In-depth exploration of FBI "sting" operations: wash trading is prevalent from DEX to CEX

Author: Research Company Kaiko

Compiled by: Felix, PANews

On October 9, three market makers (ZM Quant, CLS Global, and MyTrade) and some of their employees were charged with conspiring to conduct fraudulent trading on behalf of the NexFundAI token and crypto entities. According to evidence provided by the FBI, a total of 18 individuals and entities are facing charges.

This article will delve into the on-chain data of the NexFundAI token to identify fraudulent trading patterns that can be extended to other tokens and question the liquidity of certain tokens. Additionally, it will explore other fraudulent trading strategies in DeFi and how to detect illegal activities on centralized platforms, concluding with an examination of price manipulation in the South Korean market.

Identifying Fraudulent Trading in FBI Token Data

NexFundAI is a token issued by a company established by the FBI in May 2024 to expose market manipulation in the crypto market. The accused companies conducted algorithmic wash trading, pump-and-dump schemes, and other manipulation strategies on exchanges like Uniswap on behalf of clients. These practices target newly issued or low-cap tokens to create a false appearance of an active market, attracting real investors and increasing token prices and visibility.

The individuals involved have openly confessed to the FBI's investigation, clearly outlining their processes and intentions. Some even confirmed, "This is how we consistently market make on Uniswap."

To explore the data of the FBI's fraudulent token NexFundAI, this article will examine the on-chain transfers of the token. This data provides complete information from the issuance to each wallet and smart contract address holding these tokens.

The data shows that the token issuer funded a wallet for the market maker with the tokens, which then redistributed the funds to dozens of wallets, highlighted in deep blue clusters.

These funds were then used for wash trading in the token's only secondary market, created by the issuer on Uniswap, identified in the chart as the aggregation point for almost all wallets that received and/or transferred this token from May to September 2024.

These findings further corroborate the FBI's investigation. The accused companies used multiple bots and hundreds of wallets for fraudulent trading.

To refine the analysis and confirm the fraudulent nature of transfers from certain wallets (especially those in the cluster), this article identified the date of the first transfer received by each wallet and examined the entire chain, not just the NexFundAI token transfers. The data shows that among 485 wallets, 148 (28%) received funds for the first time in the same block as at least 5 other wallets in the sample.

Addresses trading this unknown token are naturally less likely to exhibit this pattern. Therefore, at least these 138 addresses may be related to trading algorithms and could be used for wash trading.

To further confirm the wash trading involving this token, market data from the token's only existing secondary market was examined. By aggregating the daily trading volume on this Uniswap market and comparing buy and sell volumes, a striking symmetry was found between the two. This symmetry indicates that market makers are offsetting the total amount of wash trading conducted by all wallets in this market daily.

By observing individual trades and coloring them by wallet address, it was discovered that some addresses executed exactly the same single trade (same amount, same time point) during a month of trading activity. This suggests that these addresses are related and that there is a fraudulent trading strategy in place.

Further investigation using Kaiko's wallet data solution revealed that these two addresses, although never interacting on-chain, were both funded by the same wallet address 0x4aa6a6231630ad13ef52c06de3d3d3850fafcd70 with WETH tokens. This wallet itself is funded by a smart contract from Railgun. According to the Railgun website, "Railgun is a smart contract that adds privacy protection to crypto trading for professional traders and DeFi users." These findings suggest that the wallet addresses conceal some secrets, such as market manipulation or worse behavior.

DeFi Fraud is Not Limited to NexFundAI

Manipulative behavior in DeFi is not confined to the FBI's investigation. Data shows that many of the over 200,000 assets on Ethereum DEXs lack utility and are controlled by individuals.

Some token issuers found on Ethereum are establishing short-term liquidity pools on Uniswap. By controlling the liquidity of the pool and engaging in wash trading with multiple wallets, they enhance the pool's appeal to ordinary investors, accumulate ETH, and dump their tokens. As demonstrated, a 22-fold return on the initial ETH investment was generated in about 10 days. This analysis reveals widespread fraudulent behavior among token issuers, extending beyond the FBI's NexFundAI investigation.

