In-Depth Investigation into FBI "Sting" Operations: Wash Trading from DEX to CEX Is Widespread
TechFlow Selected TechFlow Selected
In-Depth Investigation into FBI "Sting" Operations: Wash Trading from DEX to CEX Is Widespread
Lifting the veil on market makers: market manipulation in the crypto space may be widespread.
Navigating Web3 tides with focused insightsAuthor: Research firm Kaiko
Translation: Felix, PANews
On October 9, three market makers—ZM Quant, CLS Global, and MyTrade—and some of their employees were charged for allegedly conducting collusive wash trading on behalf of the NexFundAI token and related crypto entities. According to evidence provided by the FBI (Federal Bureau of Investigation), a total of 18 individuals and entities face charges.
This article will analyze on-chain data from the NexFundAI token to identify patterns of artificial trading that can be extended to other tokens, question the liquidity of certain assets, explore other forms of wash trading in DeFi, examine how illicit activities can be detected on centralized platforms, and investigate price manipulation in markets such as South Korea.
Identifying Wash Trading in FBI Token Data
NexFundAI is a token issued by a company established by the FBI in May 2024 to expose market manipulation in the cryptocurrency market. The accused firms allegedly conducted algorithmic wash trading, pump-and-dump schemes, and other manipulative strategies on behalf of clients, typically on exchanges like Uniswap. These practices targeted newly launched or small-cap tokens to create a false impression of an active market, attract genuine investors, inflate token prices, and boost visibility.
Individuals involved admitted to the FBI investigation, clearly outlining their processes and intentions. Some even confirmed, "This is how we've always done market making on Uniswap."
To explore the FBI's fake token NexFundAI through data analysis, this article examines the token’s on-chain transfers. This data provides full information from issuance to every wallet and smart contract address holding these tokens.
The data shows that the token issuer funded one of the market maker's wallets with tokens, which then redistributed funds across dozens of wallets identified by the dark blue cluster.
These funds were then used for wash trading on the token’s sole secondary market, created by the issuer on Uniswap and marked at the center of the chart as the convergence point for nearly all wallets receiving and/or transferring this token between May and September 2024.
These findings further confirm the FBI's investigation. The accused companies used multiple bots and hundreds of wallets to conduct wash trading.
To refine the analysis and verify the fraudulent nature of transactions—especially those within the cluster—the date of each wallet’s first incoming transfer was determined, examining the entire chain history, not just NexFundAI token transfers. The data reveals that out of 485 wallets, 148 (28%) received funds for the first time in the same block as at least five other wallets in the sample.
It is highly unlikely that addresses trading this obscure token would naturally exhibit such a pattern. Therefore, at least 138 of these addresses may be linked to trading algorithms, likely used for wash trading.
To further confirm wash trading involving this token, market data from its only existing secondary market was examined. By aggregating daily trading volume on this Uniswap market and comparing buy and sell volumes, a striking symmetry was observed. This symmetry suggests that market makers offset the net amounts traded daily by all wash-trading wallets in this market.
Examining individual trades and coloring them by wallet address revealed that some addresses executed identical single trades (same amount, same timing) over a month of activity. This indicates these addresses are related and part of a coordinated wash trading strategy.
Further investigation using Kaiko’s wallet data solution revealed that two addresses, despite never interacting on-chain, were both funded with WETH by the same wallet address: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. That wallet itself was funded by a smart contract from Railgun. According to Railgun’s website, “Railgun is a smart contract designed for professional traders and DeFi users, adding privacy protection to crypto transactions.” These findings suggest wallet addresses may conceal secrets such as market manipulation or worse.
DeFi Fraud Extends Beyond NexFundAI
Manipulation in DeFi is not limited to the FBI’s case. Data shows that among over 200,000 assets on Ethereum DEXs, many lack utility and are controlled by individuals.
Some token issuers on Ethereum are creating short-term liquidity pools on Uniswap. By controlling pool liquidity and conducting wash trades across multiple wallets, they enhance the pool’s appeal to ordinary investors, accumulate ETH, and dump their tokens. As shown, this generated a 22x return on the initial ETH investment within about 10 days. This analysis reveals widespread fraudulent behavior among token issuers, extending far beyond the FBI’s NexFundAI investigation.
