See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/341396077

Pump and Dumps in the Bitcoin Era: Real Time Detection of Cryptocurrency
Market Manipulations

Preprint · May 2020

CITATIONS READS

0 15,509

4 authors:

Massimo La Morgia Alessandro Mei

Sapienza University of Rome Sapienza University of Rome
26 PUBLICATIONS 141 CITATIONS 122 PUBLICATIONS 3,842 CITATIONS

SEE PROFILE SEE PROFILE

Francesco Sassi Julinda Stefa

Sapienza University of Rome Sapienza University of Rome
12 PUBLICATIONS 54 CITATIONS 55 PUBLICATIONS 2,304 CITATIONS

SEE PROFILE SEE PROFILE

All content following this page was uploaded by Massimo La Morgia on 09 July 2020.

The user has requested enhancement of the downloaded file.

 Pump and Dumps in the Bitcoin Era: Real Time
Detection of Cryptocurrency Market Manipulations
Massimo La Morgia, Alessandro Mei, Francesco Sassi, Julinda Stefa
Department of Computer Science, Sapienza University of Rome, Italy

Email: {lamorgia, mei, sassi, stefa}@di.uniroma1.it

case of alleged pump and dump [3]. The suit is linked to an

Abstract—In the last years, cryptocurrencies are increasingly investigation of the US SEC, a US financial regulator. Now,
arXiv:2005.06610v1 [cs.CY] 4 May 2020

popular. Even people who are not experts have started to invest in pump and dumps are led by a large number of self-organized
these securities and nowadays cryptocurrency exchanges process
transactions for over 100 billion US dollars per month. However, groups over the Internet, and the phenomenon is viral though
many cryptocurrencies have low liquidity and therefore they are still not very well known.
highly prone to market manipulation schemes. In this work we describe the pump and dump phenomenon
In this paper, we perform an in-depth analysis of pump and in the cryptocurrency ecosystem. We present two relevant case
dump schemes organized by communities over the Internet. We
observe how these communities are organized and how they carry
studies. In the first, we perform a longitudinal analysis of
out the fraud. Then, we report on two case studies related to the gathered pump and dumps on 4 different exchanges. In
pump and dump groups. Lastly, we introduce an approach to the second, we focus on Big Pump Signal, the biggest group
detect the fraud in real time that outperforms the current state we found in our research. Big Pump Signal is a group that
of the art, so to help investors stay out of the market when a works on Binance, able to generate a volume of transactions
pump and dump scheme is in action.
of 5, 176 BTC in a single operation, higher than the 534
Index Terms—Cryptocurrencies, Fraud Detection
BTC volume generated together by all the pump and dumps
scheme arranged on Cryptopia, YoBit and Bittrex according
I. I NTRODUCTION
to [4]. Lastly, we introduce a novel detection algorithm that
Pump and dump is a market manipulation fraud that consists works in real-time. The algorithm is not just based on the
in artificially inflating the price of an owned security and then detection of the abrupt rise of the price. The fundamental idea
selling it at a much higher price to other investors [1], [2]. This is to leverage the abnormal growth of so-called market buy
fraud is as old as the stock market. One of the most famous orders, buy orders that are used when the investor wants to buy
pump and dumps of Wall Street history happened in the late extremely quickly, whatever the price is. Just like the colluding
’20. The security was the RCA Corporation, the manufacturer members of a pump and dump group when the pump starts.
of the first all electric phonograph. At that time, one of We show that our real-time detector outperforms the current
the hottest pieces of technology. The fraud was organized state of the art [5] in a significant way, improving the expected
by the ”Radio Pool”, a group of investors that artificially speed of the detection from 30 minutes to 25 seconds and, at
pumped RCA to the incredible price of $549, and then dumped the same time, the F1-score from 60.5% to 92%.
the shares making the price plummet to under $10. A large
number of investors lost all of their savings in this operation.
Communication was done through the radio, tabloids, and II. P UMP AND DUMP GROUPS
word of mouth. In the Bitcoin era, pump and dumps are more
vital than ever. Indeed, communication is done through the Pump and dumps are performed by self-organized groups of
Internet and the Web, and the targets are the hectic and almost people over the Internet. These groups arrange the frauds out
non-regulated markets of cryptocurrencies. in the open on the Telegram [6] instant messaging platform or
The most common way to buy cryptocurrencies is through Discord server [7], thus everyone can join the groups without
a cryptocurrency exchange. Exchanges convert fiat currencies prior authorization. During our longitudinal research, from
into cryptocurrencies, and cryptocurrencies between them- July 2017 to January 2019, we joined and daily followed
selves. A cryptocurrency exchange works exactly like the all the activities performed by more than 100 groups. Being
traditional stock exchange. There are now hundreds of cryp- member of the groups allowed us to retrieve and collect one
tocurrencies, the market is not strictly regulated, and prices are of a kind information such as internal group organization, the
easy to manipulate. So, pump and dumps on these securities phases of pump and dump arrangement and how the groups
are incredibly common, with public groups in the Internet, attract outside investors inside the market. Table I shows
rules, and precise and complex organization. One of the first some metrics and characteristics of 8 representative groups
cases known to the public involves cryptocurrency prophet we joined. In the following section, we report on the findings
John McAfee, who is one of the defendant in a complicated we discovered about these communities.

