Written by: Dessislava Aubert, Anastasia Melachrinos

Compiled by: Block Unicorn

On October 9, 2024, three market makers—ZM Quant, CLS Global, and MyTrade—and their employees were accused of conducting wash trading and collusion on behalf of the cryptocurrency company and its token NexFundAI. According to evidence collected by the FBI, a total of 18 individuals and entities faced charges.

In this in-depth analysis, we will analyze the on-chain data of NexFundAI cryptocurrency to identify wash trading patterns that could extend to other cryptocurrencies and question the liquidity of certain tokens. Additionally, we will explore other wash trading strategies in DeFi and how to identify illicit activities on centralized platforms.

Finally, we will also examine price-pumping behaviors in the Korean market, which blur the lines between market efficiency and manipulation.

FBI identifies wash trading in token data

NexFundAI is a token issued by a company created by the FBI in May 2024, aimed at exposing market manipulation in the crypto market. The accused companies engaged in algorithmic wash trading and manipulative practices such as price pumping and dumping, typically on DeFi exchanges like Uniswap. These activities target newly issued or low market cap tokens, creating a false impression of an active market to attract real investors, ultimately driving up the token's price and increasing its visibility.

The FBI's investigation yielded clear confessions, with involved individuals detailing their operational steps and intentions. Some even explicitly stated, 'This is how we market on Uniswap.' However, this case not only provides verbal evidence but also showcases the true nature of wash trading in DeFi through data, which we will analyze in depth next.

To begin our data exploration of the FBI's false token NexFundAI (Kaiko code: NEXF), we will first check the on-chain transfer data of the token. This data provides a complete path from the issuance of the token, including all wallet and smart contract addresses holding these tokens.

Data shows that the token issuer transferred token funds to a market maker wallet, which then allocated the funds to dozens of other wallets, identified in the chart by a deep blue cluster.

Subsequently, these funds were used for wash trading on the unique secondary market created by the issuer—Uniswap—located at the center of the chart, which serves as a junction for almost all wallets that receive and/or transfer the token (from May to September 2024).

These findings further corroborate the information revealed by the FBI through undercover 'sting' operations. The accused companies used multiple bots and hundreds of wallets for wash trading, which did not raise suspicion among investors trying to seize early opportunities.

To refine our analysis and confirm that certain wallet transfers are fraudulent, especially those within clusters, we recorded the date of the first transfer received by each wallet, observing the entire on-chain data and not just limited to NexFundAI token transfers. The data shows that among 485 wallets in the sample, 148 wallets (28%) received funds in the same block as at least five other wallets.

For a token with such low recognition, a trading pattern like this is almost impossible. Therefore, it is reasonable to speculate that at least these 138 addresses are related to trading algorithms, possibly used for wash trading.

To further confirm the wash trading involving this token, we analyzed the market data of its only existing secondary market. By aggregating daily trading volumes on the Uniswap market and comparing buy and sell volumes, we found a surprising symmetry between the two. This symmetry indicates that market-making firms hedge the total amounts daily across all wallets participating in wash trading in the market.

By taking a closer look at individual transaction levels and coloring transactions by wallet address, we also found that certain addresses executed identical single transactions (same amounts and timestamps) during a month of trading activity, indicating that these addresses employed wash trading strategies, which also suggests that these addresses are interconnected.

Further investigation indicates that by using Kaiko's Wallet Data solution, we discovered that these two addresses, despite never interacting directly on-chain, were both funded by the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This wallet itself obtained funds through a smart contract from Railgun. According to information on the Railgun official website, 'RAILGUN is a smart contract designed to enhance privacy in crypto trading for professional traders and DeFi users.' These findings suggest that these wallet addresses may be engaged in behaviors requiring concealment, such as market manipulation or even more serious situations.

DeFi fraud exceeds NexFundAI

Manipulative behavior in DeFi is not confined to the FBI's investigation. Our data shows that among more than 200,000 assets on Ethereum decentralized exchanges, many lack real utility and are controlled by a single entity.

Some issuers of tokens issued on Ethereum establish short-term liquidity pools on Uniswap. By controlling the liquidity within the pool and using multiple wallets for wash trading, they enhance the pool's attractiveness, drawing in ordinary investors, accumulating ETH, and then selling off their tokens. According to Kaiko's Wallet Data, an analysis of four cryptocurrencies indicates that this operation can yield a 22-fold return on the initial ETH investment in about 10 days. This analysis reveals widespread fraudulent behavior among token issuers, surpassing the FBI's investigation into NexFundAI.

