Original Author: Dessislava Aubert, Anastasia Melachrinos
Compiled by Block unicorn
On October 9, 2024, three market makers - ZM Quant, CLS Global, and MyTrade - and their employees were accused of engaging in wash trading and conspiracy on behalf of the cryptocurrency company and its token NexFundAI. According to evidence collected by the FBI, a total of 18 individuals and entities face charges.
In this in-depth analysis, we will analyze the on-chain data of the NexFundAI cryptocurrency to identify wash trading patterns that can be extended to other cryptocurrencies, and question the liquidity of certain tokens. Additionally, we will explore other wash trading strategies in DeFi and how to identify illicit activities on centralized platforms.
Finally, we will also investigate price pumping behavior in the Korean market, which blurs the line between market efficiency and manipulation.
FBI Identifies Wash Trading in Token Data
NexFundAI is a token issued by a company created by the FBI in May 2024 to expose market manipulation in the crypto market. The accused companies allegedly engaged in algorithmic wash trading, price pumping, and other manipulative tactics on behalf of clients, often on DeFi exchanges like Uniswap. These practices targeted newly issued or low-cap tokens, creating the illusion of an active market to attract real investors, ultimately driving up the token price and increasing its visibility.
The FBI's investigation yielded clear confessions, with the involved parties providing detailed descriptions of their operational steps and intentions. Some even explicitly stated, "This is how we market make on Uniswap." However, this case not only provides verbal evidence but also demonstrates the real face of wash trading in DeFi through data, which we will now analyze in depth.
To begin our exploration of the data on the FBI's fake token NexFundAI (Kaiko code: NEXF), we will first examine the on-chain transfer data of the token. This data provides the complete path of the token since its issuance, including all the wallet and smart contract addresses that have held these tokens.
The data shows that the token issuer transferred the token funds into a market maker wallet, which then distributed the funds to dozens of other wallets, identified by the deep blue clustering in the chart.
These funds were then used to conduct wash trading on the sole secondary market created by the issuer - Uniswap, which is the central hub where almost all wallets that received and/or transferred the token interacted (from May to September 2024).
These findings further corroborate the information revealed by the FBI's undercover "sting" operation. The accused companies used multiple bots and hundreds of wallets to engage in wash trading, without raising the suspicion of investors trying to catch an early opportunity.
To refine our analysis and confirm the fraudulent nature of certain wallet transfers, especially those within the clustering, we recorded the date each wallet first received a transfer, observing the entire on-chain data rather than just the NexFundAI token transfers. The data shows that out of the 485 wallets in the sample, 148 wallets (28%) received their first funding in the same block as at least 5 other wallets.
For a relatively unknown token, such a transaction pattern is virtually impossible. Therefore, it can be reasonably inferred that at least these 138 addresses are likely associated with trading algorithms and may have been used for wash trading.
To further confirm the wash trading involving this token, we analyzed the market data of its sole secondary market. By aggregating the daily trading volume on the Uniswap market and comparing the buy and sell volumes, we found a surprisingly symmetric relationship between the two. This symmetry suggests that the market maker firms were hedging the total amount across all the wallets participating in the wash trading on this market on a daily basis.
Delving into the individual transaction level and color-coding the transactions by wallet address, we also found that certain addresses executed identical single transactions (same quantity and timestamp) within a month's trading activity, indicating the use of a wash trading strategy and implying the interconnectedness of these addresses.
Further investigation revealed that using Kaiko's Wallet Data solution, we found that although these two addresses never directly interacted on-chain, they both received WETH funding from the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This wallet itself obtained funds through a Railgun smart contract. According to Railgun's website, "RAILGUN is a smart contract for professional traders and DeFi users, designed to add privacy protection to crypto transactions." These findings suggest that these wallet addresses may be involved in some behavior that needs to be hidden, such as market manipulation or even more severe cases.
DeFi Fraud Goes Beyond NexFundAI
Manipulative behavior in DeFi is not limited to the FBI's investigation. Our data shows that among the over 200,000 assets on Ethereum decentralized exchanges, many lack real utility and are controlled by a single person.
Some token issuers who launch tokens on Ethereum will set up short-term liquidity pools on Uniswap. By controlling the liquidity in the pool and using multiple wallets to conduct wash trading, they enhance the pool's attractiveness, drawing in retail investors, accumulating ETH, and then dumping their token holdings. According to Kaiko's Wallet Data analysis on four cryptocurrencies, this operation can achieve a 22x return on the initial ETH investment in about 10 days. This analysis reveals widespread fraud among token issuers, going beyond the FBI's investigation of NexFundAI.
