Lifting the Veil on Centralized Exchanges

ARBITRUM FOUNDATION

Arbitrum, an Ethereum layer 2 network, landed in hot water shortly after its airdrop when on-chain sleuths noticed that 50mn ARB tokens that were supposed to be locked had been moved. Shortly after, the Arbitrum Foundation tweeted that 40mn ARB had been “been allocated as a loan to a sophisticated actor in the financial markets space. The remaining 10 million has been converted to fiat.” While this reveal may have come as a surprise given that the DAO was currently voting on whether to allocate the Foundation with funds at all, it was clear in the data that something unusual was happening.

Below I’ve grouped by trade size every trade on Binance (where it appears most of the ARB was sent) before the Foundation posted the clarifying tweet (“800” includes every trade between 800 and 810 ARB). Only the top 25 groups are included. There are some interesting patterns here, but what I’m looking for is imbalances that signal an entity methodically selling a large holding.

To better see this, I can chart the percentage of buys and sells in each group, which makes it instantly clear that there are some anomalies in the 200s.

Orders between 250–290 are all more than 60% sells and 250–280 is nearly 65% sells. On an exchange with as much volume as Binance, an imbalance like this persisting for days — especially in a high volume group — is a clear sign that someone is using a TWAP strategy to create or liquidate a large position without moving markets too much.

26mn more ARB was sold than bought in the 250–290 ARB trade size range during this time period, more than double the amount that Arbitrum said it had sold and more than half what Arbitrum loaned to the “sophisticated actor”.

An important follow up question here would be: is that just people dumping their airdrop? The answer to this is no, no recipient received fewer than 625 ARB and there is no reason to break up small positions into separate orders to minimize price impact.

Shown another way, one can see that sells in the 250–290 ARB trade size range were significantly higher than buys until the day of the Twitter clarification. Meanwhile, buys and sells were essentially even for larger trades.

Finally, to wrap up this use case, since the tweet clarification the volume distribution has looked much more normal. Yes, the 800–810 group is still receiving an unusual amount of action, but the buy and sell ratio between the groups looks correct.

COINBASE WRAPPED STAKED ETH (CBETH)

It was reported on February 8 that the SEC was investigating Kraken’s staking offering. This caused a temporary dip in cbETH’s price relative to ETH as investors speculated that Coinbase’s staking service could be in trouble. But, when using tick trade data to examine this more closely, I noticed that the price of the cbETH-ETH trading pair had actually dropped below its post-announcement low two days beforenews broke about the Kraken SEC investigation.What makes this especially interesting is that there was no corresponding drop on Uniswap V3, which had done double Coinbase’s volume for this pair over the previous two weeks.

Zooming in, it appears that someone was selling off a large cbETH position. It started with selling 244 cbETH in 435 transactions in just over 20 minutes. It then escalated, with 500 cbETH sold in 268 transactions in just 8 minutes, which temporarily crashed cbETH’s price.

What is unclear is why someone would sell off their position in this manner. According to Kaiko’s DEX liquidity data, there was over 10k ETH worth of liquidity on Uniswap V3 within 20% of the current price and over 2k ETH worth of liquidity in the main cbETH Curve pool. Either option (or ideally split between CEX and DEX) would have allowed this user to liquidate their position, likely with better execution.

Instead, they liquidated a position through a CEX pair that was not liquid enough, taking a loss of about $100k because of price slippage. This suggests one or some combination of the following: 1) time was of the essence; 2) they didn’t want to be traced on-chain; or 3) they were trying to move cbETH’s price. Given the SEC/Kraken reporting just two days later, this raises red flags.

Without a view of DEXs, this event wouldn’t have immediately stuck out as anomalous; any view of crypto markets is incomplete without including DeFi.

BINANCE TRADING HOURS

Conclusion