The Anatomy of a Cryptocurrency Pump-and-Dump Scheme Jiahua Xu, École polytechnique fédérale de Lausanne (EPFL); Benjamin Livshits, Imperial College London https://www.usenix.org/conference/usenixsecurity19/presentation/xu-jiahua This paper is included in the Proceedings of the 28th USENIX Security Symposium. August 14–16, 2019 • Santa Clara, CA, USA 978-1-939133-06-9 Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX. The Anatomy of a Cryptocurrency Pump-and-Dump Scheme Jiahua Xu Benjamin Livshits École Polytechnique Fédérale de Lausanne (EPFL) Imperial College London Imperial College London UCL Centre for Blockchain Technologies Harvard University Brave Software Abstract Regulation: In February 2018, the CFTC (Commodity Fu- tures Trading Commission) issued warnings to consumers [8] While pump-and-dump schemes have attracted the atten- about the possibility of cryptocurrency pump-and-dump tion of cryptocurrency observers and regulators alike, this schemes. It also offered a substantial reward to whistle- paper represents the first detailed empirical query of pump- blowers around the same time [12]. and-dump activities in cryptocurrency markets. We present In October 2018, the SEC (Securities and Exchange Com- a case study of a recent pump-and-dump event, investigate mission) filed a subpoena enforcement against an investment 412 pump-and-dump activities organized in Telegram chan- company trust and trustee for an alleged pump-and-dump ICO nels from June 17, 2018 to February 26, 2019, and discover scheme [27]. patterns in crypto-markets associated with pump-and-dump Clearly, regulators are aiming to find perpetrators of pump- schemes. We then build a model that predicts the pump likeli- and-dump schemes and to actively prosecute them. hood of all coins listed in a crypto-exchange prior to a pump. The model exhibits high precision as well as robustness, and This paper: In this paper, we trace the message history of can be used to create a simple, yet very effective trading strat- over 300 Telegram channels from June 17, 2018 to Febru- egy, which we empirically demonstrate can generate a return ary 26, 2019, and identify 412 pump events orchestrated as high as 60% on small retail investments within a span of through those channels. We analyze features of pumped two and half months. The study provides a proof of concept coins and market movements of coins before, during, and for strategic crypto-trading and sheds light on the application after pump-and-dump. We develop a predictive random for- of machine learning for crime detection. est model that provides the likelihood of each possible coin being pumped prior to the actual pump event. With an AUC (area under curve) of the ROC (receiver operating character- 1 Introduction istic) curve of over 0.9, the model exhibits high accuracy in predicting pump-and-dump target coins. While pump-and-dump schemes are a well-trodden ruse in Contributions: This paper makes the following contribu- conventional financial markets, the old-fashioned ploy has tions: found a new playground to thrive — cryptocurrency ex- changes. • Longitudinal study: This paper is the first research The relative anonymity of the crypto space has led to it study that examines routinely organized pump-and- becoming a fertile ground for unlawful activities, such as cur- dump events in the cryptocurrency space. We use rency theft (e.g. the DAO hack [1]), Ponzi schemes [26], and a unique dataset of pump-and-dump records from pump-and-dump schemes that have each risen in popularity June 17, 2018 to February 26, 2019 across multiple in cryptocurrency markets over the last few years. Due to crypto-exchanges and analyze crypto-market movements their end-to-end encryption, programmability, and relative associated with those pump-and-dump events. anonymity, new social media tools such as Telegram1 and Discord have become cryptocurrency enthusiasts’ preferred • Analysis: Our analysis shows that pump-and-dump ac- communication vehicles. While pump-and-dump schemes tivities are a lot more prevalent than previously believed. have been discussed in the press [29], we are not aware of a Specifically, around 100 organized Telegram pump-and- comprehensive study of this phenomenon to date. dump channels coordinate on average 2 pumps a day, which generates an aggregate artificial trading volume 1Note that not all Telegram traffic is end-to-end encrypted. of 6 million USD a month. We discover that some ex- USENIX Association 28th USENIX Security Symposium 1609 Figure 1: A successfully organized pump event. On the right hand side of the screenshot is the message history of a Telegram channel. The first message is the final countdown; the second message is the coin announcement; the last message presents the pump result. On the left hand side is the market movement of the corresponding coin around the pump time. changes are also active