The Doge of Wall Street: Analysis and Detection of Pump and Dump Cryptocurrency Manipulations

The Doge of Wall Street: Analysis and Detection of Pump and Dump
Cryptocurrency Manipulations
MASSIMO LA MORGIA, ALESSANDRO MEI, FRANCESCO SASSI, and JULINDA STEFA, Sapienza
University of Rome
Cryptocurrencies are increasingly popular. Even people who are not experts have started to invest in these securities, and nowadays,
cryptocurrency exchanges process transactions for over 100 billion US dollars per month. In spite of this, many cryptocurrencies have
arXiv:2105.00733v1 [cs.CY] 3 May 2021
low liquidity, and therefore, they are highly prone to market manipulation. This paper performs an in-depth analysis of two market
manipulations organized by communities over the Internet: The pump and dump and the crowd pump.
The pump and dump scheme is a fraud as old as the stock market. Now, it got new vitality in the loosely regulated market of
cryptocurrencies. Groups of highly coordinated people systematically arrange this scam, usually on Telegram and Discord. We
monitored these groups for more than 3 years detecting around 900 individual events. We analyze how these communities are
organized and how they carry out the fraud. We report on three case studies of pump and dump. In the first one, we investigate the
relationship between the groups, the targeted coin, and the exchanges. In the second, we put the Big Pump Signal, the largest active
group according to our analysis, under the lens. Lastly, we report on YoBit, an exchange that surprisingly starts to arrange pump and
dumps operations. Then, we leverage our unique dataset of the verified pump and dumps to build a machine learning model able to
detect a pump and dump in 25 seconds from the moment it starts, achieving the results of 94.5% of F1-score.
Then, we move on to the crowd pump, a new phenomenon that hit the news in the first months of 2021, when a Reddit community
inflates the price of the GameStop stocks (GME) of over 1, 900% on Wall Street, the world’s largest stock exchange. Later, other
Reddit communities replicate the operation on the cryptocurrency markets. The targets were Dogecoin (DOGE) and Ripple (XRP). We
reconstruct how these operations developed, and we discuss differences and analogies with the standard pump and dump. Lastly, we
illustrate how it is possible to leverage our classifier to detect this kind of operation too.
We believe that this study helps understand a widespread phenomenon that affects the cryptocurrency markets. The detection
algorithms we develop effectively detect these events in real-time and help investors stay out of the market when these frauds are in
action.
1 INTRODUCTION
Pump and dump is a market manipulation fraud that consists in artificially inflating the price of an owned security and
then selling it at a much higher price to other investors [50, 51]. This fraud is as old as the stock market. One of the
most famous pump and dumps of Wall Street history happened in the late ’20. The security was the RCA Corporation.
RCA was the manufacturer of the first all electric phonograph, one of the hottest pieces of technology at that time. The
fraud was organized by the "Radio Pool", a group of investors that artificially pumped RCA to the incredible price of
$549, and then dumped the shares making the price plummet to under $10. A large number of investors lost all of their
savings in this operation. At that time, communication was done through the radio, tabloids, and word of mouth.
With the advent of the hectic and almost non-regulated markets of cryptocurrencies, pump and dumps are more
vital than ever. There are now hundreds of cryptocurrencies, the market is not strictly regulated, and prices are easy
to manipulate. Thus, pump and dumps on these securities are incredibly common, with public groups in the Internet,
rules, and precise and complex organization. Now, pump and dumps are led by a large number of self-organized groups
over the Internet, and the phenomenon is viral though still not very well known.
Authors’ address: Massimo La Morgia, lamorgia@di.uniroma1.it; Alessandro Mei, mei@di.uniroma1.it; Francesco Sassi, sassi@di.uniroma1.it; Julinda
Stefa, stefa@di.uniroma1.it, Sapienza University of Rome.
1
2 La Morgia, et al.
As of January 2021, a new kind of operation has been in the global spotlight. A group of people active on a Reddit
group called r\wallstreetbets start an operation against a few hedge funds shorting GameStop stocks (GME). Even
if it started with few users, the group was able to attract other people and managed to raise the stock price of GME
by more than 1900% [56]. Following the media interests, the subreddit got more than 3 million new followers during
the same period. The event got worldwide attention, and several celebrities, including Elon Musk, rock star Gene
Simmons, and rapper Snoop Dogg [75] commented on the event and contributed to making it even more popular.
Following the success of this operation, people collaborated into buying other stocks such as AMC (AMC Entertainment
Holdings), BB (BlackBerry Ltd.), and NIO (NIO Inc.), whose prices increase rapidly in a few days [65]. Some digital
trading apps reacted to this event, restricting trades on the stocks that were getting pumped [31]. In reaction to these
limitations, the attention moved to the less regulated cryptocurrency market, where two major pump events involving
the Dogecoin(DOGE) and Ripple (XRP) cryptocurrencies occurred.
In this work we describe the pump and dump phenomenon in the cryptocurrency ecosystem. We describe the
organization of the groups and of the frauds, the motivations and the concerns of the stakeholders, including the
authorities. We present three relevant case studies. In the first, we perform a longitudinal analysis of the pump and
dumps on 4 different exchanges. In the second and third, we focus on two pump and dumps done by big players—Big
Pump Signal and YoBit. Big Pump Signal is a group that works on Binance, able to generate a volume of transactions
of 5, 176 BTC (around $300M as of today) in a single operation, higher than the 534 BTC volume generated together
by all the pump and dump schemes on Cryptopia, YoBit and Bittrex according to [76]. Yobit is an exchange that in
2018, surprisingly, organized 3 pump and dump operations. We analyze these frauds and leverage the users’ comments
on Twitter to taste the feeling of the community about the pump and dumps. Lastly, we introduce a novel detection
algorithm that works in real-time, and we release the first dataset in the literature of confirmed pump and dumps,
available at [72]. The algorithm is not just based on the detection of the abrupt rise of the price. The fundamental idea
is to leverage the abnormal growth of so-called market buy orders, buy orders that are used when the investor wants to
buy extremely quickly and whatever is the price. Just like the colluding members of a pump and dump group when the
pump starts. We show that our real-time detector outperforms the current state of the art [46] in a significant way,
improving the expected speed of the detection from 30 minutes to 25 seconds and, at the same time, the F1-score from
62.7% to 94.5%. Moreover, we describe a new kind of pump operation—that we refer to as crowd pump to distinguish it
from the standard pump and dump. We conduct an in depth analysis of the crowd pumps carried out on the Dogecoin
and Ripple cryptocurrencies. Collecting and analyzing the messages on Reddit, we were able to reconstruct the way
these events occurred and how they started. Then, we discuss the differences in the organization and aim between the
standard pump and dumps and the crowd pumps. Lastly, we show that with a tuning of our pump and dump detector, it
is possible to use the proposed machine learning model to detect when crowd pumps are in action.
2 PUMP AND DUMP GROUPS

