Were ETH and EOS Repeatedly Recycled during the EOS Initial Coin Offering?

1
John M. Griffin
August 31, 2021

Overview

Through detailed forensic data analytics, this white paper identifies potential connected associates
engaging in an observed scheme involving EOS to create the largest ICO in history. Their activity
is conducted by similarly behaving suspicious accounts on the Ethereum blockchain that ‘pumped
up’ the price of the ICO by repeatedly purchasing tokens and recycling Ether payments in the ICO
crowdsale. This had the effect of creating a false signal to market participants that many ICO
investors perceived EOS to have value and that they should also invest. The seemingly artificial
demand from the suspicious accounts had two effects. First, it directly manipulated EOS’s offering
price upward through the extra buying and inflated the market value of the token. Second, it created
the false impression of value of the token which enticed others to want to purchase the ICO token.
In particular, the analysis details how Ethereum accounts were created that repeatedly purchased
EOS over time. Our analysis started by identifying suspicious accounts that repeatedly invested
large amounts of Ether into the crowdsale. These accounts were repeatedly funded by Ether that
predominantly came from two exchanges, Bitfinex and Binance. Rather than holding the
purchased EOS, as would be the case for a long-term investor, the EOS were quickly and
repeatedly sent back to the same two exchanges. On these exchanges, the EOS appears to have
been sold to Ether, and the Ether was recycled back to the same Ethereum accounts to purchase
more EOS. In addition, a significant portion of the Ether raised during the crowdsale appears to
have been recycled by transferring the ICO contributions through a series of obfuscating
intermediary accounts and finally arriving at Bitfinex. 2.895 million Ether ($1.721 billion USD),
or 39% of the Ether raised in the crowdsale, are also traced from the ICO crowdsale wallet back
to Bitfinex.
Bitfinex, along with Binance, is one of the main sending and receiving destinations from the
suspicious accounts and also the largest receiving destination for Ether raised by founders during
the ICO. Bitfinex is connected to Block.one, the developer of the EOS token, through at least one
of its former executives. Brock Pierce is the co-founder of Block.one as well as the co-founder of
Tether. Tether Holdings Limited shares a parent company, iFinex, which owns the Bitfinex
exchange.

1
This forensic investigation is conducted and prepared under the supervision of John M. Griffin with assistance from
employees at Integra FEC. John M. Griffin is President of Integra FEC LLC, and also holds the James A. Elkins Chair
in Finance at the University of Texas at Austin. Because of the specialized nature of this research report in a unique
type of ICO offering and the focused nature of this research report, this report is written as a brief research report
rather than an in-depth academic article. Integra FEC is a forensic consulting firm located in Austin, TX that
specializes in forensic financial analysis. Integra FEC has developed considerable proprietary software, algorithms,
and expertise in analyzing and grouping transactions on various blockchains that were utilized in this report.

1
The recycling activity seemed to have its intended effect. First, the EOS price increased over time
as the recycling of funds continued to push up prices. The price of EOS rose from 0.0092 Ether at
the beginning of the crowdsale (in the first 30 auctions) to 0.0208 by the end of the crowdsale (in
the last 30 auctions). At the beginning of the crowdsale, 0.5% of the crowdsale was linked to the
recycled funds while at the end of the crowdsale, 23.4% of the crowdsale was linked to the recycled
funds. The total amount of these recycled funds amounted to 1.206 million Ether or $814.6 million
USD. This should be viewed as a conservative lower-bound given our conservative method of
flagging suspicious accounts. The recycling scheme may be substantially larger and could have
also consisted of other means to manipulate the EOS price upward.
Second, while EOS insiders publicly denied ever purchasing EOS during the crowdsale, they
benefited by being able to issue billions of dollars in EOS that was sold to small investors who
were unaware of such activity. The suspicious accounts created legitimacy and the perception of
widescale interest in EOS, and thus were able to make EOS move from an obscure ICO to become
a token of widely perceived value.
There are many reasons why this activity is inconsistent with non-nefarious explanations. First,
the suspicious accounts often bought and sold similar amounts of Ether on a daily and weekly
basis, and typically sent EOS to exchanges within 40 minutes. Both activities are inconsistent with
a legitimate long-term demand for the token. Second, this type of recycling activity of buying EOS
in the crowdsale and then selling EOS at an exchange was generally not profitable and would not
have been the most cost effective way for a legitimate investor to purchase EOS over the period.
Yet, this would be the most cost effective way to inflate the price of EOS and to create the
perception that EOS had more demand than it legitimately did. Third, the recycling of Ether into
EOS and EOS back to the exchanges and to Ether, is shown to be unlike any other activity by other
traders in the EOS crowdsale. Fourth, the accounts appear almost solely created for this purpose,
unlike other accounts that are widely used.
Fifth, the Ether sent back from the EOS crowdsale wallet to Bitfinex was sent in an unusually
complicated manner consistent with trying to obfuscate the identity and tracking of the funds.
Sixth, Bitfinex is the largest receiving destination for Ether raised during the ICO and where much
of the Ether funds used to purchase EOS also comes from. Seventh, the very large dollar amounts
linked to this recycling scheme indicates that several groups of investors would have needed to
purchase $814.6 million USD in EOS. Given the speculative nature of EOS and the lack of large-
scale institutional investors in the ICO market, this amount of investment by non-connected
associates seems unlikely. Based on our analysis of the Ethereum blockchain, one investor alone
would have needed to purchase $232.0 million USD, which again seems unlikely if not due to a
connected associate who was recycling funds. Finally, the detailed blockchain analysis shows that
the recycling activity from the suspicious accounts was repeated and increasing over the period in
a manner consistent with an effort to pump the price of EOS.
Overall, our detailed analysis—further explained in the following pages—reveals clear evidence
of a sophisticated and extended recycling scheme perpetuated by potential EOS connected
associates.

