Introduction
NFT has always been a highly anticipated field in web 3, but there have been many issues in its development, one of which is market manipulation. Market manipulation refers to the act of using improper means or information to influence market prices or trading volume, in order to gain undue profits. In NFT trading, market manipulation mainly takes two forms:
Hold manipulation: Holding refers to the project party (including public holding and hidden holding, with hidden holding being used for market manipulation) or market makers holding a large amount of a certain NFT, creating its scarcity and value perception, attracting more buyers to enter the market, driving up its price, and then selling at a high price to gain huge profits. This behavior leads to the formation and bursting of NFT price bubbles, damaging the interests of other investors.
Trading volume or price manipulation: Refers to certain individuals or organizations manipulating a large number of addresses to trade NFT frequently between different accounts, creating false trading volume or using it to boost prices, thereby misleading the judgment of other investors and enticing them to trade, in order to gain undue profits. This behavior undermines the authenticity and fairness of the NFT market, reducing its trustworthiness and attractiveness.
Typical actions of NFT market manipulation mainly include three stages:
Stage 1: Fundraising: The main operation is to continuously accumulate chips at a low price.
Stage 2: Wash trading or pumping. This stage is mainly indicated by trading volume, manipulating multiple addresses to artificially increase the trading volume and pump up the price.
Phase 3, Shipment Phase. Further raise the price and at the same time ship and recover funds.
Methodology
To identify the traces of holding or manipulating behind the NFT project, we use the method of on-chain data analysis, utilizing the traceable, tamper-proof, and transparent features provided by blockchain technology to collect, clean, process, and mine all kinds of transaction data in the NFT market. We mainly focus on the following two aspects of data:
Fund Relationships: By tracking the transfer records between addresses involved in NFT transactions, we construct a fund flow diagram, analyze the source and destination of funds, and identify addresses or address groups that may have manipulation intentions.
Similar behavior information: We construct features based on the behavioral information of addresses involved in NFT transactions and use clustering algorithms to find address clusters with high similarity to analyze whether there is market manipulation behavior.
Through the analysis of the above two aspects of data, we can preliminarily filter out some suspicious addresses or address clusters, and further analyze their transaction behaviors to reveal their means, motives, and effects of market manipulation.
Specific Case (Using AKCB as an example)
AKCB (A KID CALLED BEAST) is an NFT project on Ethereum. It consists of ten thousand unique 3D and AR-ready digital beasts. Each beast belongs to one of twenty beast tribes, with each tribe having five hundred members representing different personalities and values. Users who own AKCB can enter the corresponding tribe community and interact and collaborate with other users who own the same beast tribe. AKCB started minting on January 15, 2023, with an initial mint price of 0.0777 ETH, and as of June 20, 2023, the floor price is around 0.4 ETH. AKCB has attracted a lot of attention and popularity since its launch, but we have also noticed some suspicious behavior, such as pump and dump schemes and creating a sense of scarcity. We will demonstrate this through two aspects: holding and price manipulation.
I. Holding
1. Open Positions
The project team minted 1000 tokens (approximately 10%) through the contract address 0x263f8b4a146E85d8fd2BB42bE7fac5aaB0Ba3b7F. Project teams generally retain some tokens for future community development or market value management. These open positions are generally not considered malicious manipulation.
2. Hidden Positions
Since each user can only mint one token, there are a large number of addresses controlled by the same entity used for minting. Several batches of such addresses were identified by detecting the same address funding, fund aggregation, and fund transfer behaviors among all minters.
Cluster of addresses 1:
There are a total of 70 addresses that have completed two transactions of funds deposited via Disperse.app. They exhibit identical behavioral patterns and have a shared fund aggregation address after the transactions. After minting, some of the addresses concentrated their sales on January 27 and February 8. Transaction hashes for deposits:
0x0d673d7b25115bfef7eef59496f902b08b84a9b123951b01ed4107e9a4d1831f,
0x713c9bcd9f0c28c7d2fe5a833953d24b01e4d3d8472fd9832c1b602f73eb0f99
A total of 70 tokens were minted, with 43 tokens already sold, and currently 27 tokens are still held by different addresses.
Figure 1: These addresses are deposited in one of the two transactions through Disperse.app
Figure 2: These addresses are deposited in one of the two transactions through Disperse.app
Address Cluster 2:
0x302fa7adfdd959aedfd29f00b9b5489d7072cd13
0x37e725fe7eb92cc865d87b671d52ab962c9337f4
0x3c4ea03a66ac5a896a7d3076e3519234248f5983
0x62198ce64f6938d4b8f38fde5dcc77eb884b69da
0x952d1a292a16f3a87cc941b0d94c178dee7c5820
0xe49083eedb16f5752a90d264315ef8a1041eac86
0xf8939f0b7d6fdc63d9d7139e7bf7240fae8e3529
0xf35073b570c57c9e4c09eb373d8b7a1b2e96dae6
0x04f340231b82e1e7115087e81aaa04cb57606220
0x30348990bc891f5fc7d52b9c2a91907ff4a00416.