©20xx IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including
reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or
reuse of any copyrighted component of this work in other works.
 TABLE I
M ETRICS OF PUMP AND DUMP GROUPS

Group name Telegram Users Discord Users Hierarchy Main Exchange PnD (#) avg. Volume ($)
Big Pump Signal 72, 097 104,830 affiliation Binance 32 7,245,437
Trading Crypto Guide 91, 725 — vip Binance 17 2,442,923
Crypto Coin B 166, 689 — vip Binance 6 5,733,637
Crypto4Pumps 11, 716 — vip Bittrex 47 491,395
Pump King Community 7, 771 — vip Bittrex 18 931,960
Crypto Family Pumps 4, 449 5,299 free Cryptopia 28 23,800
Luxurious pumps 6, 020 — free YoBit 16 4,997
AltTheWay 7, 333 — free YoBit 89 700

is an instant messaging service, and a Telegram channel is a

special kind of a chat in which only the owner of the channel
can broadcast public messages to all the members. Discord is
a VoIP and text chat service. It was originally designed for
video gaming communities, but nowadays it is widely used
by other communities as well.
Discord offers the possibility to create macro sections and
host multiple chat rooms. Each section has its own topic. In our
analysis we have found that all the pump and dump Discord
Fig. 1. Screenshot of a Discord Info room, where it is explained how the servers are organized in roughly the same fashion, with the
affiliation system works.
following sections:
• Info & How-Tos: These two sections are like an elec-
A. Group organization tronic bulletin board with pinned messages. Both sections
are composed of several rooms that contain only one
Pump and dumps groups have leaders (or admins) that
or very few messages. The rooms of the Info section
administrate the group, and a hierarchy of members. If a
usually contain the rules of the group, the news about
member is higher in the hierarchy, he gets the message that
the group, how the affiliation system works (Fig. 1), and
starts the pump by revealing the target cryptocurrency a few
the F.A.Q.. The rooms of the How-Tos section contain
moments earlier than lower ranked members. This way, the
manuals related to the cryptocurrency world or the best
member has higher probability to buy at a lower price and
practices to participate in a pump and dump operation.
make more money out of the pump and dump operation. The
• Invite: This section contains rooms where the bots of the
advantage in terms of time of being at a higher level is usually
server live. Here, the users can query the bots in order to
between 0.5 and 1 second with respect to the next level, and
generate invite links to bring new members or to know
the maximum advantage is in the interval between 3 and 8
the number of people that joined the server by using their
seconds. Most groups are organized as an affiliation system
invite links.
—climbing the hierarchy is possible by bringing new people
• Signal: This is the core section of the group, in which
to the group. The larger is the number of new members brought
only the admins can write. Inside this section there are
to the group, the higher the ranking. Fig. 1 shows the affiliation
usually two rooms: The pump-signal, and the trading-
system of Big Pump Signal group and the rank’s benefits.
signal. In the first room, the admins share info about the
Some groups have a simpler hierarchy with only two levels:
next pump and dump operation. In the second, they share
Common members and VIP members. In these groups, to
trading advices.
become a VIP the user has to pay a fee, usually in Bitcoins,
• Discussion: in this section, there are rooms covering
in the range of 0.01 to 0.1 Bitcoins (from approximately 71 to
different topics where the group members can freely chat.
710 USD at current exchange rates1 ). In the pump and dump
groups, the admins are the only people that take decisions. We Usually, the messages written in the news and in the pump-
saw only in rare cases the admins running polls to agree on signal rooms are broadcasted to the Telegram channel as well.
the hour of the pump or the exchange to use, and never to C. Organization of the pump and dump operations
decide the target cryptocurrency.
The levels of activity of the many pump and dump groups in
B. Group communication the Internet differ considerably. The most active ones perform
To communicate and organize the pump, the groups typ- roughly one pump and dump operation a day. Less active
ically use Discord servers and Telegram channels. Telegram groups perform one operation a week. Other groups perform
operations only when they believe the market conditions are
1 Data retrieved on January 10, 2020 good. The steps during the operation are typically as follows:
 and dump operations carried out on 4 exchanges. For all the
pump and dumps collected, we retrieved the historical trading
data, as much detailed as we can, scraping the exchanges’
website or via APIs. Analyzing our data, we found that the
scheme involved 194 different cryptocurrencies, only 143 of
which are still listed by the Coinmarketcap site. It is quite
common that coins disappear from the cryptocurrency world.
Indeed, by analyzing the volumes in the last 24 hours of the
cryptocurrencies that are still active, we found out that 112 of
them moved less than $1 million in total in all the exchanges
Fig. 2. Messages that indicate the start of a pump and dump operation on in which they are listed. Actually, 46 of them moved less than
the Streamr DATAcoin (on the left) and the NevaCoin (on the right).
$10, 000.