2
Background

The EOS initial coin offering (ICO) is the largest ICO to date, raising 7.4 million Ether ($4.362
billion USD)2 between June 26, 2017 and July 1, 2018. The duration of the ICO lasted much
longer than the ICOs at the time which typically lasted a few months. As of July 20, 2021, EOS
had a market capitalization of $3.141 billion USD.3

The EOS ICO used an unconventional auction structure: a fixed number of EOS tokens were
released each day, priced based on the amount of Ether sent to the crowdsale wallet during a 23-
hour period, rather than having a pre-set price. For example, if 20,000 Ether were sent to the
crowdsale wallet, the EOS sold would be priced at 20,000 ETH ÷ 2,000,000 EOS tokens = 0.01
ETH price of EOS.
EOS prices increased over 100% during crowdsale. The price increased from 0.0092 ETH on
average during the first 30 auctions to 0.0208 ETH on average during the last 30 auctions. During
the crowdsale, Block.one claimed never to have invested in EOS themselves: “Block.one has not
participated in the EOS tokens sale in anyway, with any funds.”4

2
Throughout this report, we have used the daily closing price from https://coinmarketcap.com/ to convert to USD.
3
https://coinmarketcap.com/.
4
https://medium.com/eosio/an-update-from-block-one-ceo-brendan-blumer-eb54c2652322.

3
Overview of Behavior Observed

Twenty-one suspicious investor addresses were flagged using four criteria that collectively would
be unusual for legitimate investors. These suspicious accounts repeatedly paid Ether to purchase
EOS in the crowdsale and subsequently transferred the same equivalent amount of EOS to
exchanges, suggesting that the suspicious accounts were recycling investor funds to inflate demand
for the ICO. In total, the suspicious accounts contributed 1.2 million ETH ($815 million USD) to
the crowdsale.
The criteria used to flag suspicious accounts is as follows:
1. Total contribution to the crowdsale was over 20,000 Ether (only a limited number of
people would have the capital to invest this much);
2. Total number of contributions to the crowdsale was over 100 (most investors did not
invest this frequently);
3. Over 90% of Ether withdrawn from the account went to the crowdsale (suspicious
accounts are not used much for other purposes);
4. Over 90% of Ether deposited into the account came directly from an exchange (large
crypto investors are not likely to store funds on exchanges because they are insecure).
As seen in the following figure, these suspicious accounts had an unusually high number of
contributions to the crowdsale relative to other accounts that participated.

4
This figure below illustrates the recycling scheme. It shows flows of Ether from the exchange
accounts to the suspicious accounts, and then flows of Ether from the suspicious accounts to the
crowdsale wallet. After that, EOS is sent back to the suspicious accounts addresses and back to the
exchanges. Meanwhile, the Crowdsale account could use raised Ether to further enable the scheme.

5
Finding 1: Suspicious Accounts Circulated Funds from Exchanges to Crowdsale Wallet and Back
to Exchanges

The suspicious addresses received Ether directly from exchanges, in particular Bitfinex and
Binance which combined to supply 98% of the Data onused
Ether they Step 1: EOS. This is unusual
to purchase
since a large institutional investor with
Suspicious tens of millions
Accounts AllofFunded
dollars in assets
from would not typically
Exchanges
keep large amounts of funds at unsecured exchanges that could be hacked or become insolvent.