Pump and dumps are performed by self-organized groups of people over the Internet. These groups arrange the frauds
out in the open on the Telegram [57] instant messaging platform or Discord server [43], thus everyone can join the
groups without prior authorization. Along our longitudinal research, that goes from July 2017 to January 2021, we
joined and daily followed all the activities performed by more than 100 groups. Being member of the groups allowed us
to retrieve and collect one of a kind information such as internal group organization, the phases of pump and dump
arrangement and how the groups attract outside investors inside the market. In the following section, we report on the
findings we discovered about these communities.
The Doge of Wall Street: Analysis and Detection of Pump and Dump Cryptocurrency Manipulations 3
Fig. 1. Affiliate program and benefits of the Big Pump Signal group.
2.1 Group organization

Pump and dumps groups have leaders (or admins) that administrate the group, and a hierarchy of members. If a member
is higher in the hierarchy, he gets the message that starts the pump by reveling the target cryptocurrency a few moments
earlier than lower ranked people. This way, the member has higher probability to buy at a lower price and make more
money out of the pump and dump operation. The advantage in terms of time of being at a higher level is usually
between 0.5 and 1 second with respect to the next level, and the maximum advantage is in the interval between 1 and 10
seconds. Most groups are organized as an affiliation system —climbing the hierarchy is possible by bringing new people
to the group, the larger is the number of new members brought to the group, the higher the ranking. Fig. 1 shows the
affiliation system of the Big Pump Signal group and the rank’s benefits.
Some groups have a simple hierarchy with only two levels: Common members and VIP members. In these groups, to
become a VIP the user has to pay a fee, usually in Bitcoins, in the range of 0.01 to 0.1 Bitcoins (from approximately
$310 to $3100 at current exchange rates1 ). In the pump and dump groups, the admins are the only people that take
decisions. We saw only in rare cases the admins running polls to decide the hour of the pump or the exchange to use,
and never to decide the target cryptocurrency.
2.2 Group communication