• A few days or hours before the operation the admins Also, 100 of the coins used for pump and dumps are below
announce that the pump and dump will happen and 20 million dollars of market capitalization, with 34 of them
communicate which is the exchange that will be used, being below 1 million. The first asset with less than 20 million
the exact starting time of the operation, and whether the dollars is at the 220th position of the cryptocurrency ranking
operation will be FFA (Free for All—everybody gets the by market capitalization. So, the targets of pump and dumps
message at the same time) or Ranked (VIPs and members have a very low net worth value and a huge amount of
of higher levels in the hierarchy get the starting message circulating supply. Lastly, we find that 99 cryptocurrencies
before the other members). out of 141 are priced below 0.4 dollars. As such, with a
• The announce is repeated several times, more frequently relatively small investment, pump and dump groups can buy
as the starting time of the operation gets closer. huge amounts of shares and easily increase their price in the
• When the pump starts, the target cryptocurrency is re- pump phase of the fraud.
vealed to the members of the group. The exact time
depends on the position in the hierarchy. Usually, the
YoBit is the exchange where most of pump and dump op-
name of the cryptocurrency is contained in an image
erations happen, while Binance is the most popular exchange
that is obfuscated in a way that only humans can read it
among all groups. Each pump and dump group tends to use
quickly. Fig. 2 shows an example, a message that instructs
the same exchange. Indeed, if the groups jumped from one
to start a pump and dump operation on the NevaCoin. The
exchange to the other, the members would be forced to move
idea behind the obfuscation is to make it hard for bots
their assets accordingly and pay the related fees. The pump
to parse the message with OCR techniques and start the
and dumps on currencies with higher market capitalization
market operations faster than humans.
are typically carried out on Binance, the ones with lower
• Lastly, a few seconds after the start of the pump, the
market capitalization on Cryptopia. In particular, the median
admins share a tweet or a news and invite all the members
market capitalization of the cryptocurrencies for exchange is
of the group to spread the information that the price of
$25, 574, 192 for Binance, $2, 619, 703 for YoBit, $2, 512, 627
the cryptocurrency is rising. This is done in dedicated
for BitTrex, and $144, 373 for Cryptopia.
chat boxes, forums, and Twitter. The goal of this activity
is to create so-called FOMO (Fear of Missing Out) of a
good opportunity of investment and attract investors from Finally, we notice that pump and dump schemes do not
outside the group. affect only the target exchange. Indeed, the cryptocurrency
markets, like the real stock exchange markets, are constantly
III. C ASE STUDY under monitoring of arbitrage bots that look for profitable trad-
ing. Arbitrage is a practice that consists of taking advantage
A. The groups, the pump and dumps, and the exchanges of the price difference between two markets by buying in
In this section, we describe an in-depth investigation on the one market and selling in another market at a higher price.
cryptocurrencies and the exchanges used for the pump and Some seconds after a pump and dump starts, the price of the
dumps. We do so in a period of time that goes from July coin under attack quickly increases its price. The price spike
2017 to January 2019. In this period, we found more than 100 triggers the arbitrage bots that start to buy and sell the currency
groups, by keyword search (e.g.: ”Pump”,”Dump”,”Signal”) on a different market or other trading pairs. Table II reports the
on Telegram, Twitter, Reddit, BitcoinTalk [8], or manually values during the pump and dump carried out on the Streamr
extracting information from CoinDetect [9] or the PADL [10] DATAcoin (DATA) of the 29th of September 2018 for different
Android app. From this set, we select 19 different groups, since exchanges. As we can see, the biggest transaction volumes
the other are no longer active, only broadcast event from other and the highest prices are reached on Binance. Indeed, it was
groups, or the number of users was quite small. Reading the the exchange used for the operation. However, also the other
Telegram channel history of these groups, we found 343 pump exchanges record a rise of the price in the same time range.
 TABLE II
E FFECT OF ARBITRAGE .

Trading pair Exchange Volume ($) Open ($) Max($)

DATA/BTC Binance 5, 732, 909 0.0354 0.0916
DATA/ETH Binance 568, 722 0.0353 0.0924
DATA/BTC Bitfinex 103, 318 0.0353 0.0564
DATA/ETH Bitfinex 62, 640 0.0333 0.0552
DATA/USD Bitfinex 175, 274 0.0349 0.0551
DATA/BTC HitBTC 27, 502 0.0359 0.0564
DATA/ETH HitBTC 5, 084 0.0330 0.0735
DATA/USDT Gateio 31, 357 0.0347 0.0600

