Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesCopyBotsEarn
Analyze the hidden forces behind fake transactions and price manipulation, and how to identify manipulative behavior?

Analyze the hidden forces behind fake transactions and price manipulation, and how to identify manipulative behavior?

ChaincatcherChaincatcher2024/11/03 20:00
By:Block unicorn

Market manipulation is not limited to DeFi; it is more difficult to detect such manipulation in centralized exchanges, but comparing trading patterns and market indicators across exchanges can still help identify issues. For example, trading volume significantly exceeding liquidity may be related to wash trading.

Original authors: Dessislava Aubert, Anastasia Melachrinos

Original translation: Block unicorn

On October 9, 2024, three market makers—ZM Quant, CLS Global, and MyTrade—and their employees were accused of engaging in wash trading and collusion on behalf of the cryptocurrency company and its token NexFundAI. According to evidence collected by the FBI, a total of 18 individuals and entities face charges.

In this in-depth analysis, we will analyze the on-chain data of the NexFundAI cryptocurrency to identify wash trading patterns that may extend to other cryptocurrencies and question the liquidity of certain tokens. Additionally, we will explore other wash trading strategies in DeFi and how to identify illegal activities on centralized platforms.

Finally, we will examine price manipulation behaviors in the South Korean market, which blur the lines between market efficiency and manipulation.

FBI Identifies Wash Trading in Token Data

NexFundAI is a token issued in May 2024 by a company created by the FBI, aimed at exposing market manipulation in the crypto market. The accused companies engaged in algorithmic wash trading and other manipulative tactics on behalf of clients, typically on DeFi exchanges like Uniswap. These actions targeted newly issued or low-market-cap tokens, creating a false impression of an active market to attract real investors, ultimately driving up token prices and increasing their visibility.

The FBI's investigation yielded clear confessions, with involved parties detailing their operational steps and intentions. Some even explicitly stated, "This is how we market make on Uniswap." However, this case not only provides verbal evidence but also showcases the true nature of wash trading in DeFi through data, which we will analyze in depth.

To begin our exploration of the FBI's fraudulent token NexFundAI (Kaiko code: NEXF), we will first examine the token's on-chain transfer data. This data provides a complete path from the token's issuance, including all wallet and smart contract addresses holding these tokens.

The data shows that the token issuer transferred token funds into a market maker wallet, which then allocated the funds to dozens of other wallets, identified in the chart by deep blue clusters.

Subsequently, these funds were used for wash trading on the only secondary market created by the issuer—Uniswap—located at the center of the chart, which is the intersection point for almost all wallets receiving and/or transferring the token (from May to September 2024).

These findings further corroborate the information revealed by the FBI through undercover "sting" operations. The accused companies used multiple bots and hundreds of wallets for wash trading, raising no suspicion from investors trying to seize early opportunities.

To refine our analysis and confirm that certain wallet transfers were fraudulent, particularly those within the clusters, we recorded the date each wallet received its first transfer, observing the entire on-chain data and not just limited to NexFundAI token transfers. The data shows that among the 485 wallets in the sample, 148 wallets (or 28%) received funds in the same block as at least 5 other wallets.

For a token with such low visibility, the occurrence of this trading pattern is almost impossible. Therefore, it is reasonable to speculate that at least these 138 addresses are related to trading algorithms and may be used for wash trading.

To further confirm the wash trading involving this token, we analyzed the market data from its only existing secondary market. By aggregating the daily trading volume on the Uniswap market and comparing buy and sell volumes, we found a surprising symmetry between the two. This symmetry indicates that the market maker company hedged the total amount across all wallets participating in wash trading daily.

Upon a deeper look at individual transactions and coloring the trades by wallet address, we also found that certain addresses executed identical single transactions (same amount and timestamp) during a month of trading activity, indicating that these addresses employed wash trading strategies, which also suggests that these addresses are interconnected.

Further investigation revealed that by using Kaiko's Wallet Data solution, we discovered that these two addresses, although never directly interacting on-chain, were both funded by the same wallet address providing WETH: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This wallet itself was funded through a smart contract from Railgun. According to information from Railgun's official site, "RAILGUN is a smart contract designed to provide privacy protection for crypto trading for professional traders and DeFi users." These findings suggest that these wallet addresses may be involved in activities that require concealment, such as market manipulation or even more serious situations.

DeFi Fraud Extends Beyond NexFundAI

Manipulative behaviors in DeFi are not limited to the FBI's investigation. Our data shows that among over 200,000 assets on Ethereum decentralized exchanges, many lack real utility and are controlled by a single individual.

Some issuers of tokens on Ethereum establish short-term liquidity pools on Uniswap. By controlling the liquidity within the pool and using multiple wallets for wash trading, they enhance the pool's attractiveness, drawing in ordinary investors, accumulating ETH, and dumping their tokens. According to Kaiko's Wallet Data analysis of four cryptocurrencies, this operation can achieve a 22-fold return on initial ETH investment in about 10 days. This analysis reveals widespread fraudulent behavior among token issuers, extending beyond the FBI's investigation of NexFundAI.