To communicate and organize the pump, the groups typically use Discord servers and Telegram channels. Telegram is
an instant messaging service, and a Telegram channel is a special kind of chat in which only the owner of the channel
can broadcast public messages to all the members. Discord is a VoIP and text chat service. It was originally designed for
video gaming communities, but nowadays it is widely used by communities not related to video games. Discord offers
the possibility to create macro sections and host multiple chat rooms. Each section has its own topic or scope. In our
analysis we have found that all the pump and dump Discord servers are organized in roughly the same fashion, with
the following sections:
• Info & How-Tos: These two sections are like an electronic bulletin board with pinned messages. Both sections
are composed of several rooms that contain only one or very few messages. The rooms of the Info section usually
1 Data retrieved on January 10, 2021
4 La Morgia, et al.
contain the rules of the group, the news about the group, how the affiliation system works (Fig. 1), and the F.A.Q..
The rooms of the How-Tos section contain manuals related to the cryptocurrency world or the best practices to
participate in a pump and dump operation.
• Invite: This section contains rooms where the bots of the server live. Here, the users can query the bots in order
to generate invite links to bring new members or to know the number of people that joined the server by using
their invite links.
• Signal: This is the core section of the group, in which only the admins can write. Inside this section there are
usually two rooms: The pump-signal, and the trading-signal. In the first room, the admins share info about the
next pump and dump operation. In the second, they share trading advices.
• Discussion: in this section, there are rooms covering different topics where the group members can freely chat.
Usually, the messages written in the news and in the pump-signal rooms are broadcasted to the Telegram channel as
well.
2.3 Organization of the pump and dump operations

The levels of activity of the many pump and dump groups in the Internet differ considerably. The most active ones
perform roughly one pump and dump operation a day. Less active groups perform one operation a week. Other groups
perform operations only when they believe the market conditions are good. The steps during the operation are typically
as follows:
• A few days or hours before the operation the admins announce that the pump and dump will happen and
communicate which is the exchange that will be used, the exact starting time of the operation, and whether the
operation will be FFA (Free for All—everybody gets the message at the same time) or Ranked (VIPs and members
of higher levels in the hierarchy get the starting message before the other members).
• The announce is repeated several times, more frequently as the starting time of the operation gets closer.
• A few minutes before the start, the admins share some simple tips and best practices: Check your Internet
connection, buy low and sell high, disconnect all the other Internet activities to get low latency on your network,
hold the currency as much as possible waiting for an external investor. At this point, the free chat rooms are
closed in order to avoid so-called FUD (Fear, Uncertainty and Doubt)—sometimes due to actual human anxiety of
losing money, sometimes due to activities of disinformation done by people that have the goal of sabotaging the
operation, make people panic and make the panic spread in the group. This is also useful to avoid any possible
overload on the communication server.
• At the established time the targeted cryptocurrency is revealed, the exact time depends on the position in the
hierarchy of the group. Usually, the name of the cryptocurrency is contained in an image that is obfuscated in
such a way that only humans can read it correctly. Fig. 2 shows an example, a message that instructs to start a
pump and dump operation on the NevaCoin. The idea behind the obfuscation is to make it hard for bots to parse
the message with OCR techniques and start the operation faster than humans.
• Lastly, a few seconds after the start of the operation, the admins share a piece of news and invite all the group
members to spread the information that the price of the cryptocurrency is rising. This is done in dedicated chat
boxes, forums, and Twitter. This activity aims to attract external investors by creating FOMO—Fear of Missing
Out a unique investment opportunity.
Fig. 2. Messages that indicate the start of a pump and dump operation on the Streamr DATAcoin (on the left) and the NevaCoin (on
the right).
• Lastly, when the operation ends, the admins reopen the free chat rooms and share some statistics about the
pump with the members.
3 PUMP AND DUMP STAKEHOLDERS