B. The Big Pump Signal group

Fig. 3. Big Pump Signal pump and dumps
With more than 104, 000 members on Discord and more
than 72, 0002 members on Telegram, Big Pump Signal (BPS)
started in December 2017 over Telegram and is arguably the
the purchasing power in a single trading pair to get maximum
largest pump and dump public community in the Internet.
gain.
Reading the pump announcements on the Telegram channel
of Big Pump Signal, we found 32 pumps, 27 of which Successively, the admins discovered the presence of bots
carried out on Binance (see Figure 3)and 5 on Cryptopia. inside the channel. The bots were very fast at buying, much
Throughout all their pump and dump operations, the group faster than the group members. To mitigate their effect, the
moved 82, 369, 542 USD globally, if we count the first 6 admins changed the pump and dump signal–from a text, to an
minutes of every pump, and 267, 482, 773 USD globally, if obfuscated image–so that it was extremely difficult for bots to
we count the whole coin oscillation due to the pump. Their read.
most successfully pump and dump was organized on May As the group grew bigger, the admins started targeting
10, 2018, when they targeted the SingularDTV (SNGLS) alt- also cryptocurrencies with medium market capitalization. The
coin. In this operation, the value of the SNGLS coins sharply admins claim that the choice of the coin is typically based
oscillated for more than 9 hours and recorded a volume of on technical analysis. They also claim to re-pump the cryp-
trades of 5, 176 Bitcoin (36, 750, 000 USDs). BPS has an tocurrencies by collaborating with a small investment firm.
affiliation hierarchy, the highest level of which is achievable The investment firm is thought to be frequently involved in
after inviting 250 new members. In ranked pump and dump or to organize pump and dumps on her own. An example are
operations, the affiliation guarantees the members to receive the pump and dumps of the Monetha coin (MTH) and the
the signal 3 seconds before the unranked members. The Big WePower (WPR) coin on the Binance platform on September
Pump Signalers have, since the beginning, promoted the group 17, 2018. Our analysis shows that BPS typically chooses cryp-
in many ways: Advertisement on main social networks like tocurrencies that have had a steady price and news coverage
Twitter and Quora, through the affiliation systems, and, by in the recent past. They exploit the news coverage to generate
organizing lotteries inside the groups with prizes in Bitcoin interest and attract external investors. An example are the
or Ethereum. Thanks to the aggressive marketing campaigns retweets of news from the fake twitter account of John McAfee
and the hype on the cryptocurrencies in late 2017, the Big (@oficiallmcafee, and the still reachable @TheJohnMcafee)
Pump Signal group has grown extremely fast reaching around belonging to the admins of the group.
200, 000 members in January 2018. 2) Analysis of the pump phase: The BPS group moves large
1) Organization of the BPS operations: The organization of volumes of Bitcoins in each operation. We analyse one of
the BPS pump and dumps steadily improved with time. In the these operations to investigate in depth the pump phase, the
beginning, they operated on a single coin, while double trading most interesting step of a pump and dump operation. Figure. 4
on the Bitcoin and Ethereum target pairs. The target coin was depicts a second by second zoomed image on the very first
revealed to the members in plain text. They were also given 30 seconds of the pump on the OAX cryptocurrency. The
a target price with the goal of pushing the pump up to the upper (blue line) in the figure represents the buy volume, while
target so to attract external investors and, afterwards, profit the (lower) orange one the sell volume. We observe that the
by selling to them. However, this strategy was the opposite volume of the buys and sells in the first seconds is very close to
of being optimal for the admins: They noticed that greedy zero. Then, there are two buy peaks (blue line in Figure 4) of
group members started to sell below the target price value, approximatively 65 Bitcoins (sec. 19) and 26 Bitcoins (sec. 21)
forbidding the pump and dump operation to reach the highest respectively. The two peaks correspond to the actions of VIPs
peaks. So, they stopped indicating the target price and carried and the common members—a normal behavior, considering
that the group has a ranked policy. We also observe a peak
2 Data retrieved on January 2019 on the sell volumes (orange line in Figure 4) of almost 10
 until the requested amount of currency is reached. Although a
market order is completed almost instantly, the price difference
between the first and the last ask needed to fill the order can
be very high, especially in markets with low liquidity, and so
the price can rise considerably. A more careful investor would
use limit buy orders, orders to buy a security at no more than
a specific price. Buy market orders are not frequent in normal
transactions and are typically used by investors that need a fast
execution. Just like the members of pump and dump groups
in action. Our idea is to use this pattern, along with other
information about volume and price, to detect when a pump
and dump scheme starts.