participants in pump-and-dump 2.1 Pump-and-Dump Actors schemes. Pump organizer: Pump organizers can be individuals, or, • Prediction: We develop machine learning models that, more likely, organized groups, typically who use encrypted given pre-pump market movements, can predict the like- chat applications to coordinate pump-and-dump events. They lihood of each coin being pumped with an AUC (Area have the advantage of having insider information and are the Under Curve) of over 0.9 both in-sample and out-of- ultimate beneficiaries of the pump-and-dump scheme. sample. The models confirm that market movements Pump participants: Pump participants are cryptocurrency contain hidden information that can be utilized for mon- traders who collectively buy a certain coin immediately after etary purposes. receiving the instruction from the pump organizer on which coin to buy, causing the price of the coin to be “pumped". • Trading strategy: We formulate a simple trading strat- Many of them end up buying coins at an already inflated price egy which, when used in combination with a calibrated and are the ultimate victim of the pump-and-dump scheme. prediction model, demonstrates a return of 60% over a Pump target exchange: A pump target exchange is the ex- period of three weeks, even under strict assumptions. change selected by the pump organizer where a pump-and- dump event takes place. Some exchanges are themselves di- rectly associated with pump-and-dump. Yobit, for example, Paper organization: The paper is structured as follows. In has openly organized pumps multiple times (see Figure 2). Section 2 we provide background information on pump-and- The benefits for an exchange to be a pump organizer are dump activities organized by Telegram channels. In Section 3 threefold: we present a pump-and-dump case study. In Section 4 we investigate a range of coin features. In Section 5 we build a 1. With coins acquired before a pump, it can profit by dump- prediction model that estimates the pump likelihood of each ing those coins at a higher, pumped price; coin for each pump, and propose a trading strategy along with the model. In Section 6 we summarize the related literature. 2. It earns high transaction fees due to increased trading In Section 7 we outline our conclusions. Finally, the Appendix volume driven by a pump-and-dump; specifies parameters of the models we have used in this paper. 3. Exchanges are able to utilize their first access to users’ order information for front-running during a frenzied 2 Background pump-and-dump. A pump is a coordinated, intentional, short-term increase in 2.2 A Typical Pump-and-Dump Process the demand of a market instrument — in our study, a cryp- tocurrency — which leads to a price hike. With today’s chat Set-up: The organizer creates a publicly accessible group or applications such as Telegram and Discord offering features channel, and recruits as many group members or channel sub- of encryption and anonymity, various forms of misconduct in scribers as possible by advertising and posting invitation links cryptocurrency trading are thriving on those platforms. on major forums such as Bitcointalk, Steemit, and Reddit. 1610 28th USENIX Security Symposium USENIX Association Telegram channels only allow subscribers to receive mes- sages from the channel admin, but not post discussions in the channel. In a Telegram group, members can by default post messages, but this function is usually disabled by the group admin to prohibit members’ interference. We use the terms channel and group interchangeably in this paper. Pre-pump announcement: The group is ready to pump once it obtains enough members (typically above 1,000). The pump organizer, who is now the group or channel admin, announces @YobitExchange details of the next pump a few days ahead. The admins broad- (a) Tweets from . cast the exact time and date of the announcement of a coin which would then precipitate a pump of that coin. Other in- formation disclosed in advance includes the exchange where the pump will take place and the pairing coin2. The admins advise members to transfer sufficient funds (in the form of (b) Pump timer from the Yobit website. the pairing coin) into the named exchange beforehand. While the named pump time is approaching, the admin Figure 2: The screen-shots demonstrate that the exchange Yobit was actively sends out countdowns, and repeats the pump “rules” such as: involved in pump-and-dump activities. 1) buy fast, 2) “shill”3 the pumped coin on the exchange chat box and social media to attract outsiders, 3) “HODL”4 the coin at least for several minutes to give outsiders time to join in, 4) sell in pieces and not in a single chunk, 5) only sell at a profit and never sell below the current price. The admin also gives members a pep talk, quoting historical pump profits, to boost members’ confidence and encourage their participation.