Chainalysis: 54% of ERC-20 tokens are suspected of being speculated on DEX in 2023

Source: Chainalysis; Compiled by: Deng Tong, Golden Finance

In the year we released Crypto Crime Report Most of the research data tells a clear story. For example, through Chainalysis's tags and data, funds sent to ransomware operators, darknet markets, or sanctioned entities can be detected and trends analyzed. However, blockchain data can also be used to detect suspicious transaction patterns. In these cases, the evidence on the blockchain is often not clear enough. Instead, on-chain data can serve as a starting point for in-depth investigation, often combined with other off-chain information. Therefore, when calculating total illegal trading volume, we do not include estimates of possible market manipulation gains or victim losses—there is insufficient information to determine whether activity is criminal without additional contextual information.

"Pump and dump" schemes typically involve an investor or group of investors investing in a token, heavily promoting the token to spur price increases, and subsequently selling off their holdings at a significant profit . This often results in a significant price drop or even collapse of the token, impacting unsuspecting holders.

For this analysis, we designed a method to uncover data points that identify potential areas for further investigation into possible market manipulation. We focused on DeFi considering its transparency and availability of on-chain information (which is not similar in centralized trading platforms). Specifically, we examine the Ethereum network, which has experienced rapid growth and innovation in recent years. Thanks to the ecosystem’s ERC-20 standard, or the technical guidelines for Ethereum-based fungible tokens, it is now easier to build new tokens on Ethereum, all of which can be traded with each other and used for a variety of purposes. Decentralized applications (dApps).

In the following, we will consider some of these patterns using on-chain analysis, which is an equally important tool for market operators and government agencies.

How to use on-chain data to identify elements of possible pump and dump scenarios

In 2023 Just over 370,000 tokens were launched on Ethereum alone between January and December of 2020, of which approximately 168,600 are tradable on at least one decentralized exchange (DEX). As shown below, the number of tokens launched each month has been increasing since mid-2022, with the recent peak in activity approaching 50,000 per month.

This data comes from Transpose, a comprehensive source of indexed real-time blockchain data.

However, not all of these coins have received huge attention. In any given month, less than 14.1% of all tokens issued achieve more than $300 in DEX liquidity within the next month, and only 5.7% of tokens issued in 2023 are currently above that threshold. Although an increase from the previous two years,lower liquidity suggests that most tokens issued are still not easily redeemable against liquid assets such as ETH, wETH, USDC, USDT, and wBTC without any Its price has a significant impact.

There are many reasons that could explain the failure to achieve more liquid trading volumes. As tokenization grows in popularity, launching new tokens into an increasingly crowded market becomes more challenging.

However, some may be attempting a pump and dump scheme. Here is an example of how a token operation occurs:

• A participant ( or a group of participants) either launch a new token or purchase a large portion of the supply of an existing token—usually one with lower historical trading volume.

• A promoter promotes a token as a "get rich quick" opportunity, often using social media and online chat rooms such as Discord and Telegram.

• Continuous marketing on social media and chat rooms attracts users’ attention, leading to increased purchases.

• Promoters may also engage in false trading, i.e. buying and selling the same asset at the same time, in order to falsify its trading volume.

• If successful, the value of the token will increase.

• Once the token reaches the price target, participants liquidate their positions for profit.

• Due to increased selling pressure, token prices fell rapidly, causing many victims to "take the blame".

• If participants are also token creators, they may abandon the token project entirely, taking more users' funds with them, also known as a "Rug Pull." However, this is not always possible depending on the governance of the project.

Many of these elements can be identified in on-chain data. We use Transpose to find ERC-20 tokens that meet the following three criteria ("Criteria A"):

The token has been purchased five or more times by DEX users and is not related to the token's maximum holdings. Some have no on-chain connections, which shows that it has achieved a certain level of traction in the market.

A single address eliminated over 70.0% of the liquidity in the token’s DEX liquidity pool, indicating that the largest holders were selling the token. In most cases, this address will remove liquidity from the token within the first few weeks after launch.

