Original author: Research firm Kaiko
Original translation: Felix, PANews
On October 9, three market makers (ZM Quant, CLS Global and MyTrade) and some of their employees were charged for conspiracy to conduct false trading on behalf of NexFundAI tokens and crypto entities. In total, 18 individuals and entities face charges based on evidence provided by the FBI.
This article will delve into the on-chain data of the NexFundAI token to identify false trading patterns that can be extended to other tokens and question the liquidity of certain tokens. In addition, this article will explore other false trading strategies in DeFi, how to detect illegal activities on centralized platforms, and finally study price manipulation in the Korean market.
Identifying fake transactions in FBI token data
NexFundAI is a token issued by a company established by the FBI in May 2024 to expose market manipulation in the crypto markets. The accused company engaged in algorithmic wash trading, pump and dump schemes, and other manipulative strategies on behalf of its clients, often on exchanges such as Uniswap. These practices targeted newly issued or small-cap tokens to create the illusion of an active market, attract real investors, and increase token prices and popularity.
The FBI investigation was met with confessions from those involved, who clearly articulated their processes and intentions. Some even confirmed, “This is how we always make markets on Uniswap.”
To conduct data exploration on the FBI’s fake token NexFundAI, this article will examine the on-chain transfers of the tokens. This data provides complete information on every wallet and smart contract address that holds these tokens from issuance to date.
The data shows that token issuers fund a market maker’s wallet with tokens, which then redistributes the funds to dozens of wallets, identified by clusters highlighted in dark blue.
These funds were then used for wash trading in the token’s only secondary market, created by the issuer on Uniswap, identified in the center of the chart as the convergence point of nearly all wallets that received and/or transferred this token between May and September 2024.
The findings further corroborate the FBI’s investigation into the alleged company using multiple bots and hundreds of wallets to conduct fake transactions.
To refine the analysis and confirm the fraudulent nature of transfers from certain wallets (particularly those in the cluster), we determined the date of the first transfer received by each wallet and looked at the entire chain, not just NexFundAI token transfers. The data showed that 148 of the 485 wallets (28%) first received funds on the same block as at least 5 other wallets in the sample.
Addresses trading such an unknown token are naturally unlikely to show such a pattern. Therefore, at least these 138 addresses are likely related to trading algorithms and may be used for wash trading.
To further confirm wash trading involving this token, we examined market data for the only secondary market this token exists on. By aggregating the daily volume on this Uniswap market and comparing the buy and sell volumes, we found a striking symmetry between the two. This symmetry suggests that market makers are offsetting the total amount of all wallets engaging in wash trading on this market every day.
By observing individual transactions and coloring them according to the wallet address, we found that some addresses performed exactly the same single transaction (same amount, same time point) in a month of trading activity. This indicates that these addresses are related and there is a fake trading strategy.
Further investigation using Kaiko’s wallet data solution revealed that both addresses, despite never interacting on-chain, were funded with WETH tokens by the same wallet address 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This wallet itself was funded by a smart contract from Railgun. According to the Railgun website, “Railgun is a smart contract for professional traders and DeFi users that adds privacy to crypto transactions.” These findings suggest that the wallet address is hiding something secretive, such as market manipulation or worse.
DeFi fraud is not limited to NexFundAI
Manipulative behavior in DeFi is not limited to the FBI investigation. Data shows that many of the more than 200,000 assets on Ethereum DEXs lack utility and are controlled by individuals.
Some token issuers found on Ethereum are creating short-term liquidity pools on Uniswap. By controlling the liquidity of the pools and performing wash trades with multiple wallets, the pools are made more attractive to regular investors, accumulating ETH, and dumping their tokens. As demonstrated, 22x the initial ETH investment was generated in about 10 days. This analysis reveals widespread fraud by token issuers that extends beyond the FBI’s NexFundAI investigation.
Data Schema: GIGA 2.0 Token Example
A user (e.g. 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and originates) the entire supply of new tokens from an address (e.g. 0x 000).
