Original article by: Dessislava Aubert and Anastasia Melachrinos
Original translation: Block unicorn
On October 9, 2024, three market makers — ZM Quant, CLS Global, and MyTrade — and their employees were charged with wash trading and conspiracy on behalf of the cryptocurrency company and its token, NexFundAI. A total of 18 individuals and entities face charges based on evidence collected by the Federal Bureau of Investigation (FBI).
In this deep dive, we will analyze on-chain data of the NexFundAI cryptocurrency to identify wash trading patterns that can be extended to other cryptocurrencies and question the liquidity of certain tokens. In addition, we will explore other wash trading strategies in DeFi and how to identify illegal activities on centralized platforms.
Finally, we examine price manipulation in the Korean market, which blurs the line between market efficiency and manipulation.
FBI identifies wash trading in token data
NexFundAI is a token issued in May 2024 by a company created by the FBI to expose market manipulation in the crypto market. The accused company engaged in algorithmic wash trading, pump and dump and other manipulative practices on behalf of clients, often on DeFi exchanges such as Uniswap. These practices targeted newly issued or small-cap tokens, creating the illusion of an active market to attract real investors, ultimately driving up token prices and increasing their popularity.
The FBI investigation yielded clear confessions, with those involved describing their steps and intentions in great detail. Some even explicitly stated, “This is how we make markets on Uniswap.” However, this case not only provides verbal evidence, but also shows the true face of wash trading in DeFi through data, which we will analyze in depth below.
To begin our data exploration of the FBI’s fake token NexFundAI (Kaiko: NEXF), we will first examine the token’s on-chain transfer data. This data provides a complete path from the token’s issuance, including all wallets and smart contract addresses holding these tokens.
The data shows that token issuers transferred token funds to a market maker wallet, which then distributed the funds to dozens of other wallets, which are identified by dark blue clusters in the chart.
These funds were then used to conduct wash trades on the only secondary market created by the issuer, Uniswap, which is located in the center of the chart and is the intersection point of almost all wallets that received and/or transferred the token (between May and September 2024).
The findings reinforce what the FBI uncovered through undercover “staging” operations that allegedly involved companies using multiple bots and hundreds of wallets to conduct wash trading without raising suspicion among investors trying to take advantage of an early opportunity.
To refine our analysis and confirm that some wallets’ transfers were fraudulent, especially those within the cluster, we recorded the date each wallet received its first transfer, looking at the entire chain rather than just NexFundAI token transfers. The data showed that 148 of the 485 wallets in our sample (or 28%) first received funds in the same block as at least 5 other wallets.
For such a relatively unknown token, such a trading pattern is almost impossible. Therefore, it is reasonable to speculate that at least these 138 addresses are related to the trading algorithm and may be used for wash trading.
To further confirm wash trading involving this token, we analyzed market data from the only secondary market it exists on. By aggregating daily trading volume on the Uniswap market and comparing buy and sell volumes, we found a surprising symmetry between the two. This symmetry suggests that market maker firms are hedging the total amount between all wallets involved in wash trading on this market every day.
Drilling down to the single transaction level and coloring transactions by wallet address, we also found that some addresses executed exactly the same single transaction (same amount and timestamp) in a month of trading activity, indicating that these addresses used a wash trading strategy, which also implies that these addresses are related to each other.
Further investigation showed that by using Kaiko’s Wallet Data solution, we found that both addresses, despite never interacting directly on-chain, were funded with WETH from the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. The wallet itself was funded through a smart contract from Railgun. According to the Railgun website, “RAILGUN is a smart contract for professional traders and DeFi users that aims to add privacy to crypto transactions.” These findings suggest that these wallet addresses may have some behavior that needs to be hidden, such as market manipulation or even worse.
DeFi fraud surpasses NexFundAI
Manipulative behavior in DeFi is not limited to FBI investigations. Our data shows that many of the more than 200,000 assets listed on Ethereum decentralized exchanges lack real-world utility and are controlled by a single individual.
Some issuers of tokens on Ethereum set up short-term liquidity pools on Uniswap. By controlling the liquidity within the pool and using multiple wallets for wash trading, they enhance the attractiveness of the pool and attract ordinary investors to enter the market, thereby accumulating ETH and selling their tokens. According to Kaiko's Wallet Data, an analysis of four cryptocurrencies shows that this operation can achieve a 22-fold return on the initial ETH investment in about 10 days. This analysis reveals widespread fraud among token issuers, which is beyond the scope of the FBI's investigation into NexFundAI.
Data model: Taking GIGA2.0 token as an example
A user (e.g. 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and initiates) the entire supply of a new token from an address (e.g. 0x000).