The coin’s current liquidity is $300 or less, suggesting that the market for the coin has essentially ceased after liquidity disappeared. If a token is involved in multiple DEX pools, we consolidate liquidity.

We found approximately 90,408 tokens meeting Criterion A. This number represents 24.4% of all tokens issued on Ethereum during the study period, and 53.6% of tokens listed on DEXs. However, by 2023, the trading volume of tokens that meet Criteria A will only account for 1.3% of the total Ethereum DEX trading volume.

This method does not This does not mean these tokens are the subject of a pump-and-dump scheme – rather, it illustrates how operators or regulators can use on-chain transaction data to identify and prioritize tokens that may suggest illegal activity and require further investigation.

The number of new tokens meeting Criterion A each month has been declining since mid-2023, but is still higher than the number in 2022.

Launched in compliance with Standard A How much profit did participants of the token make before the value of their token plummeted? We can calculate this using the following formula based on how wallets associated with the token issuance interact with their DEX liquidity pools and trade the token itself.

A = Amount withdrawn from DEX pool by possible illegal actors

B = Amount deposited into DEX pool by possible illegal actors

C = Funds used by illegal actors to trade tokens, possibly through wash trading

Profit = A – B – C

Using this formula, we calculate that in line with criterion A Participants in the token collectively made approximately $241.6 million in profits in 2023, not taking into account other costs of establishing and launching profits.

Although these participants The total profits gained were considerable, but individual tokens that met our criteria generated an average profit of $2,672 each, accounting for only 1.3% of total Ethereum DEX trading volume in 2023. The data paints a picture of an ecosystem where potential bad actors could generate tens of thousands of potential pump-and-dump tokens, most of which fail to generate significant profits or attract meaningful trading volume .

Case Study: One of the most prolific token creators of 2023 generated 81 different tokens that met our criteria< /h2>

Some participants also appear to be launching multiple tokens that meet our criteria, which may be a way to generate additional revenue using the same model.

During the time period studied, we identified one address—Wallet 1 in the image below—that appeared to be involved in the largest number of launches of tokens that met the A criteria. The operator of this address launched 81 different types of tokens and made an estimated $830,000 in profits.

In an example , this address made approximately $46,000 when a token we will call Token A was released and listed on the DEX.

We can use the Chainalysis Storyline to learn more about how the operator of this address successfully performed these activities and more. First, on August 5, 2023, the address operator sent wrapped Ethereum (wETH) and Token A to the liquidity pool. Next, the address operator appeared to perform wash trades using ETH and wETH, as seen in the next 8 trades, and removed some of the liquidity on August 6, possibly taking profits.

After executing these transactions , the address operator eliminated all wETH and Token A liquidity on August 9 by selling existing positions, leaving remaining users with no liquidity to sell their assets. No additional trades have occurred in this liquidity pool since the last clear, suggesting a pull in addition to a suspicious pump and dump scheme. Overall, this activity suggests that attackers may have employed different strategies to conduct relatively sophisticated attacks.

The chart below illustrates how the liquidity of DEX pools has changed during this period, showing several sharp increases in wETH balances on August 6th. On the far right, we see that once the address operator withdraws all funds, liquidity returns to zero. August 9th. Overall, 108 other market participants using this DEX pool appear to have lost funds; they purchased approximately $55,000 of Token A during this period.

Monitor market patterns to Maintaining the Integrity and Stability of Cryptocurrency Markets

Market manipulation, such as pump and dump schemes, is as destructive to cryptocurrency markets as it is to traditional markets. However, the inherent transparency of cryptocurrencies provides the opportunity to build safer markets. Market operators and government agencies can deploy monitoring tools to help identify and prioritize areas that require further investigation, which is not possible in traditional markets.

Tools like Transpose can help monitor on-chain data for signs of unusual activity and help uncover actionable clues when combined with various forms of off-chain data.