In this section we outline a taxonomy of all the stakeholders involved in a pump and dump scheme, highlighting, for
each of them, their interests, motivations, and concerns.
3.1 Pump and dump groups

They are the main actors. Not every member is at the same level of the hierarchy and can gain from the operation.
Admins are the ones who take less risk, and their profit is almost guaranteed. In fact, by being the only ones who know
the target cryptocurrency beforehand, they can accumulate it before starting the pump and have the best chance to sell
their asset at a higher price during the dump. Of course, the accumulation needs to be slow. Otherwise, an abnormal
increase of volumes or price can unveil the target currency in advance to the other investors and make the operation
fail. The admins can also buy at a lower price just a few seconds before revealing the target coin. This practice is usually
called pre-pump and can cause a sudden rise in the currency price. A pre-pump is usually poorly seen by the group
members because the price is already higher than expected when they enter the market. Typically, accumulation is
done with currencies and exchanges with good volumes, while the pre-pump strategy with markets with low liquidity.
A third strategy is to accumulate or pre-pump in other market exchanges, different from those used for the pump. Or to
buy a different currency that, during the pump, gets pumped as well due to a stable conversion rate with the target.
VIP members are the highest-ranked members after the admins. They have a good chance of profit, but they had to
spend money or effort to get their status. Lastly, we have ordinary members. They are conscious that fraud is in action
and that their success is related to their trading skills and the presence of outside investors. Ordinary members can
quickly lose money. So, while it is true that admins can profit from a pump and dump operation, they have the concern
of keeping the trust of the group—they must organize the pumps in such a way to attract outside members. If too many
people of the group lose money, and the group can lose members.
6 La Morgia, et al.
Table 1. Effect of arbitrage.
Trading pair Exchange Volume ($) Open ($) Max($)

DATA/BTC Binance 5, 732, 909 0.0354 0.0916
DATA/ETH Binance 568, 722 0.0353 0.0924
DATA/BTC Bitfinex 103, 318 0.0353 0.0564
DATA/ETH Bitfinex 62, 640 0.0333 0.0552
DATA/USD Bitfinex 175, 274 0.0349 0.0551
DATA/BTC HitBTC 27, 502 0.0359 0.0564
DATA/ETH HitBTC 5, 084 0.0330 0.0735
DATA/USDT Gateio 31, 357 0.0347 0.0600
3.2 Exchanges
A cryptocurrency exchange is a business that allows customers to trade cryptocurrencies for other assets, such as
conventional fiat currencies or other digital currencies. Exchanges profit from transaction fees collected by both parties.
Every exchange has its fee system whose description, out of the scope of this work, is quite complex. However, we have
observed that a typical transaction fee is in the range between 0.1% and 0.2%.
From an economic point of view, it is pretty clear that the exchanges get profits from the pumps due to the high
volumes of transactions. On the other hand, pump and dump schemes often have the effect of a distributed DoS attack
on the exchange. Indeed, when the pump starts, many transactions are requested in a short time, and the web interface
of the exchange often freezes. The other users may think that the exchange does not work correctly or is too risky due
to evident market manipulation.
Moreover, we notice that pump and dump schemes do not effect only the target exchange. Indeed, the cryptocurrency
markets, like the real stock exchange markets, are constantly under monitoring of arbitrage bots that look for profitable
trading. Arbitrage is a practice that consists of taking advantage of the price difference between two markets by buying
in one market and selling in another market at a higher price. Some seconds after a pump and dump starts, the price of
the coin under attack quickly increases its price. The price spike triggers the arbitrage bots that start to buy and sell the
currency on a different market or other trading pairs. Table 1 reports the values during the pump and dump carried out
on the Streamr DATAcoin (DATA) of the 29th of September 2018 for different exchanges. As we can see, the biggest
transaction volumes and the highest prices are reached on Binance. Indeed, it was the exchange used for the operation.
However, also the other exchanges record a rise of the price in the same time range.
3.3 The target cryptocurrency

