On October 9, 2024, three market makers—ZM Quant, CLS Global, and MyTrade—and their employees were charged with wash trading and conspiracy on behalf of NexFundAI, a cryptocurrency company and token. In total, eighteen individuals and entities face charges based on FBI-led evidence.
In this deep dive, we’ll analyze on-chain data for the NexFundAI cryptocurrency to identify wash trading patterns that can be extended to other cryptocurrencies and question certain tokens’ liquidity. We’ll explore other wash trading tactics in DeFi and how to spot illicit activity on centralized platforms. Finally, we’ll examine practices like price pumping on Korean markets, which blur the line between market efficiency and manipulation.
Identifying wash trading in FBI token data.
NexFundAI is a token issued by an FBI-created company in May 2024 to expose market manipulation on cryptocurrency markets. On behalf of clients, the accused firms engaged in algorithmic wash trading, pump and dump schemes, and other manipulative tactics, often on DeFi exchanges like Uniswap. These practices targeted newly issued or small-cap tokens to create the illusion of active markets and attract real investors, ultimately boosting the token’s prices and visibility.
The FBI’s investigation led to clear confessions in this regard, with those involved explicitly detailing their procedures and intentions. Some even confirmed, ‘That’s how we do market making on Uniswap.’ However, this case offers more than just verbal evidence; it demonstrates what wash trading in DeFi looks like in the data, which is what we are going to look at now.
To start our data exploration of the FBI’s fake token, NexFundAI (Kaiko ticker: NEXF), we will examine the token’s on-chain transfers. The data provides complete information on the token’s journey from issuance and every wallet and smart contract address that has held these tokens.
The data reveals that the token issuer has funded with tokens one of the market makers’ wallets, which then reallocated the funds amongst dozens of other wallets, identified by the highlighted clusters in dark blue.
The funds were then used for wash trading on the token’s only secondary market, created by the issuer on Uniswap, identified in the centre of the graph, by the convergence point of almost all wallets that have received and/or transferred this token from May to September 2024.
These findings reinforce information uncovered by the FBI through its undercover ‘sting’ operation. The accused firms used multiple bots and hundreds of wallets to engage in wash trading without alerting unsuspecting investors seeking early opportunities.
To refine our analysis and confirm the fraudulent nature of transfers by certain wallets, especially those in clusters, we identified the date of the first transfer received by each wallet, looking at the entire chain, not just NexFundAI token transfers. The data reveals that 148 out of 485 wallets, or 28%, were funded for the first time on the same block as at least 5 other wallets in this sample.
It is highly unlikely that addresses trading this unknown token naturally would show this pattern. Thus, it is probable that at least these 138 addresses are associated with trading algorithms, likely used for wash trading.
To further confirm wash trading involving this token, we examined the market data on the only secondary market that existed for it. By aggregating the daily volume executed on this Uniswap market and comparing the bought and sold volumes, we found a surprising symmetry between the two. This symmetry suggests that market maker companies were offsetting a total amount across all wallets engaged in wash trading on this market each day.
Looking more closely at the individual trade level and colouring the trades by wallet address, we also find that some addresses execute the exact same individual trades (same amount at the same timestamp) over one month of trading activity, indicating wash trading strategies. This suggests that these addresses are related.
Further investigation using Kaiko’s Wallet Data solutions enables us to find that these two addresses, despite never interacting on-chain with each other, were both funded with WETH tokens by the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This wallet was itself funded by one of Railgun’s smart contracts. According to Railgun’s website, ‘RAILGUN is a smart contract for professional traders and DeFi users that adds privacy protection to cryptocurrency transactions.’ These findings suggest that the wallet addresses had something to hide, such as market manipulation or worse.
DeFi fraud extends beyond NexFundAI.
Manipulative practices in DeFi aren’t limited to the FBI’s investigation. Our data shows that many of the 200k+ assets on Ethereum dexes lack utility and are controlled by single individuals.
Some token issuers identified on Ethereum are setting up short-lived liquidity pools on Uniswap. By controlling pool liquidity and conducting wash trading with multiple wallets, they enhance the pool’s attractiveness to normal investors, accumulate ETH, and dump their tokens. This yields up to 22x their initial ETH investment in around 10 days, as demonstrated for four cryptocurrencies using Kaiko’s Wallet Data. This analysis reveals widespread fraudulent behaviour among token issuers, extending beyond the FBI’s NexFundAI investigation.