B. The data
Fig. 4. Pump on the OAX
As highlighted by Kamps et al. [5], it does not exist a dataset
of confirmed pump and dumps in the literature. So we need to
Bitcoins on the moment of the first buy peak, the 19th second. build one for the purpose of this work. Starting from the 19
Considering that group members are still buying and that the groups we joined, we select only the pump and dump schemes
reaction time for outsiders is too short, this sudden big sell carried out on Binance. We made this choice for two main
volume is abnormal. In fact, there can be only two possible reasons: The first one is that Binance exposes APIs [11] that
actors to sell their shares: the bots and the admins. In order allow to retrieve every single transaction in the whole history
to discern among the two we need to investigate the single of a trading pair, differently from other exchanges that allow to
transactions. Our analysis shows that, as the price rises, there retrieve data with a transaction granularity only for few hours
are many small sell operations at incremental values, probably back. The second is that pump and dumps on other exchanges
by the arbitrage bots. Then, we observe a last single shot are usually carried out by groups with few active members
transaction for over 4 Bitcoins when the OAX coin reaches and economic resource, consequently they are forced to target
the trading value of 0.00012 Bitcoins, probably done by the alt-coin that have almost no volume of transactions for days
admins of the group. We believe they have operated through before the scheme. Thus, we believe that pump and dumps
a sell limit trade order—a conditional order triggered when carried out on Binance are the most interesting and challenging
the price of a trading pair reaches/out-tops a given value. Of to detect. From the initial set of pump and dumps, we select
course, the same order could have been placed also by an all the events that were carried out on Binance. At the end
outside investor. However, we believe that a sell limit for that we get 104 pump and dump events, arranged by 12 different
amount and that overcomes the initial price of the 41% is most groups. Doing so, we retrieve the historical trading data for 7
likely by an insider. days before and after the event, for a total of 14 days. Some
pump and dumps were carried out a few days apart on the
IV. P UMP AND DUMP DETECTION
same alt-coin, so we discarded duplicate days. In the end, we
A. The idea have about 900 days of trading. The data are a list of trade
As we know, standard investors are the victims of pump records: Volume, price, operation type (buy or sell), and the
and dump schemes. When they see that the price of a cryp- UNIX timestamps. The trades are provided by Binance in a
tocurrency rise, they can believe it can be a good investment compressed way, this means that a record belonging to the
opportunity. This is not the case when a pump and dump same order at the same price have aggregated quantities, and
scheme is in action—the rise does not have economical a single order that is filled at different prices is splitted into
grounds, it is just market manipulation. To protect investors, more records.
it is important to understand if a pump and dump scheme can Unfortunately, the Binance APIs do not tell the kind of order
be detected, and how fast it can be done. This is the goal of (e.g.: Market, Limit, Stop Loss) placed by the buyer, so we
this section. need to infer this information. To do this, we can use the
To better understand how pump and dumps can be detected, fact that these kind of orders are filled in a single shot, and
it is important to have some basic notions. The pending orders so we can aggregate the trades filled at the same millisecond
for a cryptocurrency, like any other security, are listed in the as a single one. Since we do not know the original nature
order book for that cryptocurrency. The book is a sorted double of these orders we define them as rush orders. A problem
list of sell (ask) and buy (bid) orders not yet filled. The asks of this inference method is that it misses the orders that are
are sorted from the lowest price to the highest, the bids are completely filled by the first ask of the order book. Still, we
sorted from the highest to the lowest. The fastest way to buy believe that we have a good witness on the abrupt rise of
on the market is through a buy market order. A buy market market orders even with this approximation. As a contribution
order looks up the order book and fills all the pending asks to the community we will publicly release this dataset.
C. Features and classifiers
To detect the start of the fraudulent scheme, we analyze
several kinds of features and use them to feed two different
classifiers: Random Forest and Logistic Regression. A Ran-
dom Forest [12] is an ensemble learning method consisting
of a collection of decision tree classifiers such that each tree
depends on the values of a random vector sampled indepen-
dently, each tree casts a vote, and the prediction is the most
popular class among all the votes. Logistic regression [13] is
a type of regression analysis used to calculate the outcome
of dependent variables based on one or more independent
variables estimating the parameters of a logistic model, where
the value of the predictor variable is between 0 and 1. We built Fig. 5. Precision recall curve for train and test sets.
our features upon the idea of [14] for the detection of Denial
of Service attacks through an adaptive threshold. Since in our
case we do not want to find a threshold, we restyle their idea
in this way: We split our data in chunks of s seconds, and we
define a moving window of size w hours.
We conduct several experiments with different sets of fea-
tures and settings regarding the window and the chunk sizes.
Since our goal was to build a classifier able to detect a pump
and dump scheme as quickly as possible from the moment
it starts, it is crucial that the chunk size is reasonably short.
At the end of our study, we found that the best configuration,
in terms of F1-score, was achieved with a chunk size of 25
seconds and a window size of 7 hours, while the fastest one
with a chunk size of 5 seconds and a windows size of 50
minutes. Following are reported the final features we used: Fig. 6. Rush orders during a pump and dump scheme.
• StdRushOrders and AvgRushOrders: Moving standard
deviation and average of volume of rush orders in each
in Section IV-C, then we label each chunk as True if the
chunk of the moving window.
timestamp of the pump and dump signal falls into the chunk
• StdTrades: Moving stardard deviation of the number of
time range, False otherwise. We randomly split our dataset into
trades, both buy and sell.
the train (50%) and test (50%) sets, we compute the precision-
• StdVolumes and AvgVolumes: Moving standard devia-
recall curve for the train set, and we pick a threshold that is a
tion and average of volume of trades in each chunk of
tradeoff between the precision and the recall. Then we evaluate
the moving window.
the same metrics at the picked threshold for the test set. The
• StdPrice and AvgPrice: Moving standard deviation and
result of this experiment is shown in Fig. 5. We choose as value
average of closing price.
for the threshold (the black dashed line in the figure) 30.32
• AvgPriceMax and AvgPriceMin: Moving average of
that provides a precision of 91.1% and a recall of 89.9% on
maximal and minimum price in each chunk.
the train set (the blue line). As we can see, the same threshold
Once a pump is detected we pause our classifier for 30 value provides a very similar score on the test set too (the red
minutes to avoid multiple alerts for the same event. dashed line). Given these good results, we can assume that the
rush orders feature is an extremely good parameter to evaluate
D. The importance of rush orders
the start of a pump and dump.
In this section, we explore how the rush orders are important
to detect the start of a pump and dump operation. Fig. 6 E. The results
shows the number of rush orders during a pump and dump Although we retrieved 2 weeks of data for each pump
scheme on the VIBE cryptocurrency on September 9th, 2018. and dump scheme, initially we use only 3 days—the day of
As we can see, rush orders are rare during the hours before the the fraud, the day before, and the day after—since in this
pump and suddenly grow just at the start of the scheme. The timeframe we can assume that no other frauds are present in
goal of this experiment is to understand if the rush orders the dataset. We noticed that, among the market manipulations
are an effective feature to detect the start of a pump and we collected, different groups arrange schemes on the same
dump scheme and find a threshold beyond which classify the alt-coin a few days apart. Moreover, we are aware that some
growth as anomalous. To learn the threshold, we proceed as groups delete the pump and dump signal from the chat history
follows: We compute the StdRushOrder feature as described and that there do exist groups that we are not able to monitor
 TABLE III
C LASSIFIERS PERFORMANCE .