The first obvious consequence for a coin of being the target of a pump and dump is a few days of popularity. This can be
useful to make the coin stronger. However, the price after the pump and dump scheme usually gets back to normality
very quickly. Moreover, the cryptocurrencies with low market capitalization and without a strong community backing
are at the mercy of pump and dump groups that can manipulate their price very frequently. As a consequence, the
wider community starts to lose trust in the coin project, and tags it as a pump and dump coin or scam coin. At that point,
it can become very hard for the team of the coin to get back trust to the project.
Fig. 3. Example of shilling messages spread by the pump and dump groups.
3.4 Outside investors

Outside investors are the people who get cheated, since they are not conscious that a market manipulation is going on.
These traders start to buy the attacked coin thinking that the price is growing due to some strong economical reason,
or just due to some reliable crypto-influencer. In fact, the cryptocurrency market is highly volatile and very subject
to rumors and it is not unusual that a currency starts to increase very quickly. A combination of fear of missing out
from a good opportunity with a mis-interpretation of the market is what can attract the outside investors to a wrong
investment.
3.5 Signal groups

Pump and dump groups are not the only ones related to the cryptocurrency market. Indeed, there are other organizations
generally called signal groups. These groups are popular—during our research we found over 100 groups with more
than 30, 000 members each, and 5 with more than 150, 000 members. They are very similar to the pump and dump
groups—only the group owner can broadcast messages, and a user can become VIP paying a fee, usually between 0.01
and 0.05 Bitcoins for a lifetime subscription. VIP members can enjoy a private channel where the leaders disclose the
“most profitable forecasts”. This groups are used to share trading advices—called signals— that usually provide the
following information: The exchange, the trading pair, the buy zone, the stop loss, the targets, and a technical analysis
chart. The buy zone is the price range in which the currency should be bought, while the targets are sequential prices,
— usually 3, that the admins forecast that the cryptocurrency will reach. Instead, the stop loss is a price lower than the
buy zone, if the currency fall under the stop loss it should be sold. In this context, good predictions mean that more
users will join the VIP channel, and so pay the fee. Sometimes, the actions of signal groups are coordinated with pump
and dumps, and the admins of the signal group, by calculating the profit based on the spike during the pump and the
original value, can claim extraordinary profits based on their signals.
3.6 The shilling and the snowball effect

Some seconds after the start of the pump, the members of the group start to post messages about the target currency on
social networks, especially on Twitter. Some of them, after buying, simply retweet a post from the currency official
account, other members post messages about the growing price of the coin. In all of these cases, nobody mentions
that a pump and dump scheme is in action. This marketing strategy is usually called shilling. Few minutes after the
start, the most active members join the Telegram groups and the Reddit communities of the currency and share fake
news in order to attract investors to the coin, see Fig. 3. Meanwhile, the transaction volume of the currency increases
8 La Morgia, et al.
abnormally, and here starts the snowball effect. Social media bots with a large amount of followers post about the
phenomenon, exchange websites and cryptocurrency related websites that offer statistics add the coin in the “Top
gainer” list, Telegram channels signal advice for the coin. We also noticed that during some of the pump and dumps
also do some crypto-influencer tweet about the coins and, after a while, they delete the post claiming that it was a
pump and dump operation.
3.7 Authorities
Pump and dump schemes on cryptocurrencies are not illegal. Or rather, they are not regulated. There is evidence that
the authorities are concerned. The first mention about pump and dumps that we found from the authorities is on
December 12, 2017. Jay Clython, chairman of the US SEC (Security and Exchange Commission), with a personal Public
Statement [19] on the SEC website, advices the market participants that thinly traded and volatile markets are subject
to pump and dump schemes and other manipulations and frauds. A more specific article [16] about pump and dumps
was released in February 2018 by the US CFTC (Commodity Futures Trading Commission). In the article the CFTC
warns about pump and dump schemes, gives some guidelines on how customers can protect themselves, and describes
how the fraud works. The CFTC also informs about the opening of a bounty program against pump and dump schemes.
More in detail, the program provides a monetary award for users that share with the commission information that
leads to a financial sanction. The award is between 10% and 30% of the sanction, and it is possible to claim it only if the
sanctions are of 1 million dollars or more.
4 CASE STUDY
In this section, we present three case studies. In the first, we perform an analysis of the pump and dumps groups, the
targeted exchange, and the cryptocurrencies. In the second we focus on Big Pump Signal, arguably the biggest pump
and dump group, able to generate a volume of transactions of 5, 176 BTC in a single operation. Lastly, we present the
case study of the Yobit exchange that organized 3 pump and dump operations in 2018. We analyze these frauds and
leverage the users’ comments on Twitter regarding these events to understand the feeling of the crypto-community
about the phenomenon.
4.1 The groups, the exchanges, and the target cryptocurrencies

