Unveiling Cryptocurrency Market Manipulation: Analyzing the Hidden Forces Behind Wash Trading and Price Pumping
TechFlow Selected TechFlow Selected
Unveiling Cryptocurrency Market Manipulation: Analyzing the Hidden Forces Behind Wash Trading and Price Pumping
The market still has significant room for improvement.
Navigating Web3 tides with focused insightsBy: Dessislava Aubert, Anastasia Melachrinos
Translation: Block unicorn
On October 9, 2024, three market makers—ZM Quant, CLS Global, and MyTrade—and their employees were charged for allegedly conducting wash trading and conspiring on behalf of the cryptocurrency company NexFundAI and its token. According to evidence gathered by the Federal Bureau of Investigation (FBI), a total of 18 individuals and entities face charges.
In this in-depth analysis, we will examine the on-chain data of the NexFundAI cryptocurrency to identify patterns of wash trading that may extend to other cryptocurrencies, question the liquidity of certain tokens, and explore other wash trading strategies within DeFi. We will also discuss how illicit activities can be detected on centralized platforms.
Finally, we will examine price manipulation behaviors in the South Korean market that blur the line between market efficiency and manipulation.
FBI Identifies Wash Trading in Token Data
NexFundAI is a token issued in May 2024 by a company created by the FBI to expose market manipulation in the crypto markets. The accused firms reportedly provided algorithmic wash trading and "pump-and-dump" services for clients, primarily operating on DeFi exchanges such as Uniswap. These operations targeted newly launched or low-market-cap tokens, creating an illusion of active trading to attract real investors, inflate prices, and boost visibility.
The FBI investigation yielded explicit confessions, with suspects detailing their methods and intentions. Some even stated outright, "This is how we provide market making on Uniswap." However, this case provides not only verbal evidence but also data-driven insights into the reality of wash trading in DeFi—an analysis we now dive into.
To begin our data exploration of the FBI’s fabricated token NexFundAI (Kaiko ticker: NEXF), we first examine its on-chain transfer data. This dataset traces the complete path of the token since issuance, including all wallets and smart contracts holding the token.
The data shows that the issuer transferred token funds to a market maker wallet, which then distributed them across dozens of other wallets—identified in the chart by a dense blue cluster.
These funds were subsequently used to conduct wash trades on the sole secondary market created for the token: a Uniswap pool located at the center of the chart, serving as the convergence point for nearly all wallets receiving and/or transferring the token between May and September 2024.
These findings corroborate information uncovered by the FBI through undercover "sting" operations. The accused companies reportedly used multiple bots and hundreds of wallets to conduct wash trades without raising suspicion among early-stage investors seeking opportunities.
To refine our analysis and confirm fraudulent activity—particularly among wallets within the cluster—we recorded the date each wallet received its first transaction, analyzing broader on-chain activity beyond just NEXF transfers. Among the 485 wallets in our sample, 148 (28%) received their initial funds in the same block as at least five other wallets.
For a relatively obscure token, such a transaction pattern is highly improbable. It is therefore reasonable to infer that at least these 138 addresses are linked to trading algorithms and likely involved in wash trading.
To further confirm wash trading involving this token, we analyzed market data from its only existing secondary market. By aggregating daily trading volumes on the Uniswap pool and comparing buy and sell volumes, we observed a striking symmetry. This suggests that the market maker was systematically offsetting total amounts across participating wallets each day.
Drilling down to individual transactions and coloring trades by wallet address, we found that certain addresses executed identical single trades (same amount and timestamp) over a month-long period—indicating coordinated wash trading strategies and suggesting interrelated addresses.
Further investigation using Kaiko's Wallet Data solution revealed that although these two addresses never directly interacted on-chain, they were both funded with WETH from the same wallet: 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70. This funding wallet itself received funds via a smart contract from Railgun. According to Railgun’s official website, “RAILGUN is a smart contract designed for professional traders and DeFi users to enhance privacy in cryptocurrency transactions.” These findings suggest potentially hidden activities—including market manipulation or worse—associated with these wallet addresses.
DeFi Fraud Extends Beyond NexFundAI
Manipulative practices in DeFi are not limited to the FBI’s investigation. Our data shows that among over 200,000 assets listed on Ethereum decentralized exchanges, many lack real utility and are controlled by single individuals.
Some token issuers deploy short-term liquidity pools on Uniswap after launching tokens on Ethereum. By controlling liquidity within these pools and conducting wash trades using multiple wallets, they artificially enhance the pool’s appeal to attract retail investors, accumulate ETH, and dump their tokens. According to Kaiko Wallet Data, analysis of four such cryptocurrencies indicates that this strategy can yield up to 22 times the initial ETH investment within approximately 10 days. This reveals widespread fraudulent behavior among token issuers, extending well beyond the FBI’s NexFundAI probe.