Classifier Chunk size Precision Recall F1

Kamps (Initial) 1 Hour 15.6% 96.7% 26.8%
Kamps (Balanced) 1 Hour 38.4% 93.5% 54.4%
Kamps (Strict) 1 Hour 50.1% 75.0% 60.5%
RF (5 Folds) 5 Sec 92.4% 78.4% 84.0%
RF (10 Folds) 5 Sec 92.2% 77.5% 82.7%
RF (5 Folds) 15 Sec 91.3% 84.4% 87.7%
RF (10 Folds) 15 Sec 91.1% 83.3% 87.0%
RF (5 Folds) 25 Sec 93.7% 91.3% 91.8%
RF (10 Folds) 25 Sec 93.1% 91.4% 92.0%

Fig. 7. DLT candlestick chart

TABLE IV
F EATURE I MPORTANCE .

Feature Importance public. Fig. 7, for example, shows the candlestick chart for
StdRushOrders 0.401 the Agrello coin (DLT), from May 8 to 13. The event in the
StdTrades 0.202 center is a pump and dump for which we have evidence, the
AvgRushOrders 0.153 other two are suspects detected by the algorithm. As you can
AvgVolumes 0.097 see, the behavior is almost the same, including the fact that the
StdVolumes 0.076 currency goes back to the normal price quickly (the dump).
StdPrice 0.026
AvgPrice 0.014 Our classifier, based on the detection of the abnormal presence
AvgPriceMax 0.014 of rush orders and not just on the price of the security, does
AvgPriceMin 0.011 a good job in detecting pump and dumps and suspect events
that, anyways, the mindful investor wants to stay away from.
The classifier is also very fast—in all the cases the pump and
such as groups that communicate in Chinese or Russian or in dump is detected within a timeframe of 5 seconds and, in
private groups. Since our dataset consists of 104 pump and some cases, even before the start of the pump when there is
dumps, we do not split the dataset into the standard train test pre-pump activity in action.
sets, but we performed a 5 and 10 folds cross-validation, in
order to get a more reliable evaluation of the performance. F. Comparison with other pump and dump detectors
For the Random Forest classifier we use a forest of 200 trees, After validating our classifier, to better understand the
each leaf node must have at least 6 samples, and a maximum performance of our solutions we introduce the pump and dump
depth of 4 for each tree. For the Logistic Regression classifier, detector of Kamps et al. [5] as the baseline. In their work,
we used the BFGS solver with a regularization strength of C they simulate a real-time detector using as input candlesticks
equals to 1. Since we notice that the classifiers based on the of 1 hour to detect pump and dumps. So, detection time
Random Forest algorithm perform slightly better than the ones can be up to 1 hour, with an expectation of 30 minutes.
based on the Logistic Regression in all the chunk size, for To detect pump and dumps their methodology exploit two
the Logistic Regression model we report in Tab III only the anomaly thresholds one for transactions volume and the other
results with a chunk size of 25 seconds. Moreover, from the for the coin price. They compute the values of the thresholds
results of the Random Forest classifier, it is possible to note using average windows on the recent history of the candlestick
the relationship between the chunk size and the performance under observation. Hence, if both the price and the volume
of the classifiers. Indeed, while the precision is pretty stable are higher than the computed thresholds they mark the point
in all the time frames, the recall increases as we increase the as pump and dump event. Finally, Kamps et al. provide 3
chunk size dimension. different parameter configurations to compute the threshold:
In Tab IV we list the importance, computed with the Gini Initial, Balanced, and Strict. The Basic configuration maximize
Impurity, of each feature used with the Random Forest classi- the recall, the Strict the precision, while the Balanced is a trade
fier. As we can see, the best features are the ones based on the off between the previous two. In their work they only mention
rush orders and the number of trades. Once our methodology the number of alleged pump and dumps that their classifier
has been finalized, we trained a 25 second detector classifier detects, unfortunately they are not able to provide scores in
with the 3 day dataset and used the remaining part as test terms of precision and recall since their dataset lacks of ground
looking for other suspect events. After the evaluation, we got truth.
29 events that we are not able to link to evidence. We believe To use the Kamps et al. detector as the baseline for our
that virtually all of them are pump and dumps, whose evidence task, we start replicating their classifier and testing it on their
has been deleted or organized by groups that may not be dataset, detecting the same number of the pump and dumps
they declare in their work. Then, we apply their methodology market and then send millions of e-mails claiming to have
on our dataset; results are shown in Table III. As we can see, private information about substantial increases in the prices of
all our classifiers outperform in terms of F1-score the Kamps determined stocks. This causes an increase in the price and
et al. detectors. Note the difference in performance between volume of the target stocks, followed by a drop as soon as
their best configuration based on Strict parameters and our the spam campaign ends. A later analysis in 2013 by Siering
slowest classifier: Not only our performances are considerably in [20] shows that despite the authorities have taken several
better than theirs, we score 93.1% of precision and 91.4% countermeasures against fraudulent stock recommendations,
recall against their 50.1% precision and 75.0% recall, but our email-based pump and dump campaigns are still successful.
detector is also faster. These results also highlight that, due Some works about frauds in the cryptocurrency market
to the high volatility of the cryptocurrencies market, detectors have been published in the past few years. The work of
based only on the coin price and transaction volume are prone Gandal et al. [21] show evidence that the first price spike