Data Pattern: Example of the GIGA2.0 Token
A user (e.g., 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives (and initiates) the full supply of a new token from an address (e.g., 0x000).
The user immediately (within one day) transfers tokens and some ETH to create a new Uniswap V2 pool. They hold all the liquidity and receive UNI-V2 tokens representing their contribution.
Average 10 days later, the user withdraws all liquidity, burns their UNI-V2 tokens, and collects additional ETH earned from transaction fees in the pool.
Examining the on-chain data of these four tokens reveals the exact same pattern. This proves someone is orchestrating manipulation through automated, repetitive schemes solely for profit.
Market Manipulation Is Not Unique to DeFi
While the FBI’s method effectively exposed these practices, market abuse is neither new nor exclusive to DeFi in the crypto space. In 2019, Gotbit, a market maker, had its CEO publicly discuss unethical operations helping crypto projects “fake it,” exploiting incentives from smaller exchanges to manipulate markets on their platforms. The CEO of Gotbit and two directors were also charged for similar schemes involving multiple cryptocurrencies.
However, detecting such manipulation on centralized exchanges is more difficult. These platforms only display order and trade data at the market level, making it hard to identify wash trading. Still, cross-exchange comparison of trading patterns and market indicators can help. For example, if trading volume significantly exceeds an asset’s and exchange’s liquidity (1% market depth), it could indicate wash trading. Tokens such as meme coins, privacy coins, and low-market-cap altcoins often show abnormally high volume-to-depth ratios.
It should be noted that the volume-to-liquidity ratio is not a perfect indicator, as trading volume can be heavily influenced by exchange programs aimed at boosting volume, such as zero-commission campaigns.
Cross-exchange volume correlation can also be analyzed. For any given asset, volume trends tend to correlate across exchanges over time. Consistent, monotonic volume, periods of zero volume, or divergences between exchanges may signal abnormal trading activity.
For instance, when studying PEPE—a token with a relatively high volume-to-depth ratio on certain exchanges—a significant divergence in volume trends was observed in 2024 between an anonymous exchange and other platforms. While PEPE volume remained high or even rose in July on that exchange, it declined on most other exchanges.
More detailed trade data shows algorithmic traders were active in the PEPE-USDT market on that exchange. On July 3, there were 4,200 buy and sell orders of exactly 1 million PEPE within 24 hours.
Similar patterns occurred on other days in July. For example, between July 9 and 12, over 5,900 buy and sell trades of exactly 2 million PEPE were executed.
Signs suggesting potential automated wash trading include high volume-to-depth ratios, unusual weekly trading patterns, and repeated orders of fixed size executed rapidly. In wash trading, a single entity places both buy and sell orders simultaneously to artificially inflate trading volume and create a false impression of liquidity.
The Line Between Market Manipulation and Market Inefficiency Is Blurry
In crypto markets, market manipulation is sometimes mistaken for arbitrage, where traders profit from market inefficiencies.
South Korea’s “Fishing Net Pumping” is one such example. Traders exploit temporary halts in deposits and withdrawals to artificially inflate asset prices and profit. A notable case occurred in 2023 after the CRV token was hacked, leading several South Korean exchanges to suspend CRV trading.
When one exchange suspended CRV deposits and withdrawals, the price initially surged due to heavy buying. However, it quickly dropped as selling pressure emerged. During the suspension, the price saw several brief spikes driven by buying, followed each time by sharp sell-offs. Overall, selling consistently exceeded buying.
Once the suspension ended, prices rapidly fell as traders could freely move assets between exchanges to capture profits. Due to limited liquidity, such suspensions often attract retail traders and speculators expecting price increases.
Conclusion
Research into identifying market manipulation in cryptocurrency markets is still in its early stages. However, combining data and evidence from past investigations can help regulators, exchanges, and investors better address these issues in the future. In DeFi, the transparency of blockchain data offers a unique opportunity to detect wash trading across all tokens, gradually improving market integrity.
On centralized exchanges, market data can highlight new forms of market abuse and gradually align exchange incentives with public interest. As the crypto industry evolves, leveraging all available data can help reduce harmful practices and create a fairer trading environment.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@KaikoData
