Tuesday, July 12, 2022

Pump-and-Dump Schemes

On June 29th the SEC rejected the application from Grayscale Bitcoin Trust to launch a Bitcoin ETF. Among the justifications the SEC provided for their decision were (page 22, my re-formatting):
The Commission has identified in previous orders possible sources of fraud and manipulation in the spot bitcoin market, including:
  1. “wash” trading;
  2. persons with a dominant position in bitcoin manipulating bitcoin pricing;
  3. hacking of the bitcoin network and trading platforms;
  4. malicious control of the bitcoin network;
  5. trading based on material, non-public information (for example, plans of market participants to significantly increase or decrease their holdings in bitcoin, new sources of demand for bitcoin, or the decision of a bitcoin-based investment vehicle on how to respond to a “fork” in the bitcoin blockchain, which would create two different, non-interchangeable types of bitcoin) or based on the dissemination of false and misleading information;
  6. manipulative activity involving purported “stablecoins,” including Tether (USDT);
  7. fraud and manipulation at bitcoin trading platforms
Bitcoin and the wider cryptocurrency markets have a long history of "persons with a dominant position in bitcoin manipulating bitcoin pricing" and "manipulative activity involving purported “stablecoins,” including Tether (USDT)". Among the techniques involved are "pump-and-dump" schemes. Below the fold I review the literature on these schemes, and follow up with a critique.


The cryptocurrency community has always been aware of the pump-and-dump epidemic. In December 2018 David Gerard wrote The ‘Bart’ — sudden hundreds-of-Bitcoin pumps or dumps, to burn the margin traders with a detailed account of a Bitcoin pump and dump:
You’ll typically see huge pumps, then stability for a few hours, then a huge dump. Crypto watchers call these “Barts”, ‘cos they look a bit like Bart Simpson’s haircut.

These aren’t just a crypto thing — you’ll see them for all manner of thinly-traded commodities in ill-regulated markets, or in forex.
This wasn't news to readers of Gerard's blog, he had been writing about Pump and Dump (P&Ds) schemes for some time. Here I review the academic literature I could find on the topic, in date order.

To the moon: defining and detecting cryptocurrency pump-and-dumps by Josh Kamps and Bennett Kleinberg (26th November 2018) used anomaly detection techniques applied to price histories of different cryptocurrencies on different exhanges, and found signals of P&Ds in both:
The exchanges Binance and Bittrex account for more of the pumps than the relative number of symbols analysed, suggesting these exchanges are utilised more for P&D schemes than others. Conversely, the exchange Kraken accounts for almost 6% of the symbols, yet less than 1% of the pumps. This is perhaps best explained by the fact that Kraken is one of the more regulated US-based exchanges, and deals mainly with crypto/fiat currency pairs, as opposed to crypto/crypto.
The data show that the most P&Ds for one symbol pair was 13, with the vast majority of symbols having between 0 and 3 P&Ds. This is consistent with the notion that specific coins may be targeted more often than others. Also interesting to note is that five of the top ten most pumped coins were pumped on the Bittrex exchange.
The Economics of Cryptocurrency Pump and Dump Schemes by JT Hamrick et al (December 2018) took a different approach:
We identified 3,767 different pump signals advertised on Telegram and another 1,051 different pump signals advertised on Discord during a six-month period in 2018. The schemes promoted more than 300 cryptocurrencies. These comprehensive data provide the first measure of the scope of pump and dump schemes across cryptocurrencies and suggest that this phenomenon is widespread and often quite profitable. ... We then examine which factors that affect the "success" of the pump, as measured by the percentage increase in price near the pump signal. We find that the coin's rank (market capitalization/volume) is the most important factor in determining the profitability of the pump: pumping obscure coins (with low volume) is much more profitable than pumping the dominant coins in the ecosystem.
Because they were monitoring the pumpers' messages, they were able to identify:
two distinct approaches to pumping cryptocurrencies: transparent pumps that openly promote coordinated purchases to raise prices and obscured pumps that set price targets instead. By making pump signals so obvious (e.g., pre-announcements, countdown messages, revealing the coin name at precisely the intended purchase time), the organizers of transparent pumps likely increased the chances of coordinated purchasing behavior to drive up prices. This is reflected in the superior returns to transparent pumps compared to obscure ones.
Detecting "Pump & Dump Schemes" on Cryptocurrency Market Using An Improved Apriori Algorithm by Weili Chen et al (4th April 2019) used the leaked Mt. Gox transaction dataset spanning April 2011 to November 2013 as input to an algorithm whose basic idea was:
As the key feature of a P&D scheme is the participated users buy or sell the digit asset in the same time period, thus we can detect P&D schemes by finding groups of users which usually buy or sell the asset in the same time period.
The Anatomy of a Cryptocurrency Pump-and-Dump Scheme by Jiahua Xu and Benjamin Livshits (14th August 2019) first analysed a single P&D in detail:
The pump-and-dump was organized by at least four Telegram channels, the largest one being Official McAfee Pump Signals, with a startling 12,333 members. Prior to the coin announcement, the members were notified that the pump-and-dump would take place on one of the Cryptopia’s BTC markets (i.e., BTC is the pairing coin).