to a large number of false positives. to 1000 USD of the Bitcoin may have been driven by market
Differently from us, Xu et al. [4] build a classifier able manipulation. Using the well-known dataset of the Mt.Gox
to predict the currency target of the next pump and dump to exchange, they found suspicious trading activities carried out
provide a tool for strategic trade. Since the goals are different, by two actors, named ’Willy bot’ and ’Markus bot’. The
we can not make a comparison in terms of performance purpose of these actors was to buy Bitcoin to increase the price
between our work and their solutions. Indeed, they prefer and the daily volume artificially. Krafft et al. [22] investigate
to maximize the probability of gain from the investment on the behavioral patterns of the users on the Cryptsy exchange
maximizing the recall at the expense of low precision. They market. In their work, they show that even tiny volumes of
assume that buying wrong currencies does not affect their buy trades can influence the market. They use bots to buy a
trading strategy because the value of a not pumped coin will small amount of random currencies and conclude that traders
remain at the same level as the purchase price and so do not tend to buy currencies with recent activities. Li et al. [23]
produce an economic loss. Instead, in our case, we want to conduct an empirical investigation on trading data obtained
provide a reliable approach—with high precision and recall— from the pump and dumps from Binance, Bittrex, and Yobit,
to help investors stay out of the market when a pump and dump focusing on the economic point of view. They show that pump
scheme is in action or to analyze anomalies in historical data. and dumps lead to short term increase in prices, volume,
and volatility followed by a reversal of the trend after some
V. R ELATED WORKS minutes. Moreover, they show that the gain of the investors
The pump and dump phenomenon is older than the cryp- depends critically on the time they obtain the signal, and for
tocurrency revolution. Therefore, a wide portion of the lit- this reason, outside investors are systematically disadvantaged.
erature is about pump and dumps done in the traditional The work of Kamps et al. [5] shows a first attempt to detect
stock market. Allen et al. in [15] identify three categories pump and dumps using an adaptive threshold. They highlight
of market manipulation schemes: information-based, action- the issue that a reliable dataset of the confirmed pump and
based, and trade-based. The pump and dump schemes are dumps scheme does not exist, so they can not fully validate
usually a combination of information-based and trade-based their results. A crucial contribution of our work is to release
manipulation. In 2004, Mei et al. [16] show that it is possible such a dataset. Xu et al. [4] focuses on the difficult task of
to carry out pump and dump schemes just exploiting the predicting pump and dumps, using one-hour intervals data
behavioral biases of the investors. They test their theory on from Cryptopia and Yobit, also showing an approach to exploit
the pump and dump cases prosecuted by the SEC from 1980 prediction to invest in alt-coins. Since both works have some
to 2002, which confirm their hypothesis. goals in common with ours, we conducted a thorough analysis
Several case studies highlighted that emerging markets were of their results on subsection IV-F.
prone to pump and dump schemes. Khwaja et al. in [17]
show that the Pakistani weak regulation of the national stock VI. D ISCUSSION
exchange allowed brokers of the Karachi Stock Exchange to Is it possible for pump and dump groups to avoid the
arrange successful pump and dump schemes. Jiang et al. [18] detection? We based our features on the idea of detecting an
investigate on the stock pools scheme of the ’20s using daily anomalous change of some market parameters and at the same
trading volume from the New York Stock Exchange between time to be robust against the natural oscillations of the volatile
1927 and 1929. The stock pools are groups of traders that cryptocurrencies market. So, if the admins of groups or some
delegate to a single manager to trade stocks on their behalf. vip members start to buy the currency gradually in a way that
Since a pool can move a large amount of money, they can the rise of this parameter is smooth, and the users are few, our
increase the volume of trades and attract outsiders to the classifier could be not able to detect the pump and dump. In
market. When the stock pool exits the market, the price quickly this case, our classifier cannot detect 4 of the pump and dumps
drops. As reported by the University of Innsbruck in [19], in our dataset. These events were all carried out by one group,
the Internet boom in the early years of 2000 led to the birth and all of them record a consistent pre-pump phase in the hours
of a new email-based pump and dump scheme. In this new before the pump starts. Fortunately, this technique cannot be
kind of fraud, the manipulators secure their position on the applied frequently because a smart observer knowing the time
of the next pump and dump can exploit this pattern to unveil Moreover, we have identified a peculiar kind of orders that
in advance the targeted cryptocurrency. Moreover, after the are particularly effective for the detection. We think that this
pump and dump, this operation will be noticed by most users work helps to understand a complex phenomenon, improve
that could lose the trust of the admins and leave the group. the awareness of the investors interested in the cryptocurrency
Can pump and dump groups manipulate Bitcoin or ma- market, and can help the authorities regulate this particular
jor cryptocurrencies? To answer this question, we make a market in the future .
straightforward simulation. Let us take the buy volume on the
R EFERENCES
first 10 minutes of the biggest pump and dump we monitored
that is of 31 BTC on the SingularDTV (SNGLS). Now, we [1] A. S. Kyle and S. Viswanathan, “How to define illegal price manipula-
