens, a large number of buy orders pushed the price up sharply, but then quickly fell back as the sell-off began. During the pause, several brief price increases due to buying were followed by sell-offs. Overall, sell-offs were significantly higher than buy-in volumes.

Once the pause ended, prices fell rapidly as traders could easily buy and sell across exchanges to arbitrage. Such pauses often attract retail traders and speculators who expect prices to rise due to restricted liquidity.

Conclusion

Identifying market manipulation in crypto markets is still in its early stages. However, combining data and evidence from past investigations can help regulators, exchanges, and investors better respond to future market manipulation issues. In the DeFi space, the transparency of blockchain data provides a unique opportunity to detect wash trading of various tokens, thereby gradually improving market integrity. On centralized exchanges, market data can reveal new market abuse issues and gradually align the interests of some exchanges with the public interest. As the crypto industry develops, leveraging all available data can help reduce bad behavior and create a fairer trading environment.

Original link

欢迎加入律动 BlockBeats 官方社群：

Telegram 订阅群：https://t.me/theblockbeats

Telegram 交流群：https://t.me/BlockBeats_App

Twitter 官方账号：https://twitter.com/BlockBeatsAsia