Data Pattern: Taking GIGA2.0 Token as an Example

A user (for example, 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) received (and initiated) the entire supply of a new token from a certain address (such as 0x000).

Users immediately (within the same day) transferred these tokens and some ETH to create a new Uniswap V2 liquidity pool. Since all liquidity was contributed by users, they received UNI-V2 tokens representing their contribution.

On average, 10 days later, the user withdraws all liquidity, burns the UNI-V2 tokens, and extracts additional ETH earnings from trading fees.

When analyzing the on-chain data of these four tokens, we found the exact same patterns repeatedly, indicating manipulation conducted through automation and repetitive operations, with the sole purpose of making a profit.

Market manipulation is not limited to DeFi

Although the FBI's investigation effectively exposed these behaviors, market abuse is not unique to cryptocurrencies or DeFi. In 2019, the CEO of Gotbit publicly discussed his unethical business of helping crypto projects 'disguise their success,' leveraging the tacit approval of these practices by small exchanges. The CEO of Gotbit and two of its directors were also charged in this case for manipulating various cryptocurrencies using similar tactics.

However, it is more challenging to identify such manipulation on centralized exchanges. These exchanges only display market-level order books and trading data, making it difficult to precisely identify false trading. Nevertheless, comparing trading patterns and market indicators across exchanges still helps identify issues. For example, if trading volume significantly exceeds liquidity (1% market depth), it may be related to wash trading.

The data shows that assets on HTX and Poloniex have the highest trading volume to liquidity ratios, exceeding 100 times. Typically, meme coins, privacy coins, and low market cap altcoins exhibit abnormally high trading volume to depth ratios.

It is important to note that the trading volume to liquidity ratio is not a perfect indicator, as trading volume may significantly increase due to promotional activities (such as zero-fee promotions) by certain exchanges. To more reliably assess false trading volume, we can check the correlation of trading volume between exchanges. Generally, the trading volume trend of an asset across different exchanges is correlated and consistent over the long term. If trading volume is consistently monotonous, there are long periods without trading, or significant discrepancies exist across different exchanges, it may indicate abnormal trading activities.

For instance, when we look at the PEPE token on certain exchanges, we find that HTX shows a significant difference in trading volume trends compared to other platforms in 2024. On HTX, the trading volume of PEPE remained high during July, even increasing, while on most other exchanges, the trading volume declined.

Further analysis of trading data shows active algorithmic trading in the PEPE-USDT market on HTX. On July 3, there were 4,200 trades of 1M PEPE, averaging about 180 trades per hour. This trading pattern sharply contrasts with the trading on Kraken during the same period, which appeared more natural and retail-driven, with irregular trading sizes and timing.

Similar patterns also appeared on several other days in July. For instance, between July 9 and 12, over 5,900 trades of 2M PEPE were executed.

Various signs indicate the possibility of automated wash trading behavior, including high trading volume to depth ratios, unusual weekly trading patterns, fixed sizes of repeated orders, and rapid execution. In wash trading, the same entity simultaneously places buy and sell orders to artificially inflate trading volume, making the market appear more liquid.

The Subtle Line Between Market Manipulation and Efficiency Imbalance

Market manipulation in the crypto market is sometimes mistaken for arbitrage, which is profiting from market inefficiencies.

For example, the phenomenon of 'net fishing-style pump' is common in the Korean market (after attracting retail investors with a pump, the pool's funds are emptied and the perpetrators flee). Traders exploit temporary pauses in deposits and withdrawals to artificially inflate asset prices for profit. A typical case occurred in 2023 when the native token of Curve (CRV) was suspended from trading on several Korean exchanges due to a hacking incident.

The chart shows that when Bithumb suspended deposits and withdrawals of CRV tokens, a large number of buy orders pushed the price up significantly, but it quickly fell back down as selling started. During the suspension, multiple brief price hikes due to buying were immediately followed by selling. Overall, the selling volume significantly exceeded the buying volume.

Once the suspension ends, the price drops rapidly as traders can easily buy and sell for arbitrage across exchanges. Such suspensions typically attract retail traders and speculators who expect prices to rise due to limited liquidity.

Conclusion

Identifying market manipulation in the crypto market is still in its early stages. However, combining data and evidence from past investigations helps regulators, exchanges, and investors better address future market manipulation issues. In the DeFi space, the transparency of blockchain data provides a unique opportunity to detect wash trading of various tokens, gradually improving market integrity. In centralized exchanges, market data can reveal new market abuse issues and gradually align the interests of some exchanges with the public interest. As the crypto industry evolves, leveraging all available data helps reduce misconduct and foster a fairer trading environment.