Announcement: At 19:30 GMT, on November 14, 2018, the channels announced the target coin in the form of a OCR-proof picture, but not quite simultaneously. Official McAfee Pump Signals was the fastest announcer, having the announcement message sent out at 19:30:04. Bomba bitcoin “cryptopia” was the last channel that broadcast the coin, at 19:30:23.

The target coin was BVB, a dormant coin that is not listed on CoinMarketCap. The launch of the coin was announced on Bitcointalk on August 25, 2016. 5 The coin was claimed to be have been made by and for supporters of a popular German football club, Borussia Dortmund (a.k.a. BVB). The last commit on the associated project’s source code on GitHub was on August 10, 2017.

Although it has an official Twitter account, @bvbcoin, its last Tweet dates back to 31 August, 2016. The coin’s rating on Cryptopia is a low 1 out of possible 5. This choice highlights the preference of pump-and-dump organizers for coins associated with unserious projects.

During the first 15 minutes of the pump, BVB’s trading volume exploded from virtually zero to 1.41 BTC (illustrated by the tall grey bar towards the right end of the price/volume chart), and the coin price increased from 35 Sat 7 to its threefold, 115 Sat (illustrated by the thin grey vertical line inside the tall grey bar).

Price fluctuations: Further dissecting the tick by tick transactions (Figure 4), we note that the first buy order was placed and completed within 1 second after the first coin announcement. With this lightning speed, we conjecture that such an order might have been executed by automation. After a mere 18 seconds of a manic buying wave, the coin price already skyrocketed to its peak. Note that Bomba bitcoin “cryptopia” only announced the coin at the time when the coin price was already at its peak, making it impossible for investors who solely relied on the announcement from the channel to make any money.

Not being able to remain at this high level for more than a few seconds, the coin price began to decrease, with some resistance in between, and then plummeted. Three and half minutes after the start of the pump-and-dump, the coin price had dropped below its open price.
The authors then built:
a model that predicts the pump likelihood of all coins listed in a crypto-exchange prior to a pump. The model exhibits high precision as well as robustness, and can be used to create a simple, yet very effective trading strategy, which we empirically demonstrate can generate a return as high as 60% on small retail investments within a span of two and half months.
Cryptocurrency Pump and Dump Schemes: Quantification and Detection by Friedhelm Victor and Tanja Hagemann (8th November 2019) reports on:
quantification and detection of pump and dump schemes that are coordinated through Telegram chats and executed on Binance - one of the most popular cryptocurrency exchanges. We detail how pumps are organized on Telegram, and quantify the properties of 149 confirmed events with respect to market capitalization, trading volume, price impact and profitability. Based on this ground truth, and regular trading intervals obtained from twitter timestamps, we optimize a binary classifier in order to be able to detect additional suspicious trading activity. Our results indicate that pump and dump schemes occur frequently in cryptocurrencies with market capitalizations below $50 million, that scheme operators often organize their actions across multiple channels, that such activity tends to lead to inflated prices over longer time periods and machine learning can help to identify activity that is similar to known pump and dump schemes.
An Examination of the Cryptocurrency Pump and Dump Ecosystem by JT Hamrick et al (25th November 2019) continued their technique of joining P&D groups:
We quantify the scope of cryptocurrency pump and dump schemes on Discord and Telegram, two popular group-messaging platforms. We joined all relevant Telegram and Discord groups/channels and identified thousands of different pumps. Our findings provide the first measure of the scope of such pumps and empirically document important properties of this ecosystem.
We identified 952 pumps on Discord and 2,469 on Telegram over six months in 2018, then connected it with pricing data on nearly 2,000 coins across 220 cryptocurrency trading exchanges tracked by coinmarketcap.com.
We find that the median percentage price rise is 2.4-2.6% for the top 75 most popular coins, compared to 14-16% for the least popular coins ranked below 1,000 in terms of trading volume.
They conclude:
We identified two distinct approaches to pumping cryptocurrencies: transparent pumps that openly promote coordinated purchases to raise prices and obscured pumps that set price targets instead. By making pump signals so obvious (e.g., pre-announcements, countdown messages, revealing the coin name at precisely the intended purchase time), the organizers of transparent pumps likely increased the chances of coordinated purchasing behavior to drive up prices. This is reflected in the superior returns to transparent pumps compared to obscure ones.