The user immediately (within the same day) transferred these tokens and some ETH to create a new Uniswap V2 liquidity pool. Since all liquidity was contributed by the user, he received UNI-V2 tokens representing his contribution.
On average, after 10 days, the user withdraws all liquidity, destroys UNI-V2 tokens, and withdraws the additional ETH earnings from transaction fees.
When analyzing on-chain data for these four tokens, we find that the exact same pattern repeats, indicating manipulation through automated and repetitive actions with the sole purpose of profit.
Market manipulation is not limited to DeFi
While the FBI investigation was effective in exposing these practices, market abuse is not unique to crypto or DeFi. In 2019, Gotbit’s CEO publicly spoke about his unethical business of helping crypto projects “fake success” by taking advantage of small exchanges’ acquiescence to these practices. Gotbit’s CEO and two of its directors were also charged in this case for similar manipulation of multiple cryptocurrencies.
However, detecting such manipulation is more difficult on centralized exchanges. These exchanges only display market-level order books and transaction data, making it difficult to accurately identify false transactions. Still, comparing trading patterns and market indicators across exchanges can help identify issues. For example, if trading volume significantly exceeds liquidity (1% market depth), it may be related to brush trading.
Data shows that HTX and Poloniex have the most assets with a volume-liquidity ratio of more than 100 times. Usually meme coins, privacy coins, and small-cap altcoins show abnormally high volume-depth ratios.
It is important to note that the trading volume-liquidity ratio is not a perfect indicator, as trading volume may be significantly increased due to promotional activities of certain exchanges (such as zero-fee campaigns). To determine false trading volume with greater confidence, we can examine volume correlations across exchanges. Usually, the trading volume trends of an asset on different exchanges are correlated and consistent over the long term. Long periods of monotonous trading volume, long periods of no trading, or significant differences between exchanges may indicate unusual trading activity.
For example, when we looked at the PEPE token on certain exchanges, we saw significant differences in volume trends between HTX and other platforms in 2024. On HTX, PEPE trading volumes remained high or even increased during July, while on most other exchanges volumes declined.
Further analysis of trading data shows that algorithmic trading is active in the PEPE-USDT market on HTX. On July 3, there were 4,200 buy and sell orders for 1M PEPE, an average of about 180 orders per hour. This trading pattern is in stark contrast to Kraken's trading during the same period, which was more organic and retail-driven, with irregular trading sizes and timing.
A similar pattern was seen on other days in July. For example, between July 9 and 12, more than 5,900 buy and sell trades of 2M PEPE were executed.
There are signs that automated wash trading may be occurring, including high volume-to-depth ratios, unusual weekly trading patterns, and fixed sizes and rapid execution of repeated orders. In wash trading, buy and sell orders are placed simultaneously by the same entity to artificially inflate trading volume and make the market appear more liquid.
The fine line between market manipulation and efficiency imbalance
Market manipulation in crypto markets is sometimes mistaken for arbitrage, which is the act of taking advantage of market efficiency imbalances to make profits.
For example, the phenomenon of "casting a net to catch fish" is common in the Korean market (after attracting retail investors to enter the market by pulling the price, the funds in the pool are emptied and run away). Traders take advantage of the temporary suspension of deposits and withdrawals to artificially raise asset prices and profit from it. A typical case occurred in 2023, when Curve's native token (CRV) was suspended from trading on several Korean exchanges due to hacker attacks.
The chart shows that when Bithumb suspended deposits and withdrawals of CRV tokens, a large number of buy orders drove the price up sharply, but then quickly fell back as the sell-off began. During the suspension, many short-term price increases caused by buying were followed by sell-offs. Overall, the sell-off volume was significantly higher than the buy-in volume.
Once the suspension ended, prices fell rapidly as traders could easily buy and sell between exchanges to arbitrage profits. Such suspensions often attract retail traders and speculators who expect prices to rise due to restricted liquidity.
in conclusion
Identifying market manipulation in crypto markets is still in its early stages. However, combining data and evidence from past investigations can help regulators, exchanges, and investors better respond to future market manipulation issues. In the DeFi space, the transparency of blockchain data provides a unique opportunity to detect wash trading of various tokens, thereby gradually improving market integrity. In centralized exchanges, market data can reveal new market abuse issues and gradually align the interests of some exchanges with the public interest. As the crypto industry develops, leveraging all available data can help reduce bad behavior and create a fairer trading environment.
Original link
Welcome to join the BlockBeats official community:
Telegram subscription group: https://t.me/theblockbeats
Telegram chat group: https://t.me/BlockBeats_App
Official Twitter account: https://twitter.com/BlockBeatsAsia
