Original authors: Dessislava Aubert, Anastasia Melachrinos

Original text translated by: Block unicorn

On October 9, 2024, three market makers—ZM Quant, CLS Global, and MyTrade—and their employees were charged with wash trading and conspiracy on behalf of cryptocurrency companies and their token NexFundAI. According to evidence collected by the FBI, a total of 18 individuals and entities faced charges.

In this in-depth analysis, we will analyze the on-chain data of NexFundAI cryptocurrency to identify wash trading patterns that can extend to other cryptocurrencies and question the liquidity of certain tokens. Additionally, we will explore other wash trading strategies in DeFi and how to identify illegal activities on centralized platforms.

Finally, we will also study price manipulation behaviors in the Korean market, which blur the lines between market efficiency and manipulation.

FBI identified wash trading in token data.

NexFundAI is a token issued by a company created by the FBI in May 2024, aimed at exposing market manipulation in the crypto market. The accused company engaged in algorithmic wash trading, price manipulation, and other manipulative tactics on platforms like Uniswap, usually targeting newly issued or low-market-cap tokens to create a false impression of an active market, ultimately driving up token prices and increasing their visibility.

The FBI's investigation yielded clear confessions, with involved parties detailing their operational steps and intentions. Some even stated explicitly, 'This is how we market make on Uniswap.' However, this case not only provides verbal evidence but also uses data to showcase the true nature of wash trading in DeFi, which we will analyze further.

To begin our data exploration of the FBI's fraudulent token NexFundAI (Kaiko code: NEXF), we will first examine the on-chain transfer data of the token. This data provides a complete path from the token's issuance, including all wallet and smart contract addresses holding these tokens.

Data shows that the token issuer transferred the token funds to a market maker wallet, which then allocated the funds to dozens of other wallets, identified in the chart by deep blue clusters.

Subsequently, these funds were used for wash trading on the only secondary market created by the issuer—Uniswap, located at the center of the chart, which serves as the intersection point for almost all wallets receiving and/or transferring the token (from May to September 2024).

These findings further corroborate the information uncovered by the FBI through undercover 'sting' operations. The accused companies used multiple bots and hundreds of wallets for wash trading, without raising suspicions from investors looking to seize early opportunities.

To refine our analysis and confirm that certain wallet transfers are fraudulent, especially those within the clusters, we recorded the dates when each wallet received their first transfer, observing the entire on-chain data beyond just NexFundAI token transfers. The data shows that among the 485 wallets in the sample, 148 wallets (or 28%) shared the same block for their first funding with at least 5 other wallets.

For such a low-profile token, the emergence of such trading patterns is virtually impossible. Therefore, it is reasonable to speculate that at least these 138 addresses are related to trading algorithms, possibly used for wash trading.

To further confirm the wash trading involving this token, we analyzed the market data of the only existing secondary market. By aggregating the daily trading volume on the Uniswap market and comparing buy and sell volumes, we found a surprising symmetry between the two. This symmetry suggests that market maker companies hedge the total amounts across all wallets participating in wash trading on a daily basis.

In-depth examination of individual transaction levels and marking transactions by wallet address revealed that certain addresses executed identical single transactions (same amount and timestamp) during a month of trading activity, indicating that these addresses used wash trading strategies, which also suggests that these addresses are interconnected.

Further investigation revealed that by using Kaiko's Wallet Data solution, we found that these two addresses, despite never directly interacting on-chain, were both funded by the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This wallet itself obtained funding through a smart contract from Railgun. According to Railgun's official information, 'RAILGUN is a smart contract designed to enhance privacy for crypto trading for professional traders and DeFi users.' These findings suggest that there may be certain behaviors requiring concealment among these wallet addresses, such as market manipulation or even more severe situations.

DeFi fraud goes beyond NexFundAI.

Manipulative behaviors in DeFi are not limited to the FBI's investigation. Our data shows that among over 200,000 assets on Ethereum decentralized exchanges, many lack real utility and are controlled by a single individual.

Some issuers of tokens on Ethereum establish short-term liquidity pools on Uniswap. By controlling liquidity within the pool and using multiple wallets to conduct wash trading, they enhance the pool's attractiveness to draw in ordinary investors, thereby accumulating ETH and selling off their tokens. According to Kaiko's Wallet Data, analysis of four cryptocurrencies indicates that this operation can achieve a 22-fold return on initial ETH investment in about 10 days. This analysis reveals widespread fraud among token issuers, extending beyond the FBI's investigation of NexFundAI.

Data pattern: Taking GIGA2.0 token as an example.

