Original authors: Dessislava Aubert, Anastasia Melachrinos
Original Translation: Block unicorn
On October 9, 2024, three market makers—ZM Quant, CLS Global, and MyTrade—and their employees were charged with engaging in wash trading and conspiracy on behalf of the cryptocurrency company and its token NexFundAI. According to evidence collected by the FBI, a total of 18 individuals and entities face charges.
In this in-depth analysis, we will analyze the on-chain data of the NexFundAI cryptocurrency to identify wash trading patterns that may extend to other cryptocurrencies and question the liquidity of certain tokens. Additionally, we will explore other wash trading strategies in DeFi and how to identify illegal activities on centralized platforms.
Finally, we will also study price manipulation behaviors in the Korean market, which blur the lines between market efficiency and manipulation.
FBI identifies wash trading in token data
NexFundAI is a token issued in May 2024 by a company created by the FBI aimed at exposing market manipulation behaviors in the crypto market. The accused companies engaged in algorithmic wash trading, price manipulation, and other manipulative practices on behalf of clients, typically conducted on DeFi exchanges like Uniswap. These activities target newly issued or low-market-cap tokens, creating a false impression of an active market to attract real investors, ultimately inflating token prices and increasing their visibility.
The FBI investigation produced clear confessions, with those involved detailing their operational steps and intentions. Some even explicitly stated, 'This is how we market on Uniswap.' However, this case provides not only verbal evidence but also data that illustrates the true nature of wash trading in DeFi, which we will analyze in depth next.
To begin our data exploration of the FBI's false token NexFundAI (Kaiko code: NEXF), we will first examine the on-chain transfer data of the token. This data provides a complete path from the token's issuance, including all wallet and smart contract addresses holding these tokens.
Data shows that the token issuer transferred token funds into a market maker's wallet, which then allocated the funds to dozens of other wallets, identifiable in the chart by deep blue clusters.
Subsequently, these funds were used for wash trading on the only secondary market created by the issuer—Uniswap, located at the center of the chart, which is the intersection point of almost all wallets receiving and/or transferring that token (from May to September 2024).
These findings further corroborate the information revealed by the FBI through undercover 'sting' operations. The accused companies used multiple bots and hundreds of wallets to engage in wash trading without raising the suspicions of investors trying to seize early opportunities.
To refine our analysis and confirm the fraudulent nature of certain wallet transfers, especially those within the clusters, we recorded the dates of the first transfers received by each wallet, observing the entire on-chain data and not limited to NexFundAI token transfers. Data shows that among 485 wallets in the sample, 148 wallets (28%) received funds in blocks that matched at least 5 other wallets.
For tokens with low visibility, such trading patterns are almost impossible. Therefore, it is reasonable to speculate that at least these 138 addresses are related to trading algorithms that may be used for wash trading.
To further confirm the wash trading involving this token, we analyzed market data from its only existing secondary market. By aggregating daily trading volumes on the Uniswap market and comparing buy and sell volumes, we found surprising symmetry between the two. This symmetry suggests that market-making companies hedge the total amounts among all wallets participating in wash trading every day.
A closer look at individual transaction levels, along with color-coding transactions by wallet address, reveals that certain addresses executed identical individual transactions (same amount and timestamp) during a month of trading activity, indicating that these addresses employed wash trading strategies, suggesting interrelation among them.
Further investigation revealed that by using Kaiko's Wallet Data solution, we found that although these two addresses never interacted directly on-chain, they both received WETH funds from the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This wallet itself obtained funds through a smart contract of Railgun. According to Railgun's official information, 'RAILGUN is a smart contract for professional traders and DeFi users designed to add privacy protection to crypto trading.' These findings suggest that these wallet addresses may be involved in behaviors that need to be concealed, such as market manipulation or even more serious situations.
DeFi fraud surpasses NexFundAI
Manipulative behaviors in DeFi are not limited to the FBI's investigation. Our data shows that among over 200,000 assets on Ethereum decentralized exchanges, many lack practical use and are controlled by a single individual.
Some issuers of tokens on Ethereum establish short-term liquidity pools on Uniswap. By controlling the liquidity within the pool and using multiple wallets for wash trading, they enhance the pool's attractiveness, draw in ordinary investors, accumulate ETH, and then sell their tokens. According to Kaiko's Wallet Data analysis of four cryptocurrencies, this operation can yield a 22-fold return on the initial ETH investment in about 10 days. This analysis reveals widespread fraudulent behavior among token issuers that extends beyond the FBI's investigation into NexFundAI.
