54% of ERC-20 tokens listed on DEXs in 2023 show patterns that may suggest Pump&Down schemes, but represent only 1.3% of DEX trading volume
For most of the investigations we publish in our annual Crypto Crime Report, the data tells a clear story. For example, funds sent to ransomware operators, darknet markets, or sanctioned entities can be measured and trends analyzed using Chainalysis data and tagging.
But blockchain data can also be used to detect suspicious trading patterns. In these cases, the evidence about blockchain is less definitive. Instead, on-chain data can provide a starting point for deeper investigations, usually combined with other off-chain information.
For this reason, we do not include potential income from market manipulation or estimates of losses to victims in our count of the total volume of illicit transactions; There is not enough information to determine whether the activity is criminal or not without additional context.
Pump&Down schemes typically involve an actor or group of actors investing in a token, promoting it heavily to stimulate a price increase, and subsequently dumping their holdings at a significant profit. This often results in a sharp drop or even collapse of a token's price, affecting unsuspecting holders.
For this analysis, we designed a methodology to surface data points that identify potential areas for further investigation into potential market manipulation.
We focus on DeFi, given its transparency and the availability of on-chain information, which is similarly not available on centralized trading platforms. Specifically, we look at the Ethereum network, which has seen rapid growth and innovation in recent years.
Thanks to the ecosystem's ERC-20 standard, or technical guidelines for Ethereum-based fungible tokens, it has never been easier to create new tokens on top of Ethereum, and all tokens can be exchanged with each other and used in a variety of applications. decentralized. (dApps).
Next, we will use on-chain analysis to consider what some of these patterns look like, a critical tool for both market operators and government agencies.
How on-chain data could be used to identify elements of potential Pump&Down schemes
Between January and December 2023, just over 370,000 tokens were launched on Ethereum, of which approximately 168,600 were available for trading on at least one decentralized exchange (DEX). As we see below, the number of monthly tokens launched has increased since mid-2022, with recent spikes in activity approaching 50,000 per month.
This data comes from Transpose, the comprehensive source of real-time indexed blockchain data.
However, not all of those tokens gain significant traction. In a given month, less than 14.1% of all tokens launched achieve more than $300 of DEX liquidity in the following month, and only 5.7% of tokens launched in 2023 are currently above that threshold.
Although this is an increase from the previous two years, the low liquidity values suggest that most of the tokens launched cannot yet be easily exchanged against liquid assets such as ETH, wETH, USDC, USDT and wBTC without their prices are significantly affected.
There are many reasons that could explain the inability to achieve more liquid trading volumes. As the popularity of tokenization grows, launching new tokens in an increasingly crowded market becomes more challenging.
However, some may be attempts to implement Pump&Down schemes. Below is an example of how one type of token manipulation could occur:
An actor (or group of actors) launches a new token or purchases a large portion of the supply of an existing token, usually one with historically low volume.
This actor promotes the token as a “get rich quick” opportunity, typically using social media and online chat rooms such as Discord and Telegram.
Persistent marketing on social media and chat rooms attracts users' attention, leading to increased purchases.
The actor may also engage in laundering operations, which involve the simultaneous purchase and sale of the same asset with the intention of falsifying its level of activity.
If successful, the token value increases.
Once the token reaches the desired target price, the actor liquidates his position to make a profit.
The price of the token falls rapidly due to increased selling pressure, leaving many victims “holding the bag.”
If the actor is also the creator of the token, they can completely abandon the token project and take more users' funds with them, also known as a "rug pull." However, this is not always possible depending on the governance of the project.
Many of these elements can be identified in the on-chain data. We used Transpose to search for ERC-20 tokens that met the following three criteria ("Criteria A"):
The token was purchased five times or more by DEX users off-chain to the largest holders of the token, indicating that it achieved some level of traction in the market.
A single address wiped out over 70.0% of the liquidity in the token's DEX liquidity pool, indicating that the largest holder dumped the token. In most cases, management removed liquidity from the token within the first few weeks after launch.
The token currently has liquidity of $300 or less, indicating that the market for the token essentially ceased following the removal of liquidity. If the token was involved with multiple DEX pools, we pooled the liquidity.
