Data Reveals Wash Trading on Crypto Markets – Kaiko

On October 9, 2024, three market makers – ZM Quant, CLS Global and MyTrade – and their employees were charged with racketeering and conspiracy on behalf of NexFundAI, a cryptocurrency company and token. A total of eighteen individuals and entities face charges based on FBI-led evidence.

In this deep dive, we will analyze on-chain data for the NexFundAI cryptocurrency to identify wash trading patterns that can be extended to other cryptocurrencies and question certain tokens’ liquidity. We will explore other wash trading tactics in DeFi and how to detect illegal activity on centralized platforms. Finally, we will examine practices such as price pumps in Korean markets, which blur the line between market efficiency and manipulation.

Identifying Laundering in FBI Token Data.

NexFundAI is a token issued in May 2024 by an FBI-created company to expose market manipulation on cryptocurrency markets. On behalf of clients, the accused firms engaged in algorithmic wash trading, pump-and-dump schemes and other manipulative tactics, often on DeFi exchanges such as Uniswap. These practices targeted newly issued or small-cap tokens to create the illusion of active markets and attract real investors, ultimately increasing the token’s prices and visibility.

The FBI’s investigation led to clear confessions in this regard, with those involved explicitly setting out their procedures and intentions. Some even confirmed: ‘This is how we do market making on Uniswap.’ However, this case offers more than just oral evidence; it demonstrates what wax trading in DeFi looks like in the data, that’s what we’re going to look at now.

To begin our data exploration of the FBI’s fake token, NexFundAI (Kaiko ticker: NEXF), we will examine the token’s on-chain transfers. The data provides complete information about the token’s journey from issuance and every wallet and smart contract address that held these tokens.

The data reveals that the token issuer funded one of the market makers’ wallets with tokens, which then reallocated the funds among dozens of other wallets, identified by the highlighted groups in dark blue.

The funds were then used for wash trading on the token’s only secondary market, created by the issuer on Uniswap, identified in the middle of the graph, by the convergence point of almost all wallets that received and/or transferred this token from May to September 2024.

These findings reinforce information uncovered by the FBI through its covert ‘sting’ operation. The accused firms used multiple bots and hundreds of wallets to engage in wash trading without alerting unsuspecting investors looking for early opportunities.

To refine our analysis and confirm the fraudulent nature of transfers by certain wallets, especially those in groups, we identified the date of the first transfer received by each wallet by looking at the entire chain, not just NexFundAI -token transfers do not. The data shows that 148 out of 485 wallets, or 28%, were funded for the first time on the same block as at least 5 other wallets in this sample.

Addresses naturally trading this unknown token are highly unlikely to show this pattern. It is therefore likely that at least these 138 addresses are associated with trading algorithms, likely used for wash trading.

To further confirm wax trading involving this token, we examined the market data on the only secondary market that existed for it. By aggregating the daily volume traded on this Uniswap market and comparing the bought and sold volumes, we found a surprising symmetry between the two. This symmetry suggests that market maker companies settled an aggregate amount across all wallets that were engaged in wax trading on this market each day.

If we take a closer look at the individual trade level and color the trades by wallet address, we also find that some addresses execute exactly the same individual trades (same amount at the same timestamp) over one month of trading activity, indicating wash trading strategies. This indicates that these addresses are related.

Further investigation using Kaiko’s Wallet Data solutions allows us to find that these two addresses, despite never interacting in the chain, were both funded with WETH tokens by the same wallet address : 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This wallet is self-funded by one of Railgun’s smart contracts. According to Railgun’s website, ‘RAILGUN is a smart contract for professional traders and DeFi users that adds privacy protection to cryptocurrency transactions.’ These findings suggest that the wallet addresses had something to hide, such as market manipulation or worse.

DeFi fraud extends beyond NexFundAI.

Manipulative practices in DeFi are not limited to the FBI’s investigation. Our data shows that many of the 200k+ assets on Ethereum dexes are not usable and controlled by single individuals.

Some token issuers identified on Ethereum are setting up short-term liquidity pools on Uniswap. By controlling pool liquidity and doing wash trade with multiple wallets, they increase the pool’s attractiveness to normal investors, collect ETH and dump their tokens. This yields up to 22x their initial ETH investment in about 10 days, as demonstrated for four cryptocurrencies using Kaiko’s Wallet Data. This analysis reveals widespread fraudulent behavior among token issuers, which extends beyond the FBI’s NexFundAI investigation.

