On-chain insider trading schemes

The vast majority of the suspicious trading patterns flagged by Solidus’ HALO platform as part of this research involved the following process:

1. A cryptocurrency wallet buys the token using a decentralized exchange days or hours before its listing is announced by a centralized exchange/crypto platform

2. That wallet sells the token using a DEX shortly after.

In some cases, the wallet used a DEX in only one of these steps: To purchase the token before its listing announcement, or to sell it soon after. In rare cases, however, the wallet’s owner avoided DEXs altogether, and used the wallet only to transfer the token from one centralized exchange to another.

In these three alternative scenarios, the wallet’s owner may have been seeking to minimize transaction costs, maximize profits, or avoid triggering centralized exchanges’ insider trading detection models.

One insider traded ahead of 14 listings using DEXs – and as many as 22 more using CEXs

One trader that HALO flagged used nine separate but connected Ethereum addresses to trade ahead of 14 token listing announcements on one exchange throughout 2021. These addresses – each of which have direct or indirect exposure to a single consolidation address – spent a combined $2.7 million buying tokens just before their listings were announced, only to flip them for a profit of over $300,000 after.

Just 21 hours before the listing of Amp (AMP) on this exchange, for example, one of these addresses began buying AMP on DEXs in increments of $10,000 to $20,000. In total, the address purchased $230,000 worth of AMP in a buying spree completed 12 hours before the listing announcement.

The token’s listing was announced the next morning. 24 minutes later, the address began to offload its AMP holdings.

The address collected $307,000 worth of Wrapped Ether (WETH) and USD Coin (USDC) from its sell-off, which it then converted into Tether (USDT). Within three hours, the address had fully exited its position, generating a single-day profit of $77,000.

Four other wallet addresses tied to this insider have on-chain transaction histories that suggest they may have engaged in insider trading using centralized exchanges as well. These four addresses have collectively received 22 different ERC-20 tokens from centralized exchange addresses either just before or just after each tokens' listing was announced. Those tokens were then transferred to another centralized exchange shortly after.

54 additional wallets have traded ahead of just one ERC-20 token listing announcement – potentially indicative of insider trading by employees of token issuers, market makers, or investment firms

Solidus has identified at least 54 wallets that have engaged in suspicious trading ahead of just one token listing announcement. It's possible that some of these trades were well-timed but otherwise benign. However, these 54 wallets in particular appear to have been created just to trade one soon-to-be-listed token, as their on-chain trading histories consist solely of transactions in which they funded the wallet, bought the token just before its listing announcement, and then sold it and transferred the proceeds moments after.

Several of these suspicious wallets’ owners have used obfuscation tools and techniques. Some have routed their proceeds through privacy protocols like Tornado Cash or the Secret Network; others have transferred their proceeds to centralized exchanges that do not enforce know your customer (KYC) policies.

While we cannot rule out the role of luck without further investigation by regulators and law enforcement, it is possible that the owners of many of these cryptocurrency wallets had access to material nonpublic information (MNPI) regarding the listing. The employees of at least four different types of crypto market participants could have access to this MNPI: 

• Token issuers
• Market makers working on behalf of token issuers
• Investment firms providing capital to token issuers
• Crypto trading platforms

That being said, further analysis would be needed to support the case that these trades were executed by individuals with access to MNPI.

Decentralized exchanges change the game for crypto insiders

The DEX-based approach to insider trading represents a major departure from traditional finance, both in terms of its mechanics and its frequency. In traditional stock markets, insiders have three main ways to profit from material nonpublic information: by trading correlated assets under their legal name, by tipping off friends or relatives, or by selling information to strangers. In crypto, insiders to the token listing process can profit from two additional approaches:

1. Buying a digital asset on a centralized exchange (CEX) on which that token is already listed, on the knowledge that it will soon be listed on another CEX
2. Buying a digital asset on a DEX using a pseudonymous cryptocurrency address

Our findings suggest that the pseudonymity of DEX trading, coupled with the fact that crypto assets are often listed on DEXs and other CEXs well before they are listed on major exchanges, increases the appeal – and therefore the frequency – of insider trading in crypto assets relative to stocks. Academic research supports this hypothesis: Researchers at the University of Technology Sydney estimate that stock-based insider trading occurs ahead of just 5% of earnings announcements and 20% of mergers and acquisitions – far lower than the 56% we’ve observed in our sample of ERC-20 token listing announcements.
‍

For employees at crypto exchanges, token issuers, market makers, or any other market participant with access to MNPI, leaning into the pseudonymity of blockchains may seem like the ideal method to avoid detection. But blockchains aren’t just pseudonymous; they’re also permanent, public, and traceable. With Solidus’ DEX-Based Insider Trading Detection tool, exchanges and regulators can hold these rogue traders accountable.