On October 9, three market makers (ZM Quant, CLS Global and MyTrade) and some of their employees were charged with conspiring to conduct false transactions on behalf of NexFundAI tokens and crypto entities. A total of 18 individuals and entities face charges based on evidence provided by the FBI.
This article will delve into the on-chain profile of the NexFundAI token to identify false trading patterns that could extend the suite to other tokens and question the liquidity of certain tokens. In addition, this article will explore other false trading strategies in DeFi, how to detect illegal activities on centralized platforms, and finally study price manipulation in the Korean market, etc.
Identifying fake transactions in FBI token profiles
NexFundAI is a token issued by a company established by the FBI in May 2024 to expose market manipulation in the crypto market. The alleged companies engaged in algorithmic sham trading, pump and dump schemes, and other manipulative tactics on behalf of clients, often on exchanges such as Uniswap. These practices target newly issued or small-cap tokens to create the illusion of an active market, attract real investors, and increase token prices and popularity.
Relevant personnel confessed to the FBI investigation, and those involved clearly stated their processes and intentions. Some even confirmed, “This is how we always make markets on Uniswap.”
In order to conduct data exploration on the FBI’s fake token NexFundAI, this article will examine the on-chain transfer of tokens. This information provides complete information on every wallet and smart contract address from issuance to holding these tokens.
Token issuers use tokens to fund a market maker’s wallet, which then redistributes the funds among dozens of wallets, which are marked by integrations highlighted in dark blue, according to the information.
These funds were then used for wash trades in the token’s only secondary market, established by the issuer on Uniswap, identified in the center of the chart as receipts and/or transfers of this token between May and September 2024 The convergence point for almost all wallets.
These findings further corroborate the FBI's investigation. The accused company used multiple bots and hundreds of wallets to conduct fake transactions.
In order to refine the analysis and confirm the fraudulent nature of transfers from certain wallets, especially those in clusters, this article identified the date of the first transfer received by each wallet and looked at the entire chain, not just the NexFundAI token Transfer money. The data shows that 148 of the 485 wallets (28%) received funds on the same block for the first time as at least 5 other wallets in the sample.
Addresses trading this unknown token are naturally unlikely to show this pattern. Therefore, at least these 138 addresses may be related to the trading algorithm and may be used for wash trading.
To further confirm wash trades involving this token, check the market data of the only secondary market where this token exists. By aggregating the daily trading volume on this Uniswap market and comparing buy and sell volumes, a striking symmetry between the two is discovered. This symmetry indicates that market makers are offsetting the total amount of all wallets engaged in wash trades in this market every day.
By looking at individual transactions and coloring them based on wallet address. Some addresses were found to have executed the exact same single transaction (same amount, same point in time) over a month of trading activity. This indicates that these addresses are related and there is a fake trading strategy.
Further investigation using Kaiko's wallet profile solution revealed that both addresses, despite never interacting on-chain, were funded with WETH tokens by the same wallet address 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70.
The wallet itself is funded by a Railgun smart contract. According to the Railgun website, “Railgun is a smart contract for professional traders and DeFi users that adds privacy protection to encrypted transactions.” These findings suggest that wallet addresses hide secrets such as market manipulation or worse.
DeFi fraud isn’t limited to NexFundAI
DeFi manipulation is not limited to FBI investigations. Data shows that many of the more than 200,000 assets on Ethereum DEXs lack practicality and are controlled by individuals.
Some token issuers found on Ethereum are establishing short-term liquidity pools on Uniswap. By controlling the liquidity of the pool and performing wash trades with multiple wallets, the pool is made more attractive to ordinary investors, amassing ETH, and dumping their tokens. As demonstrated, 22x the initial ETH investment was generated in approximately 10 days. This analysis revealed widespread fraud by token issuers that extends beyond the FBI’s NexFundAI investigation.
Data model: GIGA2.0 token example
A user (e.g. 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and initiates) the entire supply of new tokens from an address (e.g. 0x000).
