Article author: Dessislava Aubert, Anastasia Melachrinos

Article translation: Block unicorn

On October 9, 2024, three market makers – ZM Quant, CLS Global and MyTrade – and their employees were charged with wash trading and conspiracy on behalf of the cryptocurrency company and its token NexFundAI. A total of 18 individuals and entities face charges based on evidence collected by the Federal Bureau of Investigation (FBI).

In this deep dive, we will analyze on-chain data of the NexFundAI cryptocurrency to identify wash trading patterns that can be extended to other cryptocurrencies and question the liquidity of certain tokens. In addition, we will explore other wash trading strategies in DeFi and how to identify illegal activities on centralized platforms.

Finally, we will also examine price-pumping behaviors in the Korean market, which blur the lines between market efficiency and manipulation.

FBI identifies wash trading in token data.

NexFundAI is a token issued by a company created by the FBI in May 2024, aimed at exposing market manipulation in the crypto market. The accused company engages in algorithmic wash trading, pumping and dumping techniques on behalf of clients, usually on DeFi exchanges like Uniswap. These actions target newly issued or low-market-cap tokens, creating a false illusion of an active market to attract real investors, ultimately driving up token prices and increasing their visibility.

The FBI investigation yielded clear confessions, with involved parties detailing their operational steps and intentions. Some even explicitly stated, "This is how we market make on Uniswap." However, this case provides not only verbal evidence but also data showing the true nature of wash trading in DeFi, which we will analyze further.

To begin our data exploration of the FBI's fake token NexFundAI (Kaiko code: NEXF), we will first examine the on-chain transfer data of the token. This data provides a complete path from the issuance of the token, including all wallets and smart contract addresses holding these tokens.

Data shows that the token issuer transferred token funds into a market maker wallet, which then allocated the funds to dozens of other wallets, identified in the chart by the deep blue clustering.

Subsequently, these funds were used for wash trading on the only secondary market created by the issuer—Uniswap, located at the center of the chart, which is the intersection point of almost all wallets receiving and/or transferring the token (from May to September 2024).

These findings further corroborate the information revealed by the FBI through undercover "sting" operations. The accused company used multiple bots and hundreds of wallets for wash trading, without raising suspicions from investors attempting to seize early opportunities.

To refine our analysis and confirm that certain wallet transfers are fraudulent, especially those within the clustering, we recorded the date of the first transfer received by each wallet and observed the entire on-chain data, not limited to NexFundAI token transfers. The data shows that among the 485 wallets in the sample, 148 wallets (or 28%) had the same block for their first funding as at least 5 other wallets.

For tokens with low visibility, such trading patterns are nearly impossible. Therefore, it is reasonable to speculate that at least these 138 addresses are related to trading algorithms that may be used for wash trading.

To further confirm the wash trading involving this token, we analyzed the market data of its only existing secondary market. By aggregating the daily trading volume on the Uniswap market and comparing buy and sell volumes, we found a surprising symmetry between the two. This symmetry suggests that market maker companies hedge the total amount daily among all wallets participating in wash trading.

In-depth examination of individual transaction levels and marking transactions by wallet address revealed that certain addresses executed identical single transactions (same quantity and timestamp) during a month of trading activity, indicating these addresses employed wash trading strategies, which also suggests these addresses are interconnected.

Further investigation revealed that using Kaiko's Wallet Data solution, we found that although these two addresses never directly interacted on-chain, both received WETH funding from the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This wallet itself was funded through a smart contract of Railgun. According to Railgun's official information, "RAILGUN is a smart contract designed for professional traders and DeFi users to enhance privacy in crypto trading." These findings suggest that these wallet addresses may exhibit certain behaviors that need to be concealed, such as market manipulation or even more severe situations.

DeFi fraud extends beyond NexFundAI.

Manipulative behaviors in DeFi are not limited to the FBI's investigation. Our data shows that among over 200,000 assets on Ethereum decentralized exchanges, many lack real utility and are controlled by a single individual.

Some issuers of tokens on Ethereum establish short-term liquidity pools on Uniswap. By controlling liquidity within the pool and using multiple wallets for wash trading, they enhance the pool's appeal, attracting ordinary investors to enter, thereby accumulating ETH and dumping their tokens. According to Kaiko's Wallet Data, analysis of four cryptocurrencies indicates that such operations can yield a 22-fold return on the initial ETH investment within about 10 days. This analysis reveals widespread fraudulent behavior among token issuers, exceeding the FBI's investigation into NexFundAI.