A user (e.g., 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) received (and initiated) the entire supply of a new token from a certain address (e.g., 0x000).

Users immediately (within the same day) transferred these tokens and some ETH to create a new Uniswap V2 liquidity pool. Since all liquidity was contributed by users, they received UNI-V2 tokens representing their contribution.

On average, 10 days later, the user withdraws all liquidity, destroys UNI-V2 tokens, and extracts additional ETH gains from transaction fees.

When analyzing the on-chain data of these four tokens, we found the exact same patterns repeatedly, indicating manipulation conducted through automation and repetitive operations, with the sole purpose of profit.

Market manipulation is not limited to DeFi.

While the FBI's investigation effectively uncovered these behaviors, market abuse is not unique to cryptocurrency or DeFi. In 2019, the CEO of Gotbit publicly discussed his unethical business of helping crypto projects 'disguise success,' taking advantage of small exchanges' acquiescence to these practices. The CEO of Gotbit and two of its directors were also charged in this case for manipulating various cryptocurrencies using similar tactics.

However, detecting such manipulation in centralized exchanges is more challenging. These exchanges only display market-level order books and trading data, making it difficult to accurately identify fraudulent transactions. Nevertheless, comparing trading patterns and market indicators across exchanges still helps identify issues. For example, if trading volume significantly exceeds liquidity (1% market depth), it may be related to wash trading.

Data shows that assets with more than 100 times trading volume-liquidity ratios are most prevalent on HTX and Poloniex. Typically, meme coins, privacy coins, and low-market-cap altcoins show abnormally high trading volume-depth ratios.

It is important to note that the trading volume-liquidity ratio is not a perfect indicator, as trading volume may be significantly increased due to promotional activities (like zero-fee promotions) by certain exchanges. To more confidently assess false trading volume, we can examine the correlation of trading volume across exchanges. Typically, the trading volume trends of an asset across different exchanges are correlated and consistent over the long term. If trading volume is consistently monotonous, experiences prolonged periods without trading, or shows significant differences across exchanges, it may indicate abnormal trading activities.

For example, when we look at the PEPE token on certain exchanges, we find that HTX has significantly different trading volume trends from other platforms in 2024. On HTX, PEPE trading volume remained high and even increased during July, while trading volume on most other exchanges declined.

Further analysis of trading data shows that there is active algorithmic trading in the PEPE-USDT market on HTX. On July 3, there were 4,200 buy and sell orders of 1M PEPE, averaging about 180 orders per hour. This trading pattern sharply contrasts with trading on Kraken during the same period, where trades appeared more natural and retail-driven, with irregular sizes and timing.

Similar patterns were observed on other days in July. For example, from July 9 to 12, over 5,900 buy and sell transactions of 2M PEPE were executed.

Various signs suggest the possibility of automated wash trading, including high trading volume-depth ratios, unusual weekly trading patterns, fixed sizes of repeated orders, and rapid execution. In wash trading, the same entity simultaneously places buy and sell orders to artificially inflate trading volume, making the market appear more liquid.

The subtle boundary between market manipulation and efficiency imbalance.

Market manipulation in the crypto market is sometimes mistaken for arbitrage activity, which is profiting from market inefficiencies.

For example, the phenomenon of 'net fishing style price manipulation' is common in the Korean market (where prices are artificially inflated to attract retail investors before emptying the pool's funds and running away). Traders exploit temporary pauses in deposits and withdrawals to artificially raise asset prices for profit. A typical case occurred in 2023 when Curve's native token (CRV) was suspended from trading on several Korean exchanges due to a hacking incident.

The chart shows that when Bithumb suspended deposits and withdrawals of the CRV token, a large number of buy orders drove the price up significantly, but it quickly fell back as selling began. During the suspension, several brief price increases caused by buying were immediately followed by sell-offs. Overall, the sell-off volume was significantly higher than the buying volume.

Once the pause ends, prices quickly drop because traders can easily buy and sell for arbitrage between exchanges. Such pauses typically attract retail traders and speculators who anticipate that prices will rise due to limited liquidity.

Conclusion

Identifying market manipulation in the crypto market is still in its early stages. However, combining past investigation data and evidence helps regulators, exchanges, and investors better respond to future market manipulation issues. In the DeFi space, the transparency of blockchain data provides a unique opportunity to detect wash trading in various tokens, gradually improving market integrity. In centralized exchanges, market data can reveal new issues of market abuse, progressively aligning the interests of some exchanges with the public interest. As the crypto industry develops, utilizing all available data helps reduce misconduct and create a fairer trading environment.