Our analysis has implications for regulatory policy. Regulators could perhaps significantly disrupt future pump and dump schemes by focusing their efforts on the most prolific exchanges and brazen pump channels. Far from insurmountable, a concentrated ecosystem makes enforcement tractable.
Mirtaheri et al Fig. 1>
Identifying and Analyzing Cryptocurrency Manipulations in Social Media by Mehrnoosh Mirtaheri et al (17th December 2019) focused on the relevance of Twitter activity:
given financial and Twitter data pertaining to a particular coin, our method is able to detect, with reasonable accuracy, whether there is an unfolding attack on that coin on Telegram, and whether or not the resulting pump operation will succeed in terms of meeting the anticipated price targets. We also analyze activities of users involved in pump operations, and observe a prevalence of Twitter bots in cryptocurrency-related tweets in close proximity to the attack.
Charting the Landscape of Online Cryptocurrency Manipulation by Leonardo Nizzoli et al (18th June 2020) conclude:
  • We collect and share a large dataset for studying online cryptocurrency manipulations, comprising more than 50M messages and describing the online cryptocurrency ecosystem across three major platforms: Twitter, Telegram and Discord.
  • We uncover the pivotal role of Twitter bots in broadcasting invite links to deceptive Telegram and Discord channels, exposing a little-known social bot activity.
  • Instead of focusing on specific frauds, we let manipulation patterns naturally emerge from data, highlighting the existence of two different manipulations – namely, pump-and-dump and Ponzi schemes.
  • Our results describe Discord as a reasonably healthy online cryptocurrency ecosystem. In contrast, more than 56% of crypto-related Telegram channels are involved in manipulations. Moreover, these deceptive activities are massively broadcast with the help of Twitter bots.
Nizzoli et al Table 3
They used topic extraction techniques, which revealed both Ponzis and P&Ds as shown in their Table 3. In particular:
Whereas on Discord we found a negligible level of deception, on Telegram we retrieved 296 channels involved in pump-and-dump and 432 involved in Ponzi schemes, accounting for a striking 20% of the total.
Cryptocurrency Pump-and-Dump Schemes by Tao Li, Donghwa Shin and Baolian Wang (10th February 2021) used a difference-in-difference approach based on the Bittrex exchange's ban on Pump and Dump schemes starting 24th November 2017 to show:
significant wealth transfers between insiders and outsiders ... causal evidence that P&Ds are detrimental to the liquidity and price of cryptocurrencies.
One question is why, given the huge advantages enjoyed by the pump organizers, others are willing to participate. The authors:
discuss potential mechanisms why outsiders are willing to participate and describe how our findings shed light on manipulation theories.
Among their results are:
An “insider,” who knows the cryptocurrency identity and timing of the pump in advance and buys target cryptocurrencies ten minutes before the announcement and holds until 70 seconds after the announcement, achieves a nearly 25% return. For an “outsider” who does not know about a P&D in advance but buys immediately after the announcement and sells 70 seconds later, his return of 15% is still eye-popping.
Our estimates suggest that the Bittrex ban increased prices of its cryptocurrencies by about 4.5% (during a five-day window) to 10.0% (during a two-week window), and the volume by 24.2% (during a two-week window) to 33.2% (during a four-week window), respectively.
The Doge of Wall Street: Analysis and Detection of Pump and Dump Cryptocurrency Manipulations by Massimo La Morgia et al (3rd May 2021) examined two different types of manipulations, classic P&Ds and "crowd pumps" exemplified by Gamestop. As regards P&Ds:
Groups of highly coordinated people arrange this scam, usually on Telegram and Discord. We monitored these groups for more than 3 years detecting around 900 individual events. We analyze how these communities are organized and how they carry out the fraud. We report on three case studies of pump and dump.
La Morgia et al Fig. 4
Their Figure 4 shows the P&Ds that they found. They then report in detail on three case studies of P&Ds:
In the first, we perform an analysis of the pump and dumps groups, the targeted exchange, and the cryptocurrencies. In the second we focus on Big Pump Signal, arguably the biggest pump and dump group, able to generate a volume of transactions of 5,176 BTC in a single operation. Lastly, we present the case study of the Yobit exchange that organized 3 pump and dump operations in 2018.
Then they:
leverage our unique dataset of the verified pump and dumps to build a machine learning model able to detect a pump and dump in 25 seconds from the moment it starts, achieving the results of 94.5% of F1-score.
Finally they:
move on to the crowd pump, a new phenomenon that hit the news in the first months of 2021, when a Reddit community inflates the price of the GameStop stocks (GME) of over 1,900% on Wall Street, the world's largest stock exchange. Later, other Reddit communities replicate the operation on the cryptocurrency markets. The targets were Dogecoin (DOGE) and Ripple (XRP). We reconstruct how these operations developed, and we discuss differences and analogies with the standard pump and dump. Lastly, we illustrate how it is possible to leverage our classifier to detect this kind of operation too.
Profitability of cryptocurrency Pump and Dump schemes by Taro Tsuchiya (9th June 2021) showed that some exchanges are more P&D-friendly than others:
Yobit and Cryptopia are more sensitive (easily manipulated) to the increase in the trading volume than Binance and Bittrex, while controlling other significant factors, including the timing of the pump (hourly, yearly), the currency, and the Telegram channel.
Tsuchiya trained a model on PumpOlymp data:
The classification model succeeded in predicting more than 75% of the successful and unsuccessful pumps (out-of-sample) using information before the pump occurs.
A new wolf in town? Pump-and-dump manipulation in cryptocurrency markets by Anirudh Dhawan and Tālis J. Putniņš (12th November 2021) observed that P&D organizers make money only if others join in despite probable losses:
We investigate the puzzle of widespread participation in cryptocurrency pump-and-dump manipulation schemes. Unlike stock market manipulators, cryptocurrency manipulators openly declare their intentions to pump specific coins, rather than trying to deceive investors. Puzzlingly, people join in despite negative expected returns. In a simple framework, we demonstrate how overconfidence and gambling preferences can explain participation in these schemes. Analyzing a sample of 355 cases in six months, we find strong empirical support for both mechanisms. Pumps generate extreme price distortions of 65% on average, abnormal trading volumes in the millions of dollars, and large wealth transfers between participants.
Detecting cryptocurrency pump-and-dump frauds using market and social signals by Huy Nghiem et al (15th November 2021) used a neural network combining data extracted from social media and market data to:
predict the target cryptocurrency for each pump before its announcement using market and social media signals ... that are capable of forecasting the highest price induced by the pump after the cryptocurrency’s identity is revealed within 6.1% error margin.
Our experimental results serve as proof of a feasible forecasting expert system for identifying cryptocurrency pump-and-dump frauds using publicly available data.
Their dataset is interesting:
We focus on pump channels organized on Telegram, a cloud-based, crossplatform messaging service. We gather data from PumpOlymp, a website that collects and hosts comprehensive historical pump events on Telegram channels through various means as per direct conversation with PumpOlymp’s staff. PumpOlymp’s administrators search for possible channels using relevant keywords, such as ”pump”,”dump”,”signals”, etc. and their variants on search mediums such as Telegram’s site search, Twitter links, and Discord’s aggregators, including also tgstat.com, a website that mines Telegram-specific analytics. Pump channels also cross-promote each other, providing another possible venue for collection. Administrators then manually review this list of candidates to designate true pump channels based on previously outlined hallmark characteristics. Our collection of historical pump events retrieved from pumpolymp.com dates back from June 17th, 2018 to December 19th, 2019.
Our data includes pump activities on 4 exchanges: Binance, Bittrex, Cryptopia and Yobit for 355 unique cryptocurrencies. In the designated time period, 324 pump events transpired on Binance, followed by Yobit with 269, Cryptopia with 243, and Bittrex with 49.
Note that these machine learning models could be used to implement profitable algorithmic trading by predicting and joining P&Ds.