Data Patterns: Taking GIGA2.0 Token as an Example
A user (e.g., 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) received (and initiated) the entire supply of a new token from a certain address (e.g., 0x000).
The user immediately (within the same day) transfers these tokens along with some ETH to create a new Uniswap V2 liquidity pool. Since all liquidity is contributed by users, they receive UNI-V2 tokens representing their contribution.
On average, 10 days later, the user withdraws all liquidity, destroys the UNI-V2 tokens, and extracts additional ETH earnings from trading fees.
When analyzing the on-chain data of these four tokens, we found the exact same patterns repeatedly, indicating manipulation conducted through automation and repetitive operations, with the sole purpose of profit.
Market manipulation is not limited to DeFi
Although the FBI's investigation effectively exposed these behaviors, market abuse is not unique to cryptocurrencies or DeFi. In 2019, the CEO of Gotbit publicly discussed his unethical business of helping crypto projects 'disguise success', exploiting the tacit approval of these practices by small exchanges. The CEO of Gotbit and two of its directors were also charged in this case for manipulating various cryptocurrencies using similar tactics.
However, identifying such manipulation in centralized exchanges is more challenging. These exchanges only display market-level order books and trading data, making it difficult to accurately identify false trades. Nevertheless, comparing trading patterns and market indicators across exchanges still helps to uncover issues. For example, if trading volume significantly exceeds liquidity (1% market depth), it may be related to wash trading.
Data shows that assets with a trading volume-to-liquidity ratio exceeding 100 times are the most prevalent on HTX and Poloniex. Typically, meme coins, privacy coins, and low-market-cap altcoins exhibit abnormally high trading volume-to-depth ratios.
It is important to note that the trading volume-to-liquidity ratio is not a perfect indicator, as trading volumes may be significantly inflated due to promotional activities (such as zero-fee promotions) from certain exchanges. To more accurately assess false trading volumes, we can examine the correlation of trading volumes across exchanges. Generally, the trading volume trends of an asset across different exchanges are correlated and show long-term consistency. If the trading volume is monotonous for an extended period, experiences long periods without trading, or has significant discrepancies across different exchanges, it may indicate abnormal trading activity.
For example, when we look at the PEPE token on certain exchanges, we find significant differences in trading volume trends between HTX and other platforms in 2024. On HTX, the trading volume of PEPE remained high and even increased during July, while the trading volume on most other exchanges decreased.
Further analysis of trading data shows that algorithmic trading is active in the PEPE-USDT market on HTX. On July 3, there were 4,200 buy and sell orders of 1M PEPE, averaging about 180 orders per hour. This trading pattern sharply contrasts with the trading on Kraken during the same period, which appeared more natural and retail-driven, with irregular trading sizes and timings.
Similar patterns also appeared on other days in July. For instance, from July 9 to 12, more than 5,900 2M PEPE buy and sell transactions were executed.
Various signs indicate the possibility of automated wash trading, including a high trading volume-to-depth ratio, unusual weekly trading patterns, fixed sizes of repeated orders, and rapid execution. In wash trading, the same entity simultaneously places buy and sell orders to inflate trading volumes, making the market appear more liquid.
The subtle line between market manipulation and efficiency imbalance
Market manipulation in the crypto market is sometimes mistaken for arbitrage, which profits from market efficiency imbalances.
For example, the phenomenon of 'net fishing style manipulation' is common in the Korean market (after attracting retail investors by manipulating prices, the funds in the pool are emptied and the manipulators run away). Traders exploit temporary pauses in deposits and withdrawals to artificially inflate asset prices for profit. A typical case occurred in 2023 when the native token of Curve (CRV) was suspended from trading on several Korean exchanges due to a hack.
The chart shows that when Bithumb suspended deposits and withdrawals of CRV tokens, a large number of buy orders drove the price up significantly, but it quickly fell back as selling began. During the suspension, multiple short-lived price increases caused by buying were immediately followed by sell-offs. Overall, the sell-off volume was significantly higher than the buy volume.
Once the suspension ends, prices quickly drop as traders can easily arbitrage between exchanges. Such suspensions typically attract retail traders and speculators who anticipate that prices will rise due to limited liquidity.
Conclusion
Identifying market manipulation in the crypto market is still in its early stages. However, combining data and evidence from past investigations helps regulators, exchanges, and investors better address future market manipulation issues. In the DeFi space, the transparency of blockchain data provides a unique opportunity to detect wash trading of various tokens, gradually improving market integrity. In centralized exchanges, market data can reveal new market abuse issues and gradually align the interests of certain exchanges with the public interest. As the crypto industry develops, leveraging all available data helps reduce misconduct and create a fairer trading environment.
Original link