Data Pattern: The Case of GIGA2.0 Token
A user (e.g., 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and initiates) the entire supply of a new token from some address (e.g., 0x000).
The user immediately (within the same day) transfers these tokens and some ETH to create a new Uniswap V2 liquidity pool. Since all the liquidity is contributed by the user, they receive the UNI-V2 tokens representing their contribution.
On average, 10 days later, the user will withdraw all the liquidity, burn the UNI-V2 tokens, and extract the additional ETH earnings from the trading fees.
When analyzing the on-chain data of these four tokens, we found the exact same pattern repeating, indicating that the manipulation is carried out through automated and repetitive operations, with the sole purpose of profiting.
Market Manipulation Extends Beyond DeFi
While the FBI's investigation effectively exposed these practices, market abuse is not exclusive to cryptocurrencies or DeFi. In 2019, the CEO of Gotbit openly discussed his unethical business of helping crypto projects "fake success," leveraging the complicity of small exchanges in these practices. The CEO of Gotbit and two of its directors were also charged in this case for manipulating various cryptocurrencies using similar methods.
However, such manipulation is more difficult to detect in centralized exchanges. These exchanges only display the order book and trade data at the market level, making it difficult to accurately identify fake trades. Nevertheless, comparing trading patterns and market indicators across exchanges can still help identify issues. For example, if trading volume significantly exceeds liquidity (1% market depth), it may be related to wash trading.
The data shows that assets with a trading volume-liquidity ratio over 100 times are the most prevalent on HTX and Poloniex. Typically, meme coins, privacy coins, and low-cap Altcoins exhibit abnormally high trading volume-depth ratios.
It should be noted that the trading volume-liquidity ratio is not a perfect indicator, as trading volume may be significantly increased by certain exchanges' promotional activities (such as zero-fee campaigns). To more reliably assess fake trading volume, we can check the correlation of trading volume across exchanges. Typically, the trading volume trend of an asset is correlated and consistent across different exchanges. If the trading volume is persistently monotonic, has prolonged periods of no trading, or shows significant differences across exchanges, it may indicate abnormal trading activity.
For example, when we look at the PEPE token on certain exchanges, we find that HTX's trading volume trend in 2024 differs significantly from other platforms. On HTX, the PEPE trading volume remained high and even increased during the July period, while on most other exchanges, the trading volume declined.
Further analysis of the trade data shows that there is active algorithmic trading activity in the PEPE-USDT market on HTX. On July 3, there were 4,200 buy and sell orders of 1M PEPE, averaging about 180 orders per hour. This trading pattern contrasts sharply with the more natural and retail-driven trading on Kraken during the same period, where the trade sizes and timing are more irregular.
Similar patterns were observed on several other days in July. For example, from July 9 to 12, there were over 5,900 buy and sell trades of 2M PEPE.
All these signs suggest the possibility of automated wash trading, including a high trading volume-depth ratio, unusual weekly trading patterns, fixed-size repeated orders, and rapid execution. In wash trading, the same entity simultaneously places buy and sell orders to artificially inflate trading volume and make the market appear more liquid.
The Subtle Line between Market Manipulation and Efficiency Imbalance
Market manipulation in the crypto market is sometimes mistaken for arbitrage, which is the practice of profiting from market inefficiencies.
For example, the "net-fishing-style pump" phenomenon is common in the Korean market (where retail investors are attracted by the price pump and then the pool is drained). Traders take advantage of the temporary suspension of deposits and withdrawals to artificially inflate asset prices and profit from it. A typical case occurred in 2023, when the native token of Curve (CRV) was temporarily suspended from trading on several Korean exchanges due to a hacker attack.
The chart shows that when Bithumb suspended deposits and withdrawals of the CRV token, a large number of buy orders drove the price up significantly, but it then quickly fell back as sell-offs began. During the suspension period, there were multiple brief price increases due to buy orders, each followed by sell-offs. Overall, the sell-off volume was significantly higher than the buy-in volume.
Once the suspension was lifted, the price quickly dropped, as traders could easily arbitrage between exchanges. Such suspensions often attract retail traders and speculators who expect the price to rise due to the limited liquidity.
Conclusion
Identifying market manipulation in the crypto market is still in its early stages. However, combining data and evidence from past investigations can help regulators, exchanges, and investors better address future market manipulation issues. In the DeFi space, the transparency of blockchain data provides a unique opportunity to detect wash trading in various tokens, gradually improving market integrity. In centralized exchanges, market data can reveal new market abuse issues and gradually align the interests of some exchanges with the public interest. As the crypto industry evolves, utilizing all available data can help reduce misconduct and create a fairer trading environment.