These papers agree on a number of points:
  1. P&Ds are frequent.
  2. They are organized on channels such as Discord and Telegram.
  3. They are extremely profitable for organizers and others who can trade on "material non-public information".
  4. P&Ds targeting smaller altcoins are both more prevalent and more profitable
The problem with this consensus is that, because the research measures the profitability of a P&D by spot trades in the targeted cryptocurrency, it downplays the type of P&D described by David Gerard and shown above. These target the major cryptocurrencies, primarily Bitcoin, and derive their profitability not from spot trades but from trades in the (roughly ten times larger) derivative market, which is dominated by financial institutions. As Gerard wrote explaining "Barts":
The motivation is to burn margin traders, whether short (betting the price will go down) or long (betting it’ll go up) — you’ll see a Bart when it’s profitable to manipulate the number that a derivative depends upon. Pump or drop the price a hundred dollars, win the margin bet against someone who bet the other way.
These P&Ds are profitable only for cryptocurrencies with a large, liquid derivative market. Because moving the price of such a cryptocurrency requires trading large amounts of stablecoins, they are available only to deep-pocketed players, who do not organize them on groups with names like Big Pump Signal. Gerard details one such event (actually a $40M D&P followed by a P&D):
The way it works is:
  1. Margin traders place bets on the Bitcoin price.
  2. Those bets depend on the price at other exchanges.
  3. You can win more on the bet than it would cost to fiddle the price to win the bet.
I don’t know what the margin bets were that were being targeted by the rise — but the sudden drop was a single sale, of 5,000 BTC on Bitstamp, around 02:50 UTC on the morning of Friday 17 May. The price bottomed out at 03:10 UTC at $6,178