Users transfer tokens and some ETH immediately (within a day) to establish a new Uniswap V2 pool. It owns all liquidity and receives UNI-V2 tokens representing its contributions.
After an average of 10 days, users will withdraw all liquidity, destroy their UNI-V2 tokens, and receive additional ETH earned from the pool's transaction fees.
When examining the on-chain profiles of these four coins, the exact same pattern is found. This is evidence of orchestrated manipulation through automated and repetitive schemes with the sole purpose of profit.
Market manipulation is not unique to DeFi
While the FBI’s approach effectively exposed these practices, market abuse is not new to cryptocurrencies, nor is it unique to DeFi. In 2019, the CEO of market maker Gotbit publicly discussed its unethical business of helping crypto projects "disguise" and exploit the incentives of small exchanges to conduct manipulation on their platforms. Gotbit’s CEO and two directors have also been charged in connection with similar schemes involving multiple cryptocurrencies.
However, detecting such manipulation is difficult on centralized exchanges. These exchanges only display market-level order and transaction data, making it difficult to identify fake trades. However, it can be assisted by comparing trading patterns and market indicators across exchanges. For example, if trading volume significantly exceeds the liquidity of the asset and exchange (1% market depth), it may be due to wash trading. In general, tokens like meme coins, privacy coins, and low-cap Altcoin often exhibit unusually high volume-to-depth ratios.
It’s worth noting that the volume-to-liquidity ratio is not a perfect indicator, as trading volume can be severely affected by exchange programs designed to increase trading volume on an exchange, such as zero-commission campaigns.
It is possible to check the cross-exchange correlation of trading volumes. For an asset, volume trends tend to be correlated across exchanges over time. Consistent, monotonous trading volumes, periods of zero trading volume, or differences between exchanges can all signal unusual trading activity.
For example, when studying PEPE (higher volume-to-depth ratios on some exchanges), it was noted that there was a large difference in volume trends in 2024 between an anonymous exchange and other platforms. PEPE trading volumes on the exchange have remained high and even increased in July, while PEPE trading volumes on most other exchanges have declined.
More detailed trading data shows that algorithmic traders are active in the PEPE-USDT market on the exchange. On July 3, within 24 hours, there were 4,200 buy and sell orders for 1 million PEPE.
Similar patterns were seen on other trading days in July for the same trading pairs, confirming automated trading activity. For example, between July 9 and 12, more than 5,900 buy and sell transactions of 2 million PEPE were executed.
There are some signs that automated wash trades may be occurring. These signs include high volume-to-depth ratios, unusual weekly trading patterns, and recurring orders of fixed size and rapid execution. In fake trading, one entity places buy and sell orders simultaneously to falsely increase trading volume and make the market appear more liquid.
The line between market manipulation and inefficiency is blurry
Market manipulation in crypto markets is sometimes mistaken for arbitrage, where traders profit from market inefficiencies.
“Fishing Net Pumping” in the Korean market is an example. Traders take advantage of the temporary pause in deposits and withdrawals to artificially increase asset prices and profit. One notable example is the suspension of trading of the CRV token on several South Korean exchanges following a hack in 2023.
When an exchange suspended deposits and withdrawals of CRV tokens, the price initially jumped due to heavy buying. However, it fell quickly as the sell-off began. During the pause, there were several brief price increases due to buying, but this was always followed by selling. Overall, there were more sells than buys.
Once the pause ends, the price falls quickly as traders can easily buy and sell between exchanges to make a profit. With limited liquidity, these pauses often attract retail traders and speculators who expect prices to rise.
in conclusion
Research on how to identify market manipulation in crypto markets is still in its early stages. However, incorporating information and evidence from past investigations can help regulators, exchanges and investors better address this issue in the future. In DeFi, the transparency of blockchain data provides a unique opportunity to detect wash trades across all tokens and gradually improves market integrity.
On centralized exchanges, market data can highlight new market abuse issues and gradually align some exchange incentives with the public interest. As the crypto industry evolves, utilizing all available information can help reduce harmful practices and create a fairer trading environment.