• Accounts got
Ether from
exchanges
• Exchanges ar
insecure for lar
investors
• Mostly Bitfin
(30%) and
Binance (68%)

17
These suspicious addresses then sent virtually allData
(97%) ofon Step
their Ether 2:
received from the exchanges
to the crowdsale wallet, meaning that the addresses were created with the specific purpose of
buying EOS as opposedSuspicious Accounts
to acquiring a portfolio Sent Ether and
of other cryptocurrencies to digital
Crowdsale
assets.

• Accounts sen
almost all of
their Ether to
the crowdsale
• These
addresses were
almost
exclusively used
for recycling
funds; very littl
Ether was used
for other
purposes (3%)

18

6
Another feature of the suspicious accounts is that they bought virtually all (99%) of their EOS
Data on Step 3:
from the crowdsale wallet, even though it would have been cheaper on average to purchase EOS
from exchanges. EOS Went Back to Suspicious Accounts

• Accounts got
their EOS from
the crowdsale
• Very little EO
was bought from
exchanges or
other investors
(1%), even
though EOS wa
often cheaper
there

19
Data on Step 4:
Finally, the suspicious addresses then transferred EOS back to Bitfinex and Binance where EOS
Suspicious
could be exchanged for Ether. Accounts Sent EOS Back to Exchanges

• Accounts sent
almost all
(97.0%) of their
EOS directly to
exchanges
• Mostly Bitfinex
(31.7%) and
Binance (65.0%)

20

7
The resulting circular transaction patterns are consistent with the suspicious accounts recycling
funds. In aggregate the amount of Ether sent from exchanges to the suspicious addresses is virtually
the same as the amount of EOS sent to the exchanges from the suspicious addresses.

Additionally, these transfers of EOS occurred quickly after the EOS auctions, with the suspicious
accounts typically sending their EOS to exchanges within 40 minutes of the end of each
crowdsale. This is in contrast with other accounts which tended to hold EOS for longer periods.

8
Furthermore, these accounts often bought and sold similar amounts of Ether on both a weekly and
daily basis.

9
Finding 2: Repeatedly Circulating Funds Between the Exchanges and the ICO was not a Profitable
Trading Strategy

To repeatedly buy and sell EOS on the same day was not a profitable trading strategy during the
ICO period. On most days of the crowdsale, this strategy would lose money since the average price
of EOS was higher at the crowdsale than at Binance and Bitfinex immediately following the
crowdsale.

Buying and selling the same amount of EOS daily would have lost money (-1.4% expected average
profit) whereas simply buying and holding would have resulted in an expected 126% profit.

10
Finding 3: Five Suspicious Accounts are Linked and Comprise a $232 Million Investor

Five of the suspicious accounts used common deposit addresses at Binance and Bitfinex, providing
strong evidence that they are controlled by the same entity. These five accounts contribute $232
million worth of Ether to the crowdsale, more than any other account. These accounts have related
transactions with the BigOne exchange, so it is possible that these accounts are related in some
manner to Li Xiaolai, the founder of BigOne, who has claimed publicly to be a large investor of
EOS. Li Xiaolai has had business relationships with Block.one personnel in the past.5

5
"Daniel Larimer, CTO of EOS, is my old friend. I’ve invested in the decentralized cryptocurrency exchange which
he created back in 2013 and I’m a long-term supporter of it. Then when he joined EOS and started to lead the project’s
development, I also bet on it." Li Xiaolai, as quoted in interview on March 24, 2018 by Daily Fintech; available at:
https://dailyfintech.com/2018/03/24/34501/.

11
Finding 4: Large Amounts of Ether Transferred from the Crowdsale to Bitfinex

2.895 million Ether ($1.721 billion USD) were withdrawn from the crowdsale address and sent to
Bitfinex, comprising 39.1% of all Ether raised from the crowdsale and making Bitfinex the biggest
destination of crowdsale funds.

These transactions took place over a series of four hops to overlapping Bitfinex deposit addresses,
the design of which is consistent with obfuscating deposits to common accounts at Bitfinex.

12
Ether from the crowdsale wallet flowed to Bitfinex—one of the main exchanges used by the
suspicious accounts—throughout the duration of the crowdsale.

Finding 5: Investment by Suspicious Accounts Increased by 125 Times over the Crowdsale

The amount of Ether contributed by the 21 suspicious accounts increased over time, from 77 ETH
per auction during the first 30 auctions to 9,731 ETH per auction during the last 30 auctions. One
possible source for the increase in purchases was the Ether withdrawn from the crowdsale account.

13
The amount of Ether contributed by the suspicious accounts increased at rates similar to how the
total Ether transferred from the crowdsale wallet to Bitfinex also increased.

14