Cryptocurrency Trading Investigation: Market Manipulation & the LINK Token
In recent years the cryptocurrency community has made phenomenal strides towards legitimacy and integrity. However, there is no question that the ecosystem remains, in many respects, vulnerable, unregulated, and subject to systemic abuse. Even highly-reputable projects with entirely legitimate intentions can incur reputational damage at the hands of coordinated actors and highly concentrated crypto cabals.
The AnChain team’s recent analysis of the LINK token, inclusive of transactions between April 1, 2019 and July 26, 2019, revealed a pattern of suspicious activity that we believe to be indicative of a coordinated pump and dump manipulation.
What is Pump and Dump?
Pump and dump is a form of microcap fraud in which the price of an asset, often of low market cap and share volume, is manipulated by a group of coordinated actors through a series of high-volume purchases.
This artificially inflated demand triggers a dramatic increase in the price of the aforementioned asset, and is often accompanied by an influx of unknowing investors who are unaware of the manipulated nature of the spike. Often this phase is augmented through the proliferation of misleading positive statements or recommendations by experts, further driving casual traders to market.
Ultimately, the perpetrators dump their shares, flooding the market and overwhelming organic demand. At this point the share price of the asset plummets, leaving ordinary investors holding now heavily devalued shares.
Cryptocurrencies tend to be exceptionally vulnerable to this form of attack, as coins are often heavily concentrated in the hands of a comparatively small number of individuals, whose market activities can dramatically impact the coin price. When groups of these individuals collaborate, their combined market influence can easily manipulate market pricing.
While pump and dump manipulations are illegal and highly policed in the legacy economy, no such regulations exist in the crypto economy.
Overarching Timeline (Date, Time, Event, Price)
6/13/2019, 10:04:00 PST - Chainlink tweet: https://twitter.com/chainlink/status/1139217022477361152?lang=en
$1.19
6/13/2019, 11:44:00 PST - Google Cloud tweet: https://twitter.com/gcpcloud/status/1139242028498374656?lang=en
$1.93
6/26/2019, 12:27:00 PST - Chainlink tweet: https://twitter.com/blockonomi/status/1143963910447476736
$2.35
6/28/2019, 0:04:00 PST - Price Pump Starting Point
$2.24
6/28/2019, 10:21:00 PST - Coinbase adds LINK token: https://blog.coinbase.com/chainlink-link-is-now-available-on-coinbase-1f3df2e9d21d
$2.54
6/29/2019, 9:34:01 PST - LINK peaks.
$4.45
7/2/2019, 7:30:45 PST - LINK begins to drop.
$3.73
The Pump Phase
Starting on June 28, 2019 the token’s market price began to rise quite dramatically.
Examining the number of transactions and overall volume, we observed a corresponding hike starting on June 28, 2019.
Figure 9
Figure 10
As seen above in Figures 9 and 10, focusing closer on the time range between June 28–30, 2019 immediately reveals a small number of addresses (eg. 0x56d08812 in Figure 11) which account for a large proportion of LINK transferred in.
This presents reason to suspect that these addresses are performing a coordinated pump of LINK’s price on a particular exchange by purchasing large quantities of LINK.
Next, we track down the source of the LINK being traded, which ultimately originates from Binance exchange (0x0681dbbf in Figure 11). Examining the interactions between the suspicious address (0x56d08812) and the exchange address (0x0681dbbf), we observe that multiple jump addresses are used to mask the token flow; often an indicator of a user trying to cover their tracks and remain undetected.
Another traceable path is the ETH gas fee trace (represented by horizontal flows in Figure 11). By examining the small amounts of ETH transfer flows used for token transfer gas fees, we can see that all the ETH sent to the jump addresses are sourced from mining nodes (0xea678ec8, 0x2a658226). This is a sophisticated tactic that hides the player’s real address.
Below is a flow chart of the two tracing paths:
Horizontal flows represent ETH transfer flow. Vertical flows represent LINK transfer flow.
Figure 11
The Dump Phase
By monitoring the initial addresses who received a large amount of tokens at the time of token creation, we found one address (0xdad2e11f) which sold 4.2M tokens between July 2–15, 2019. The user behind this address utilized multiple jump addresses and finally transferred the tokens to the Binance exchange (0x355cf0bE) for trading.
We can continuously monitor any of the suspicious addresses (0xdad2e11f) to automatically catch any further operations moving forward.
In addition, by following the ETH gas fees we can identify large numbers of jump addresses that are being used to obfuscate the transfer flow.
Despite such a large number of jump addresses, we can trace the source back to exchanges (0x1522E428, 0x730fa60f) and observe that many of the direct, or second hop, receiver addresses from these exchanges are wallets (0x53f68d6c) that hold large amounts of ETH.
By keeping an eye on these addresses for suspicious activity moving forward, we can induce whether those behind these addresses are supporting more jump addresses and aiming to trigger another round of dump and pump schemes on the same token, or a new one. This is a useful leading indicator for when and where the next pump and dump scheme will take place.
Below is a flow chart of the two tracing paths:
Horizontal flows represent ETH transfer flow. Vertical flows represent LINK transfer flow.
Figure 12
What Can The Crypto Community Do?
While the community at large has undoubtedly directed impressive effort towards market integrity, we believe that further diligence is crucial for the ecosystem moving forward. If cryptocurrencies are to thrive moving into the future, regulation must become the center of conversation.
It is tempting, in a market as volatile as cryptocurrency, to dismiss dramatic market shifts as natural erratic consequences of a market in flux. Market manipulations of this exact sort, however, have a lasting negative impact on the image of cryptocurrency in the mainstream media that is not so easily repaired. We encourage the cryptocurrency sector as a whole to make legitimacy and market integrity a top priority as it continues to grow.
Conclusion
The inherent immutability of the blockchain allows for deep analysis of marketplace activity and network interaction. Utilizing our analytics capabilities and proprietary platform, we are able to construct a directory of key addresses, affiliations, and transaction pathways in order to create a clear picture of the many moving pieces behind various token price movements.
The implications of these discoveries are far-reaching: beyond the ability to uncover and blacklist players and addresses involved in collusion and market manipulation from a security perspective, comprehensive analytics of this nature can be utilized predictively, allowing for high-velocity responses to market trends and protracted surveillance of addresses with a history of anomalous behavior.