We found that approximately 90,408 tokens met Criterion A. This number represents 24.4% of all tokens launched on Ethereum and 53.6% of tokens listed on a DEX during the period studied. However, in 2023, the volume of transactions made with tokens that met Criterion A represented only 1.3% of the total trading volume on Ethereum DEX.
Number of tokensPercentage of all tokens launchedTotal tokens launched370,066100.0%Tokens listed on DEX168.62353.6%Tokens that currently have less than $300 in liquidity where a single address removed more than 70.0% of the liquidity in one single transaction with five or more previous DEX purchases90.40824.4%
This methodology does not mean that these tokens have been subject to pump and dump schemes; rather, it illustrates how operators or regulators can leverage on-chain trading data to identify and prioritize patterns that may suggest illicit activity and warrant further investigation.
The monthly amount of new tokens that meet Criterion A has been decreasing since mid-2023, although it is still higher than the 2022 amount.
Source: Transpose
How much did actors who launched tokens that met Criterion A earn before the value of their tokens plummeted? We can calculate this using the following formula, based on how the wallets associated with a token launch interacted with their DEX liquidity pools and traded the token itself.
A = Amount withdrawn from the DEX group by possible illicit actor
B = Amount deposited in the DEX pool by a possible illicit actor
C = Funds spent by an illicit actor to exchange tokens, possibly through wash trading
Benefit = A – B – C
Using this formula, we calculate that actors who launched tokens that met Criterion A collectively earned approximately $241.6 million in profits in 2023, without taking into account other costs to generate and launch the profits.
Source: Transpose
Although the total profit accrued by these actors is significant, individual tokens that meet our criteria produce on average just $2,672 each in profit and represent just 1.3% of the total Ethereum DEX trading volume for 2023.
The data paints a picture of an ecosystem where potentially bad actors could generate tens of thousands of potential Pump&Down tokens, most of which fail to generate significant profits and attract significant trading volume.
Case study: One of the most prolific token creators of 2023 generated 81 different tokens that met our criteria
Some of the actors involved also appear to launch multiple tokens that meet our criteria. This could be a way to generate more income using the same pattern.
During the period studied, we identified one address (Wallet 1 in the chart below) that appears to have been involved in the majority of token launches that meet Criterion A. The operator of this address launched 81 different types of tokens to generate an estimated $830,000 in profits.
In one case, this address made approximately $46,000 on the DEX launch and listing of a token we will refer to as Token A.
We can see a breakdown of how this address operator successfully executed these activities and more using Chainalysis Storyline. First, on August 5, 2023, the address operator sent wrapped Ether (wETH) and Token A to a liquidity pool. Next, the address trader appears to have traded using ETH and wETH, as shown in the subsequent eight transactions, and removed some liquidity on August 6, likely to take partial profits.
After executing these trades, the address trader eliminated all wETH and Token A liquidity on August 9 by selling existing positions and left the remaining users illiquid to sell their own assets.
Since these latest deletions, there have been no additional transactions in this liquidity pool, suggesting a rug-pulling in addition to the alleged Pump&Down scheme. Taken together, this activity suggests that the actor may have employed different tactics for a relatively complex attack.
The chart below illustrates how DEX pool liquidity changed during this period, showing several sharp increases in the wETH balance on August 6. On the far right, we see that liquidity returned to zero once the address trader withdrew all funds. August 9. Overall, 108 other market participants using this DEX pool appear to have lost funds; They had purchased approximately $55,000 worth of Token A during this period.
Source: Transpose
Monitor market patterns to maintain the integrity and stability of the crypto market
Market manipulation such as pump and dump schemes are destructive to cryptocurrency markets in the same way they are to traditional markets. However, the inherent transparency of cryptocurrencies provides the opportunity to build more secure markets.
Market operators and government agencies can implement monitoring tools that can help identify and prioritize areas for further investigation in a way that would not be possible in traditional markets.
Tools like Transpose can help monitor on-chain data for signs of unusual activity and help detect actionable leads alongside various forms of off-chain data.