Data Patterns: GIGA 2.0 Token Example

Users (like 0x33ee6449b05193766f839d6f84f7afd5c9bb3c93) receive (and initiate) the entire supply of new tokens from addresses (like 0x000).

Users immediately (within a day) transfer tokens and some ETH to create a new Uniswap V2 pool. It holds all the liquidity and receives UNI-V2 tokens representing their contribution.

On average, 10 days later, users withdraw all liquidity, burn their UNI-V2 tokens, and collect additional ETH earned from the pool's trading fees.

When examining the on-chain data of these four tokens, a completely identical pattern is found. This proves that someone has meticulously orchestrated manipulation through automated and repetitive schemes, solely for profit.

Market Manipulation is Not Unique to DeFi

While the FBI's methods effectively exposed these practices, market abuse is not new to cryptocurrency and is not unique to DeFi. In 2019, the CEO of market maker Gotbit publicly discussed its unethical business of helping crypto projects "disguise" themselves, exploiting incentives from small exchanges to manipulate on their platforms. The CEO of Gotbit and two directors were also charged in connection with similar schemes involving multiple cryptocurrencies.

However, detecting such manipulation in centralized trading is relatively difficult. These exchanges only display market-level order and trading data, making it hard to identify fraudulent trades. However, comparisons of trading patterns and market indicators across exchanges can assist. For example, if trading volume significantly exceeds the liquidity of the asset and exchange (1% market depth), it may be due to wash trading. Tokens like meme coins, privacy tokens, and low-market-cap altcoins typically exhibit abnormally high volume-to-depth ratios.

It is worth noting that the volume-to-liquidity ratio is not a perfect indicator, as trading volume can be severely affected by exchange programs aimed at increasing trading volume, such as zero-commission promotions.

Cross-exchange correlation of trading volume can be examined. For an asset, trading volume trends are often long-term correlated across exchanges. Consistent, monotonic trading volumes, periods of zero trading volume, or discrepancies between different exchanges may signal abnormal trading activity.

For instance, when studying PEPE (which has a high volume-to-depth ratio on certain exchanges), significant differences in trading volume trends were noted between an anonymous exchange and other platforms in 2024. The trading volume of PEPE on that exchange remained high, even increasing in July, while the trading volume of PEPE on most other exchanges declined.

More detailed trading data shows that algorithmic traders were active in the PEPE-USDT market on that exchange. On July 3, there were 4,200 buy and sell orders of 1 million PEPE within 24 hours.

Similar trading pairs exhibited similar patterns on other trading days in July, confirming automated trading activity. For example, between July 9 and 12, over 5,900 buy and sell trades of 2 million PEPE were executed.

Some signs suggest the possibility of automated wash trading. These signs include high volume-to-depth ratios, unusual weekly trading patterns, and fixed-size, rapidly executed repeat orders. In fraudulent trading, an entity simultaneously places buy and sell orders to falsely inflate trading volume, making the market appear more liquid.

The Boundaries Between Market Manipulation and Inefficiency are Blurred

Market manipulation in the crypto market is sometimes mistaken for arbitrage, where traders profit from market inefficiencies.

The "Fishing Net Pumping" in the South Korean market is an example. Traders artificially inflate asset prices and profit by exploiting temporary pauses in deposits and withdrawals. A notable example occurred after the CRV token was hacked in 2023, leading to trading suspensions on several South Korean exchanges.

When a certain exchange suspended deposits and withdrawals for the CRV token, the price initially surged due to heavy buying. However, it quickly fell as selling began. During the suspension, the price experienced several brief spikes due to buying, but was always followed by selling. Overall, selling outpaced buying.

Once the suspension ended, prices rapidly declined as traders could easily buy and sell across exchanges to profit. Due to limited liquidity, these suspensions often attract retail traders and speculators who expect prices to rise.

Conclusion

Research on how to identify market manipulation in the crypto market is still in its early stages. However, combining data and evidence from past investigations can help regulators, exchanges, and investors better address this issue in the future. In DeFi, the transparency of blockchain data provides a unique opportunity to detect wash trading across all tokens and gradually improve market integrity.

In centralized exchanges, market data can highlight new market abuse issues and gradually align the incentives of some exchanges with the public interest. As the crypto industry evolves, leveraging all available data can help reduce harmful practices and create a fairer trading environment.