tion,” American Economic Review, vol. 98, no. 2, pp. 274–79, 2008.
take a snapshot of the exchange order book for the trading [2] D. B. Kramer, “The way it is and the way it should be: Liability under
pair BTC/USD (data of April 12, 2019), and assume that the § 10 (b) of the exchange act and rule 10b-5 thereunder for making false
market is frozen and only the members of the pump and dump and misleading statements as part of a scheme to” pump and dump”
a stock,” University of Miami Business Law Review, vol. 13, no. 2, p.
group can make actions, this is the best case for them to make 243, 2005.
the price raise and get the attention of the outside investors. [3] S. Golstein. (2018) John mcafee among defendants named in pump
We find that the amount of money at their disposal can rise and dump lawsuit. [Online]. Available: https://bit.ly/2Ul1hXz
[4] J. Xu and B. Livshits, “The anatomy of a cryptocurrency pump-and-
the value of BTC of less than 5 USD. Now, we analyze the dump scheme,” in 28th {USENIX} Security Symposium ({USENIX}
price oscillation of the Bitcoin in the hour before the snapshot Security 19), 2019, pp. 1609–1625.
on time ranges of 10 minutes, and we find that the minimum [5] J. Kamps and B. Kleinberg, “To the moon: defining and detecting
cryptocurrency pump-and-dumps,” Crime Science, vol. 7, no. 1, p. 18,
oscillation was of 10 USD while the maximum was more than 2018.
50 USD. If we made another similar simulation on the Ripple [6] T. LLC. (2018) Telegram - a new era of messaging. [Online]. Available:
(XRP), we get that the XRP value increases less than 0.0005 https://telegram.org/
[7] D. Inc. (2018) Discord. [Online]. Available: https://discordapp.com/
USD, while the minimum and maximum oscillation is of 0.001 [8] Bitcointalk, official forum of bitcoin. [Online]. Available: https:
and 0.002. As we can see, only the volume of the orders in the //bitcointalk.org
orders book is enough to smooth the firepower of the pump [9] Coindetect. [Online]. Available: https://coindetect.org
[10] Padl - crypto pump and dump groups -signals - list. [Online]. Available:
and dump group, and the higher price peak they can achieve, https://padl.mine.nu
in this extremely optimistic situation, is not enough to drum [11] Binance. (2018) Public rest api for binance. [Online]. Avail-
up the interests of outside investors. able: https://github.com/binance-exchange/binance-official-api-docs/
blob/master/rest-api.md
Is it possible for the exchange markets to stop pump and [12] L. Breiman, “Random forests,” Machine learning, vol. 45, no. 1, pp.
dump schemes? In this work we show that it is possible to 5–32, 2001.
detect a pump and dump scheme as soon as it starts. We also [13] D. W. Hosmer Jr, S. Lemeshow, and R. X. Sturdivant, Applied logistic
regression. John Wiley & Sons, 2013, vol. 398.
believe that an exchange can detect better than us when a [14] V. A. Siris and F. Papagalou, “Application of anomaly detection algo-
fraudulent scheme like this one is in action. In fact, the data rithms for detecting syn flooding attacks,” in IEEE Global Telecommu-
owned by the exchange is more fine-grained than what we nications Conference, 2004. GLOBECOM’04., vol. 4. IEEE, 2004, pp.
2050–2054.
could obtain: It has full knowledge on the kind of operations [15] F. Allen and D. Gale, “Stock-price manipulation,” The Review of
performed, their amount, and exactly who performed them Financial Studies, vol. 5, no. 3, pp. 503–529, 1992.
during the pump and dumps. Moreover, we notice that small [16] J. Mei, G. Wu, and C. Zhou, “Behavior based manipulation: theory and
prosecution evidence,” Available at SSRN 457880, 2004.
policy enforcements against the pump and dumps can reduce [17] A. I. Khwaja and A. Mian, “Unchecked intermediaries: Price manipu-
drastically the amount of these market manipulations. As an lation in an emerging stock market,” Journal of Financial Economics,
example, BitTrex exchange announced [24] that it actively vol. 78, no. 1, pp. 203–241, 2005.
[18] G. Jiang, P. G. Mahoney, and J. Mei, “Market manipulation: A compre-
discourages any type of market manipulation and will begin hensive study of stock pools,” Journal of Financial Economics, vol. 77,
to punish the participants. Since then, the amount of pump no. 1, pp. 147–170, 2005.
and dumps in the exchange drastically decreased. We counted, [19] L. Frieder and J. Zittrain, “Spam works: Evidence from stock touts and
corresponding market activity,” Hastings Comm. & Ent. LJ, vol. 30, p.
before the statement, more than 50 pump and dumps in the 479, 2007.
5 months from July to the end of November 2017, and only [20] M. Siering, “All pump, no dump? the impact of internet deception on
31 in almost one year after the statement. Another possible stock markets.” in ECIS, 2013, p. 115.
[21] N. Gandal, J. Hamrick, T. Moore, and T. Oberman, “Price manipulation
counter-measure could be to stop transactions on a security in the bitcoin ecosystem,” Journal of Monetary Economics, vol. 95, pp.
when it gains or loses more than some threshold, or give 86–96, 2018.
special protection to cryptocurrencies with extremely low [22] P. M. Krafft, N. Della Penna, and A. S. Pentland, “An experimental study
of cryptocurrency market dynamics,” in Proceedings of the 2018 CHI
market capitalization and trading volumes. Conference on Human Factors in Computing Systems. ACM, 2018, p.
605.
VII. C ONCLUSION [23] T. Li, D. Shin, and B. Wang, “Cryptocurrency pump-and-dump
schemes,” Available at SSRN, 2018.
In this work, we performed an in-depth analysis of the [24] BitTrex. (2018) What are my trade limits? [Online]. Available:
pump and dump ecosystem. We have studied the relationship https://support.bittrex.com/hc/en-us/articles/115003004171
that exists between the groups, the exchange, and the target
cryptocurrencies. We also presented two case studies and a
tool that can detect in real time a pump and dump in action.

View publication stats