The user immediately (within a day) transfers the tokens and some ETH to create a new Uniswap V2 pool. It owns all the liquidity and receives UNI-V2 tokens representing its contribution.
After an average of 10 days, users withdraw all liquidity, destroy their UNI-V2 tokens, and collect the additional ETH earned from the pool's transaction fees.
When examining the on-chain data for these four tokens, the exact same pattern is observed, proving that there is an orchestrated manipulation through an automated and repetitive scheme with the sole purpose of profit.
Market manipulation is not unique to DeFi
While the FBI’s approach was effective in uncovering these practices, market abuse is not new to crypto, nor is it unique to DeFi. In 2019, the CEO of market maker Gotbit publicly discussed its unethical business of helping crypto projects “masquerade” and exploit the incentives of smaller exchanges to manipulate on their platforms. The Gotbit CEO and two directors were also charged in a similar scheme involving multiple cryptocurrencies.
However, it is more difficult to detect such manipulation on centralized exchanges. These exchanges only display market-level order and transaction data, making it difficult to identify fake trading. However, this can be aided by comparing trading patterns and market indicators across exchanges. For example, if the trading volume greatly exceeds the liquidity of the asset and exchange (1% market depth), it may be due to wash trading. Generally, tokens like meme coins, privacy coins, and low-market-cap altcoins often show abnormally high volume-to-depth ratios.
It is important to note that the volume-to-liquidity ratio is not a perfect indicator, as volumes can be heavily influenced by exchange initiatives designed to increase trading volume on an exchange, such as zero-commission campaigns.
You can check cross-exchange correlation of trading volume. For an asset, trading volume trends tend to be correlated across exchanges over the long term. Consistent, monotonous volume, periods of zero volume, or differences between exchanges can all be signs of unusual trading activity.
For example, when studying PEPE, which has a high volume-to-depth ratio on certain exchanges, it was noticed that there was a big difference in volume trends between an anonymous exchange and other platforms in 2024. The PEPE volume on this exchange remained high and even increased in July, while PEPE volumes on most other exchanges decreased.
More detailed trading data shows that algorithmic traders are active in the PEPE-USDT market on the exchange. On July 3, there were 4,200 buy and sell orders for 1 million PEPE in a 24-hour period.
Similar patterns were seen on other trading days in July for the same trading pairs, confirming automated trading activity. For example, between July 9 and 12, more than 5,900 buy and sell trades of 2 million PEPE were executed.
Some signs point to possible wash trading. These signs include high volume-to-depth ratios, unusual weekly trading patterns, and repeated orders of fixed size and rapid execution. In wash trading, an entity places buy and sell orders simultaneously to artificially increase volume and make the market appear more liquid.
The line between market manipulation and inefficiency is blurry
Market manipulation in crypto markets is sometimes mistaken for arbitrage, where traders profit from market inefficiencies.
One example is the “Fishing Net Pumping” in the South Korean market. Traders took advantage of temporary pauses in deposits and withdrawals to artificially increase asset prices and profit. One notable example was the suspension of trading of CRV tokens on several South Korean exchanges following a hack in 2023.
When an exchange suspended deposits and withdrawals of CRV tokens, the price initially surged due to heavy buying. However, it quickly fell as selling began. During the suspension, there were several brief price spikes due to buying, but they were always followed by selling. Overall, there were more selling than buying.
Once the pause ends, prices can fall quickly as traders can easily buy and sell between exchanges to make a profit. Due to limited liquidity, these pauses often attract retail traders and speculators who expect prices to rise.
in conclusion
Research into how to identify market manipulation in crypto markets is still in its early stages. However, combining data and evidence from past investigations can help regulators, exchanges, and investors better address this issue in the future. In DeFi, the transparency of blockchain data provides a unique opportunity to detect wash trading of all tokens and gradually improve market integrity.
On centralized exchanges, market data can highlight new market abuses and gradually align the incentives of some exchanges with the public interest. As the crypto industry grows, leveraging all available data can help reduce harmful practices and create a fairer trading environment.