This was a huge dump. Trading in all cryptos is very thin — clearing 5,000 BTC out of the Bitstamp order book at that time meant going from orders to buy Bitcoin at $7,800, all the way down to orders to buy at $6,178. And so, that was the bottom price.

This caused about $250 million of long positions on BitMEX to be liquidated, as the price used by BitMEX bottomed at $6469.15.

BitMEX doesn’t exchange bitcoins for US dollars itself — it takes its BTC/USD prices from Coinbase and … Bitstamp.
Note the >6-fold difference between the spot and derivative values. The profits available to these manipulations are likely much larger than those available by manipulating the spot markets.

1 comment:

David. said...

Molly White reports that John McAfee associate fined $376,000 for pump & dump scheme and undisclosed promotion of ICOs:

"In October 2020, the SEC filed charges against anti-virus software magnate, two-time Libertarian presidential candidate, and all-around shady character John McAfee, as well as his bodyguard, Jimmy Watson Jr. ... The SEC also charged the pair with participating in a pump and dump scheme, where they secretly bought large amounts of a cryptocurrency token before hyping it on Twitter (where McAfee had millions of followers), then selling the tokens as the price increased.

McAfee died by suicide in June 2021 in a Spanish prison, shortly before he was due to be extradited to the United States on tax evasion charges.
Now, the SEC has wrapped up the investigation, finding his partner in crime responsible for the ... pump and dump scheme. In addition to a $376,000 fine, Watson is prohibited from any professional cryptocurrency trading."