Data Pattern: Example of GIGA2.0 Token

A user (e.g., 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and initiates) the entire supply of a new token from a certain address (e.g., 0x000).

The user immediately (within the same day) transfers these tokens along with some ETH to create a new Uniswap V2 liquidity pool. Since all liquidity is contributed by the user, they receive UNI-V2 tokens representing their contribution.

On average, 10 days later, the user withdraws all liquidity, burns the UNI-V2 tokens, and extracts additional ETH earnings from transaction fees.

When analyzing the on-chain data of these four tokens, we found the exact same pattern repeating, indicating manipulation conducted through automation and repetitive actions, with the sole purpose of profit.

Market Manipulation Is Not Limited to DeFi

While the FBI's investigation effectively exposed these behaviors, market abuse is not unique to cryptocurrencies or DeFi. In 2019, the CEO of Gotbit publicly discussed his unethical business of helping crypto projects "fake success," exploiting the tacit approval of these practices by small exchanges. The CEO of Gotbit and two of its directors were also charged in this case for manipulating various cryptocurrencies using similar tactics.

However, detecting such manipulation in centralized exchanges is more challenging. These exchanges only display order books and trading data at the market level, making it difficult to accurately identify fake trades. Nevertheless, comparing trading patterns and market indicators across exchanges can still help uncover issues. For example, if trading volume significantly exceeds liquidity (1% market depth), it may be related to wash trading.

Data shows that assets on HTX and Poloniex with over 100 times the trading volume-to-liquidity ratio are the most common. Typically, meme coins, privacy coins, and low-market-cap altcoins exhibit abnormally high trading volume-to-depth ratios.

It is important to note that the trading volume-to-liquidity ratio is not a perfect indicator, as trading volume may significantly increase due to promotional activities (such as zero-fee promotions) from certain exchanges. To more reliably assess fake trading volume, we can examine the correlation of trading volume across exchanges. Generally, the trading volume trends of a certain asset across different exchanges are correlated and show consistency over time. If trading volume is monotonous for an extended period, shows long periods of inactivity, or exhibits significant discrepancies between different exchanges, it may indicate abnormal trading activity.

For example, when we look at the PEPE token on certain exchanges, we find significant differences in trading volume trends between HTX and other platforms in 2024. On HTX, PEPE trading volume remained high during July, even increasing, while trading volume on most other exchanges declined.

Further analysis of trading data shows that there was active algorithmic trading in the PEPE-USDT market on HTX. Within July 3, there were 4,200 buy and sell orders of 1M PEPE, averaging about 180 orders per hour. This trading pattern sharply contrasts with the trading on Kraken during the same period, which appeared more natural and retail-driven, with irregular trade sizes and timings.

Similar patterns also appeared on other days in July. For instance, from July 9 to 12, over 5,900 buy and sell transactions of 2M PEPE were executed.

Various signs suggest the possibility of automated wash trading behavior, including high trading volume-to-depth ratios, unusual weekly trading patterns, fixed sizes of repeated orders, and rapid execution. In wash trading, the same entity simultaneously places buy and sell orders to artificially inflate trading volume, making the market appear more liquid.

The Subtle Line Between Market Manipulation and Efficiency Imbalance

Market manipulation in the crypto market is sometimes mistaken for arbitrage, which profits from market inefficiencies.

For example, the phenomenon of "net fishing-style pump" is common in the South Korean market (where traders attract retail investors into the market and then empty the pool). Traders profit by artificially inflating asset prices during temporary pauses in deposits and withdrawals. A typical case occurred in 2023 when the native token of Curve (CRV) was suspended from trading on several South Korean exchanges due to a hacking incident.

The chart shows that when Bithumb suspended deposits and withdrawals for the CRV token, a large number of buy orders pushed the price up significantly, but it quickly fell back as selling began. During the suspension, multiple brief price increases due to buying were immediately followed by sell-offs. Overall, the sell volume was significantly higher than the buy volume.

Once the suspension ended, the price quickly dropped as traders could easily buy and sell for arbitrage between exchanges. Such suspensions typically attract retail traders and speculators who anticipate that prices will rise due to limited liquidity.

Conclusion

Identifying market manipulation in the crypto market is still in its early stages. However, combining past investigation data and evidence can help regulators, exchanges, and investors better address future market manipulation issues. In the DeFi space, the transparency of blockchain data provides a unique opportunity to detect wash trading across various tokens, gradually enhancing market integrity. In centralized exchanges, market data can reveal new market abuse issues and gradually align the interests of some exchanges with the public interest. As the crypto industry evolves, leveraging all available data will help reduce misconduct and create a fairer trading environment.

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Locked for new tokens.
APR up to 10%. Always on, always get airdrop.
Lock now!

You may also like

The newest pro-crypto faces on Capitol Hill

These Congressional winners have the crypto industry to thank

Blockworks2024/11/07 22:11

Chair Gensler’s anti-innovation crypto crusade must end

Crypto needs clarity, not crackdowns, from the SEC

Blockworks2024/11/07 21:11