Data pattern: Using GIGA2.0 token as an example.

A user (for example, 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) received (and initiated) the entire supply of a new token from a certain address (like 0x000).

Users immediately (within the same day) transferred these tokens and some ETH to create a new Uniswap V2 liquidity pool. Since all liquidity was contributed by users, they received UNI-V2 tokens representing their contribution.

On average, 10 days later, the user withdraws all liquidity, destroys the UNI-V2 tokens, and extracts additional ETH earnings from transaction fees.

When analyzing the on-chain data of these four tokens, we found completely identical patterns repeating, indicating manipulation conducted through automation and repetitive operations, solely aimed at profit.

Market manipulation is not limited to DeFi.

Although the FBI's investigation effectively exposed these behaviors, market abuse is not unique to cryptocurrencies or DeFi. In 2019, Gotbit's CEO publicly discussed his unethical business of helping crypto projects "fake success," leveraging the complicity of small exchanges in these practices. The CEO of Gotbit and two of its directors were also charged in this case for manipulating various cryptocurrencies using similar tactics.

However, detecting such manipulation in centralized exchanges is more challenging. These exchanges only display order book and trading data at the market level, making it difficult to accurately identify false trades. Nevertheless, comparing trading patterns and market indicators across exchanges can still help identify issues. For example, if trading volume significantly exceeds liquidity (1% market depth), it may be related to wash trading.

Data shows that HTX and Poloniex have the most assets with over 100 times trading volume-liquidation ratios. Generally, meme coins, privacy coins, and low-market-cap altcoins exhibit abnormally high trading volume-depth ratios.

It’s important to note that the trading volume-liquidation ratio is not a perfect indicator, as trading volume can significantly increase due to promotional activities (such as zero-fee events) by certain exchanges. To more confidently assess false trading volumes, we can examine the correlation of trading volumes across exchanges. Typically, the trading volume trends of an asset across different exchanges are correlated and consistently aligned over the long term. If trading volume is persistently monotonic, exhibits long periods of inactivity, or shows significant differences across exchanges, it may indicate abnormal trading activity.

For example, when we looked at the PEPE token on certain exchanges, we found significant differences in trading volume trends between HTX and other platforms in 2024. On HTX, PEPE trading volume remained high and even increased during July, while trading volume decreased on most other exchanges.

Further analysis of trading data shows active algorithmic trading in the PEPE-USDT market on HTX. Within July 3, there were 4,200 buy and sell orders of 1M PEPE, averaging about 180 orders per hour. This trading pattern sharply contrasts with trading on Kraken during the same period, which appeared more natural and retail-driven, with irregular sizes and timings.

Similar patterns appeared on several other days in July. For instance, between July 9 and 12, over 5,900 trades of 2M PEPE were executed.

Various signs indicate possible automated wash trading behavior, including high trading volume-depth ratios, unusual weekly trading patterns, fixed sizes of repeated orders, and rapid execution. In wash trading, the same entity simultaneously places buy and sell orders to artificially inflate trading volume, making the market appear more liquid.

The subtle boundary between market manipulation and efficiency imbalance.

Market manipulation in the crypto market is sometimes mistaken for arbitrage, which is profiting from market efficiency imbalances.

For instance, the "net fishing style pump" phenomenon is common in the Korean market (after attracting retail investors into the market, the pool's funds are emptied). Traders profit by artificially driving up asset prices during temporary pauses in deposits and withdrawals.

The chart shows that when Bithumb paused deposits and withdrawals for the CRV token, a large number of buy orders pushed the price up significantly, but then it quickly fell back down as selling began. During the pause, several brief price increases caused by buying were immediately followed by sell-offs. Overall, sell volumes were significantly higher than buy volumes.

Once the pause ends, prices quickly drop as traders can easily buy and sell across exchanges for arbitrage. Such pauses typically attract retail traders and speculators, who expect prices to rise due to limited liquidity.

Conclusion

Identifying market manipulation in the crypto market is still in its early stages. However, combining data and evidence from past investigations helps regulatory bodies, exchanges, and investors better address future market manipulation issues. In the DeFi space, the transparency of blockchain data offers a unique opportunity to detect wash trading of various tokens, gradually improving market integrity. In centralized exchanges, market data can reveal new market abuse issues and gradually align the interests of some exchanges with the public interest. As the crypto industry develops, utilizing all available data helps reduce bad behavior and create a fairer trading environment.