Data Patterns: The Case of GIGA2.0 Token
A user (e.g., 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receives the entire supply of a new token from an address (such as 0x000).
The user immediately (within the same day) transfers these tokens along with some ETH to create a new Uniswap V2 liquidity pool. Since all liquidity is provided by the user, they receive UNI-V2 tokens representing their share.
On average, ten days later, the user withdraws all liquidity, burns the UNI-V2 tokens, and claims additional ETH earned from trading fees.
When analyzing the on-chain data of these four tokens, we observe the exact same pattern repeating—indicating automated, repetitive manipulation solely aimed at profit extraction.
Market Manipulation Is Not Limited to DeFi
While the FBI investigation effectively exposed these practices, market abuse is not unique to cryptocurrencies or DeFi. In 2019, the CEO of Gotbit publicly discussed his unethical business of helping crypto projects "fake success," leveraging tacit approval from smaller exchanges. The CEO of Gotbit and two of its directors are also charged in this case for manipulating multiple cryptocurrencies using similar tactics.
However, detecting such manipulation on centralized exchanges is more challenging. These platforms only display aggregated order book and trade data at the market level, making it difficult to pinpoint fraudulent trades. Nevertheless, comparing trading patterns and market metrics across exchanges can help identify anomalies. For example, if trading volume significantly exceeds liquidity (measured by 1% market depth), it may indicate wash trading.
Data shows that HTX and Poloniex have the highest number of assets with volume-to-liquidity ratios exceeding 100x. Typically, meme coins, privacy coins, and small-cap altcoins exhibit abnormally high volume-to-depth ratios.
It should be noted that the volume-to-liquidity ratio is not a perfect indicator, as trading volume can be inflated by exchange promotions (e.g., zero-fee campaigns). To gain higher confidence in identifying fake volume, we can examine cross-exchange volume correlations. Normally, trading volume trends for a given asset across different exchanges are correlated and show long-term consistency. If volume remains monotonically increasing, exhibits prolonged periods of zero trading, or shows significant divergence across exchanges, it may signal anomalous activity.
For instance, when examining PEPE token volume across exchanges, we find a stark divergence in 2024 between HTX and other platforms. On HTX, PEPE volume remained high in July and even increased slightly, while it declined on most other exchanges.
Further transaction analysis reveals active algorithmic trading in the PEPE-USDT market on HTX. On July 3 alone, there were 4,200 buy and sell orders of exactly 1M PEPE, averaging about 180 per hour. This contrasts sharply with Kraken’s trading activity during the same period, which appears more organic and retail-driven, with irregular trade sizes and timing.
Similar patterns occurred on other days in July. For example, between July 9 and 12, over 5,900 trades of exactly 2M PEPE were executed.
Multiple red flags suggest potential automated wash trading: high volume-to-depth ratios, unusual weekly trading patterns, fixed-size repeated orders, and rapid execution. In wash trading, the same entity places both buy and sell orders to inflate volume and create a false impression of market liquidity.
The Thin Line Between Market Manipulation and Efficiency Exploitation
In crypto markets, manipulation is sometimes mistaken for arbitrage—the exploitation of temporary market inefficiencies for profit.
For example, the phenomenon known as "dragnet pumping" is common in the South Korean market—where traders artificially inflate prices to lure retail investors before draining the pool. Traders exploit temporary deposit and withdrawal suspensions to manipulate asset prices for profit. A notable case occurred in 2023 when Curve’s native token (CRV) was suspended on several South Korean exchanges due to a hack.
The chart shows that when Bithumb suspended CRV deposits and withdrawals, heavy buying pushed prices sharply upward—followed quickly by sharp declines upon resumption of trading. During the suspension, multiple brief price spikes driven by buying were immediately followed by sell-offs. Overall, sell volume clearly exceeded buy volume.
Once trading resumed, prices rapidly dropped as traders could freely arbitrage across exchanges. Such suspensions often attract retail traders and speculators who expect prices to rise due to constrained liquidity.
Conclusion
Identifying market manipulation in cryptocurrency markets is still in its early stages. However, combining data and evidence from past investigations helps regulators, exchanges, and investors better prepare for future threats. In DeFi, blockchain transparency offers a unique opportunity to detect wash trading across various tokens, gradually improving market integrity. On centralized exchanges, market data analysis can uncover new forms of abuse and push some platforms toward aligning their incentives with public interests. As the crypto industry evolves, leveraging all available data will help reduce malicious behavior and foster a fairer trading environment.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@BlockUnicorn