0x0127ead2363227136cfee02ee860faae0f695e30
Relationship: Address 1-9 Deposited in the same transaction using CoinTool: MultiSender, deposit tx_hash:
0x0086718d1b4242060b3ab5c7c4716bd26c75a4ded0cb8341d5ba801d7e2ec87a,
Address 9 and 10 are deposit addresses for Address 11. Additionally, these addresses have no prior transaction history and exhibit identical behavior.
Figure 3: Deposits made to the addresses using CoinTool: MultiSender in the same transaction
These addresses collectively minted 11 tokens, which were then transferred to addresses 2 and 11. All tokens were subsequently sold in mid-February and on March 10th (with prices above 1.2 ETH).
Figure 4: Tokens transferred to address 2 or address 11
Figure 5: Fund relatedness between addresses in cluster 2
Address cluster 3:
0x8cA45E505d10764AcD1A918146cfd0A0FF68E0C8
0x5a42a4e689b727354ef9933e610f4fbe0f599e8d
0x8bae46274a92d5d5852C476d2c4A80968018Bab4
0x2eeEc62CE45367a47d77B81851aebC756B107567
0x685225594fb2499eae3598ee698441d4da9a2be7
0x71a3ae50fcbc3d89d1a6910478c70e9e67ee1552
0x77b8726b0b062ab5c9596eafbee441ab2181390e
0x6cC330603cDfa702a8D10E25931263DbA9a35458
0x4ee5d01a5c96be6743718fc237a7a81960615fe9
0xdcbe09d16e3c83acda5b1718b1b2c1cb4b6794cf
0xB4f6C471fb6682d178fC485E2751B58477BAe584
A total of 11 addresses, the deposit addresses of these addresses are the same, and the final fund collection address is the same. There is no transaction history, and the behavior is similar. The specific funding sources are:
Source of funds for addresses 1-5: 0xFccf1C6A8C6978d76dF001699E02A2Ee88B8DEdA;
Source of funds for addresses 6-7: 0x82B38c1636E98f0F7010cB00fcE9a24b649878Ab;
Funds for addresses 8-11: Directly or indirectly sent to address 1
All of the above addresses ultimately collect funds to the same Bybit deposit wallet:
Figure 6: These addresses finally send funds to the same Bybit deposit address
Figure 7: Funds correlation between addresses in Cluster 3
These addresses minted a total of 11 tokens after the second mint on January 26 and immediately sold them, with prices around 0.5 ETH.
Conclusion
We have found through our algorithm that behind each cluster of addresses, there must be manipulation by the same entity. The common characteristics of these addresses are:
They are all new addresses with no transaction history
Manipulated on a large scale by the same entity
Dumped at high prices after minting
This behavior is likely a way for the project party or market maker to increase popularity and recover funds.
II. Price Manipulation
In the process of analyzing the trading data of AKCB, we have found the following suspicious phenomena in the trading volume and floor price changes of this series, suggesting that the project party or market maker may have pumped the price between February 6th and February 15th:
Suspicion 1: Starting from February 6th, the number of buyers, number of sellers, trading volume, and floor price sharply increased (compared to other blue-chip NFTs during the same period without a similar upward trend)
Figure 8: The number of buyers and sellers sharply increased starting from February 6th
Figure 9: Trading volume and floor price increased significantly starting from February 6th
Afterwards, the trading volume and floor price of this series remained relatively low.
Question 2: Starting from February 6th, the distribution of trading prices showed a uniform upward trend and the prices concentrated below the next day's floor price
Figure 10: Distribution of trading prices showing a uniform upward trend
The simplest way to raise the floor price is to sweep away all tokens below the target floor price. Therefore, this will inevitably result in a distribution of trading prices showing a uniform upward trend, and the prices on the day are concentrated below the next day's floor price. On February 7th and February 8th, when the trading volume increased sharply, most of the trades were at prices lower than the next day's floor price. This is in stark contrast to other time periods, and such differences indicate the possibility of systematically manipulating the floor price.
Figure 11: On February 7th and February 8th, the majority of trades were priced below the floor price of the following day
Question 3: Wholesalers are buying large amounts of goods
Figure 12 NSwap has bought a large amount of AKCB
After NSwap made a large purchase, the floor price rose significantly. In addition to NSwap's entry, which increased the community's confidence in AKCB, we believe there are also artificial manipulation factors affecting the subsequent price increase based on the data.
Conclusion
Through these abnormal transaction data, we believe that AKCB may have engaged in market-making behavior to boost the floor price in mid-February (reaching as high as 1.92 ETH).
Summary
The NFT market is a field full of innovation and vitality, but it also has some irregular and unfair practices, such as manipulating market prices, inflating trading volume, and money laundering. These behaviors not only harm the healthy development of the NFT market, but also affect the interests of ordinary users and investors. Therefore, analyzing these behaviors from a data perspective can provide players with a deeper understanding of the market situation and make data-driven decisions when investing. On the other hand, by exposing these market manipulation behaviors, we can enhance the transparency and credibility of the NFT market.
About the Authors
This research analysis report is written by Helena L. and Lin S. from Eocene Research. Follow us on Twitter for more NFT analysis and research.