The Data Pattern: The Example of the GIGA2.0 Token
- A user (e.g., 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and initiates) the full supply of a new token from an address such as 0x000.
- The user moves immediately (within the day) the tokens and some ETH to create a new Uniswap V2 pool. He owns all the liquidity, getting UNI-V2 tokens representing his contribution.
On average, 10 days later, the user withdraws all liquidity, destroying their UNI-V2 tokens, and collects the extra ETH gained from the pool’s trading fees.
When examining the on-chain data for these four tokens, the exact same pattern is repeated. This provides evidence of orchestrated manipulation through automated and repetitive schemes, with the sole objective of profit.
Market manipulation isn’t exclusive to DeFi.
While the FBI’s methods effectively exposed these practices, market abuse isn’t new to cryptocurrency or exclusive to DeFi. In 2019, Gotbit’s CEO openly discussed his unethical business of helping crypto projects “fake it until they make it”, using small exchanges incentives on accepting such practices on their platforms. Gotbit, its CEO, and two directors are also charged as part of this case, for similar schemes involving numerous cryptocurrencies.
However, spotting this kind of manipulation on centralized exchanges is harder. These exchanges only show order book and trade data at the market level, so it’s difficult to pinpoint fake trading. Still, this data can be very helpful for flagging concerns by comparing trading patterns and market metrics across exchanges. For instance, if trading volume significantly surpasses liquidity (1% market depth) across assets and exchanges, it might be due to wash trading.
This metric reveals that HTX and Poloniex have the highest number of assets with volume-to-liquidity ratios above 100x. We also can see that tokens such as meme coins, privacy tokens, and low-cap altcoins often show unusually high volume-to-depth ratios.
It’s important to note that the volume-to-liquidity ratio is not a perfect indicator, as trade volumes can be heavily influenced by exchange programs aiming to increase volume on the exchange, like zero taker-fee campaigns. To gain confidence in artificial volume suspicions, we can examine cross-exchange correlation of volume. Volume trends tend to be correlated over long periods of time across exchanges, for an asset. Consistent, monotonic volume, periods of zero volume, or discrepancies between different exchanges can signal irregular trading activity.
For example, when we looked at PEPE, a token with a high trade volume-to-depth ratio on some exchanges, we noticed big differences in volume trends between HTX and other platforms in 2024. PEPE volumes on HTX stayed high and even rose in July, while they dropped on most other exchanges.
Looking at more detailed trade data shows that algorithmic traders are active in the PEPE-USDT market on HTX. On July 3rd, there were 4,200 buy and sell orders of 1M PEPE each within 24 hours, averaging 180 trades per hour. This pattern was unlike the trades on Kraken during the same time, which seemed more organic and retail-driven, with less uniform trade sizes and timing.
Similar patterns were seen on other days in July for the same trading pair, confirming automated trading activity. For example, between July 9-12, over 5900 buy and sell trades of 2M PEPE each were executed.
Several signs point to possible automated wash trading. These include a high volume-to-depth ratio, unusual weekly trade patterns, and repetitive orders with fixed sizes and rapid execution. In wash trading, a single entity places both buy and sell orders to falsely boost trading volume and make the market seem more liquid.
The fine line between market manipulation and inefficiency.
Market manipulation in crypto markets can sometimes be mistaken for arbitrage, where traders profit from market inefficiencies.
One example is “Fishing Net Pumping” in Korean markets. Traders take advantage of temporary pauses in deposits and withdrawals to artificially increase asset prices and make a profit. A notable case happened when trading of Curve’s native token (CRV) was halted on several Korean exchanges after a hack in 2023.
The chart reveals that when Bithumb paused CRV token deposits and withdrawals, prices initially rose sharply due to large purchases. However, they quickly fell as selling began. During the pause, there were several brief price increases caused by buying, but these were always followed by selling. Overall, there was more selling than buying.
Once the suspension ended, prices dropped rapidly as traders could easily buy and sell between exchanges to make a profit. These pauses often attract retail traders and speculators who anticipate price increases due to the limited liquidity.
Conclusion
Identifying market manipulation in crypto markets is still in its early stages. However, combining data and evidence from past investigations can help regulators, exchanges, and investors better address this issue in the future. In DeFi, blockchain data’s transparency offers unique chances to detect wash trading for all tokens and gradually improve market integrity. On centralized exchanges, market data can highlight new market abuse concerns and progressively align some exchanges’ incentives with the common good. As the crypto industry grows, using all available data can help reduce harmful practices and create a fairer trading environment.