The data pattern: the example of the GIGA2.0 token

A user (eg 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and initiates) the full supply of a new token from an address such as 0x000.

The user instantly (within the day) moves the tokens and some ETH to create a new Uniswap V2 pool. He owns all the liquidity and gets UNI-V2 tokens that represent his contribution.

On average, 10 days later, the user withdraws all liquidity, destroys their UNI-V2 tokens, and collects the extra ETH obtained from the pool’s trading fees.

When examining the on-chain data for these four tokens, the exact same pattern is repeated. It provides evidence of orchestrated manipulation through automated and repetitive schemes, with the sole purpose of profit.

Market manipulation is not exclusive to DeFi.

While the FBI’s methods effectively exposed these practices, market abuse is neither new to cryptocurrencies nor exclusive to DeFi. In 2019, Gotbit’s CEO openly discussed his unethical business of helping crypto projects to “fake it till they make it”, using small exchange incentives to accept such practices on their platforms. Gotbit, its CEO, and two directors are also charged as part of this case for similar schemes involving numerous cryptocurrencies.

However, it is more difficult to spot this kind of manipulation on centralized exchanges. These exchanges only show order book and trade data at the market level, so it is difficult to identify fake trades. Still, this data can be very useful in flagging concerns by comparing trading patterns and market statistics across exchanges. For example, if trading volume significantly exceeds liquidity (1% market depth) across assets and exchanges, it may be due to wash trading.

This metric shows that HTX and Poloniex have the highest number of assets with volume to liquidity ratios above 100x. We can also see that tokens such as meme coins, privacy tokens and low-cap altcoins often exhibit unusually high volume-to-depth ratios.

It is important to note that the volume-to-liquidity ratio is not a perfect indicator, as trading volumes can be heavily influenced by exchange programs aimed at increasing volume on the exchange, such as campaigns with no consumer fees. To gain confidence in artificial volume conjectures, we can examine cross-exchange correlation of volume. Volume trends tend to be correlated across exchanges for an asset over long periods of time. Consistent, monotonous volume, periods of zero volume, or differences between different exchanges can indicate irregular trading activity.

For example, when we looked at PEPE, a token with a high trading volume to depth ratio on some exchanges, we noticed large differences in volume trends between HTX and other platforms in 2024. PEPE volumes on HTX remained high and even rose in July, while they fell on most other exchanges.

Looking at more detailed trading data shows that algorithmic traders are active in the PEPE-USDT market on HTX. On July 3, there were 4,200 buy and sell orders of 1M PEPE each within 24 hours, averaging 180 transactions per hour. This pattern was different from the trades on Kraken during the same time, which appeared more organic and retail driven, with less uniform trade sizes and timing.

Similar patterns were seen on other days in July for the same trading pair, confirming automated trading activity. For example, between July 9-12, more than 5900 buy and sell transactions of 2M PEPE each were executed.

Several signs point to possible automated wax trading. These include a high volume-to-depth ratio, unusual weekly trading patterns and recurring orders with fixed sizes and fast execution. In wash trading, a single entity places both buy and sell orders to falsely increase trading volume and make the market appear more liquid.

The fine line between market manipulation and inefficiency.

Market manipulation in crypto markets can sometimes be confused with arbitrage, where traders take advantage of market inefficiencies.

One example is “Fishnet pump” in Korean markets. Traders take advantage of temporary pauses in deposits and withdrawals to artificially increase asset prices and make a profit. A notable case occurred when trading of Curve’s native token (CRV) was halted on several Korean exchanges following a hack in 2023.

The chart reveals that when Bithumb paused CRV token deposits and withdrawals, prices initially rose sharply due to large purchases. However, they fell quickly when the sale started. During the break, there were several short price increases caused by buying, but these were always followed by selling. In general, there was more selling than buying.

Once the suspension ended, prices fell quickly as traders could easily buy and sell between exchanges to make a profit. These breaks often attract retail traders and speculators who expect price increases due to the limited liquidity.

Deduction

Identifying market manipulation in crypto markets is still in its early stages. However, combining data and evidence from past investigations can help regulators, exchanges and investors better address this issue in the future. In DeFi, blockchain data’s transparency offers unique chances to detect fraud for all tokens and gradually improve market integrity. On centralized exchanges, market data can highlight new concerns about market abuse and gradually align some exchanges’ incentives with the common good. As the crypto industry grows, using all available data can help reduce harmful practices and create a fairer trading environment.