Written by: Dessislava Aubert, Anastasia Melachrinos
Compiled by: Block unicorn
On October 9, 2024, three market makers - ZM Quant, CLS Global, and MyTrade - and their employees were charged with wash trading and conspiracy on behalf of the cryptocurrency company and its token NexFundAI. Based on evidence collected by the Federal Bureau of Investigation (FBI), a total of 18 individuals and entities face charges.
In this in-depth analysis, we will analyze on-chain data of the NexFundAI cryptocurrency to identify wash trading patterns that can be extended to other cryptocurrencies and question the liquidity of certain tokens. In addition, we will explore other wash trading strategies in DeFi and how to identify illegal activities on centralized platforms.
Finally, we will also examine price pumping in the South Korean market, which blurs the line between market efficiency and manipulation.
FBI Identifies Wash Trading in Token Data
NexFundAI is a token issued in May 2024 by a company created by the FBI to expose market manipulation in the crypto market. The accused companies engaged in algorithmic wash trading, pump and dump and other manipulative tactics on behalf of their clients, often on DeFi exchanges such as Uniswap. These practices targeted newly issued or small-cap tokens, creating the illusion of an active market to attract real investors, ultimately driving up token prices and increasing their popularity.
The FBI investigation resulted in clear confessions, with the individuals involved describing their operations and intentions in detail. Some even explicitly stated, “This is how we make markets on Uniswap.” However, this case not only provides verbal evidence, but also shows the true face of wash trading in DeFi through data, which we will analyze in depth below.
To begin our data exploration of the FBI fake token NexFundAI (Kaiko code: NEXF), we will first examine the token’s on-chain transfer data. This data provides a complete path from the token issuance, including all wallets and smart contract addresses holding these tokens.
The data shows that the token issuer transferred the token funds to a market maker wallet, which in turn distributed the funds to dozens of other wallets, which are identified by the dark blue clusters in the chart.
The funds were then used to conduct wash trades on Uniswap, the only secondary market created by the issuer, which is located in the center of the chart and is the intersection of almost all wallets that received and/or transferred the token (between May and September 2024).
These findings further support the information revealed by the FBI through undercover "staging" operations. The accused companies used multiple bots and hundreds of wallets to conduct wash trades without attracting the suspicion of investors trying to seize early opportunities.
To refine our analysis and confirm that the transfers from certain wallets were fraudulent, especially those within the cluster, we recorded the date when each wallet received the first transfer, observing the entire on-chain data rather than just NexFundAI token transfers. The data shows that 148 of the 485 wallets in the sample, or 28%, first received funds in the same block as at least 5 other wallets.
For such a relatively unknown token, such a trading pattern is almost impossible. Therefore, it is reasonable to speculate that at least these 138 addresses are related to the trading algorithm and may be used for wash trading.
To further confirm the wash trading involving this token, we analyzed the market data of its only existing secondary market. By aggregating the daily trading volume on the Uniswap market and comparing the buy and sell volume, we found a surprising symmetry between the two. This symmetry suggests that market maker firms hedge the total amount between all wallets participating in wash trading on this market every day.
After looking deeper into the single transaction level and coloring the transactions by wallet address, we also found that some addresses executed exactly the same single transaction (same amount and timestamp) in a month of trading activities, indicating that these addresses used a wash order strategy, which also implies that these addresses are related to each other.
Further investigation showed that by using Kaiko’s Wallet Data solution, we found that both addresses, despite never interacting directly on-chain, were provided with WETH funds by the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. The wallet itself was funded through a smart contract of Railgun. According to the information on the Railgun website, "RAILGUN is a smart contract for professional traders and DeFi users, designed to add privacy protection to crypto transactions." These findings suggest that these wallet addresses may have some behavior that needs to be hidden, such as market manipulation or even worse.
DeFi fraud goes beyond NexFundAI
Manipulative behavior in DeFi is not limited to the FBI investigation. Our data shows that many of the more than 200,000 assets on Ethereum decentralized exchanges lack practical use and are controlled by a single individual.
Some issuers of tokens on Ethereum set up short-term liquidity pools on Uniswap. By controlling the liquidity within the pool and using multiple wallets for wash trading, they enhance the pool's appeal and attract ordinary investors to enter, accumulate ETH, and sell their tokens. According to Kaiko's Wallet Data, an analysis of four cryptocurrencies shows that this operation can achieve a 22x return on the initial ETH investment in about 10 days. This analysis reveals widespread fraud among token issuers that goes beyond the scope of the FBI's investigation of NexFundAI.
Data pattern: Taking GIGA2.0 token as an example
A user (e.g. 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and activates) the entire supply of a new token from an address (e.g. 0x000).
The user immediately (within the same day) transfers these tokens and some ETH to create a new Uniswap V2 liquidity pool. Since all liquidity was contributed by the user, he received UNI-V2 tokens representing his contribution.
On average, after 10 days, the user withdraws all liquidity, destroys UNI-V2 tokens, and withdraws the additional ETH income from transaction fees.
When analyzing the on-chain data of these four tokens, we find that the exact same pattern repeats, indicating manipulation through automated and repetitive operations with the sole purpose of profit.
Market manipulation is not limited to DeFi
While the FBI investigation was effective in uncovering these practices, market abuse is not unique to crypto or DeFi. In 2019, Gotbit’s CEO publicly spoke about his unethical business of helping crypto projects “fake success” by taking advantage of small exchanges’ acquiescence to these practices. Gotbit’s CEO and two of its directors were also charged in this case for similar manipulation of multiple cryptocurrencies.
However, it is more difficult to detect such manipulation on centralized exchanges. These exchanges only display market-level order books and trading data, making it difficult to accurately identify fake trades. Still, comparing trading patterns and market indicators across exchanges can help identify problems. For example, if trading volume significantly exceeds liquidity (1% market depth), it may be related to wash trading.
The data shows that HTX and Poloniex have the most assets with more than 100x volume-to-liquidity ratios. Usually meme coins, privacy coins, and small-cap altcoins show abnormally high volume-to-depth ratios.
It is important to note that the volume-to-liquidity ratio is not a perfect indicator, as trading volume can be significantly increased by promotional activities on some exchanges (such as zero-fee activities). To more confidently determine fake trading volume, we can check the correlation of trading volume between exchanges. Usually, the trading volume trends of an asset on different exchanges are correlated and consistent over time. If the trading volume is monotonous for a long time, there are long periods of no trading, or there are significant differences between different exchanges, it may indicate abnormal trading activity.
For example, when we look at PEPE tokens on some exchanges, we see significant differences in volume trends between HTX and other platforms in 2024. On HTX, PEPE volume remained high and even increased during July, while it declined on most other exchanges.
Further analysis of trading data shows that algorithmic trading is active in the PEPE-USDT market on HTX. On July 3, there were 4,200 buy and sell orders for 1M PEPE, an average of about 180 per hour. This trading pattern is in stark contrast to Kraken's trading during the same period, which was more organic and retail-driven, with irregular trade sizes and timing.
Similar patterns emerged on other days in July. For example, more than 5,900 buy and sell trades of 2M PEPE were executed between July 9 and 12.
There are signs of possible automated wash trading, including high volume-to-depth ratios, unusual weekly trading patterns, fixed sizes of repeated orders, and fast execution. In wash trading, the same entity places buy and sell orders simultaneously to inflate volume and make the market appear more liquid.
The subtle line between market manipulation and efficiency imbalance
Market manipulation in the crypto market is sometimes mistaken for arbitrage, which is the use of market efficiency imbalances to make profits.
For example, the phenomenon of "casting a net to catch fish" is common in the Korean market (after attracting retail investors to enter the market by pulling the market, the funds in the pool are emptied and run away). Traders take advantage of the temporary suspension of deposits and withdrawals to artificially raise asset prices and profit from it. A typical case occurred in 2023, when Curve's native token (CRV) was suspended from trading on several Korean exchanges due to hacker attacks.
The chart shows that when Bithumb suspended deposits and withdrawals of CRV tokens, a large number of buy orders drove the price up sharply, but then quickly fell back as selling began. During the suspension, many short-lived price increases due to buying were followed by selling. Overall, the selling volume was significantly higher than the buying volume.
Once the suspension ended, the price fell rapidly because traders could easily buy and sell between exchanges for arbitrage. Such suspensions often attract retail traders and speculators who expect prices to rise due to restricted liquidity.
Conclusion
Identifying market manipulation in crypto markets is still in its early stages. However, combining data and evidence from past investigations can help regulators, exchanges, and investors better respond to future market manipulation issues. In the DeFi space, the transparency of blockchain data provides a unique opportunity to detect wash trading of various tokens, thereby gradually improving market integrity. In centralized exchanges, market data can reveal new market abuse issues and gradually align the interests of some exchanges with the public interest. As the crypto industry develops, leveraging all available data can help reduce bad behavior and create a fairer trading environment.