We conduct an in-depth investigation of the cryptocurrencies and the exchanges used for the pump and dumps. We do
so in a period that goes from July 2017 to January 2021. In this period, we found more than 100 groups, by keywords
search (e.g.: "Pump","Dump","Signal") on Telegram, Twitter, Reddit, BitcoinTalk [1], or manually extracting information
from CoinDetect [2] or the PADL [3] Android app. From this set, we select 20 different groups since the others are not
very active or have a small number of users. We include the list of the selected groups in the Appendix A.1. We report
the extended name, their Telegram link, and the short version of the name that we will use in the charts for each group.
Reading the Telegram channel history of these 20 groups, we found evidence of 1108 pump and dump events carried
out on 4 exchanges. We discovered that 206 of these operations were jointly arranged by more than one group. Hence
we have in our dataset 902 unique pump and dump operations.
Analyzing our data, we found that the scheme involved 378 different cryptocurrencies, only 340 of which CoinGecko
still lists. CoinGecko is a service that exposes APIs [21] to retrieve historical trading data. Instead, leveraging the
CryptoCompare API [22] we were also able to retrieve the market capitalization, at the time of the fraud, for 264 coins.
Analyzing the volume of the 24 hours before the pump of the target cryptocurrencies, we can see that 284 (83.5%) of
Binance Yobit Bittrex Cryptopia

Bittrex warns P&D groups Cryptopia Hacked
(2017-11-25) (2019-01-15)
PKG
C4P
LUX
CCS
CPI
CW
BPF
CP
TWP
Group
WCG
TCG
TCC
MPG
FCS
CPS
CCB
BPS
BPG
ATW
2017-07 2018-01 2018-07 2019-01 2019-07 2020-01 2020-07 2021-01
Date
Fig. 4. Pump and dump events by group and exchange during the analysis period.
them moved less than $1 million in total in all the exchanges. 182 (53.5%) of them moved a negligible amount of money,
less than $10, 000. Also, analyzing the market capitalization of 264 coins, we find out that 140 (71%) coins are below the
20 million dollars of market capitalization, with 44 (22%) below 1 million dollars.
The market capitalization of targeted coins is low, considering that the first asset with less than 20 million dollars
is at the 616𝑡ℎ position of the cryptocurrency ranking by market capitalization2 . Typically, Binance is the market of
choice for the pump and dumps on currencies with higher market capitalization, Cryptopia for those with lower market
capitalization. In particular, the median market capitalization of the cryptocurrencies for exchange is $25, 574, 192 for
Binance, $2, 619, 703 for YoBit, $2, 512, 627 for BitTrex, and $144, 373 for Cryptopia. Thus, the target cryptocurrencies of
pump and dumps have a very low net worth value and a vast circulating supply. Lastly, we find that 264 (78.3%) assets
are priced below 0.4 dollars. As such, with a relatively small investment, pump and dump groups can buy huge amounts
of shares and easily increase their price in the pump phase of the fraud.
Figure 4 shows the number of the pump and dumps by group and exchange. From the figure, we can note that the
groups typically tend to work on one or a couple of exchanges. That’s quite normal. Indeed, if the groups jump from
one exchange to the other, the members would be forced to move their assets according to the selected exchange, pay
the withdrawal and the network fees, and waste their time. Sometimes, the groups move from one exchange to another
due to external circumstances. For instance, 2 out of 3 groups that operated mainly on Cryptopia suddenly changed the
target exchange after Cryptopia was hacked in January 2019. In contrast, the third group waits almost a month before
moving on Binance. Another example is when Bittrex warned the community about its intention to ban users involved
in pump and dumps operations [10]. We can note that before the warning (the dashed line on the figure), 42 out of
54 (77.8%) operations are arranged on BitTrex. After, only 48 out of 817 (0.06%). From a longitudinal perspective, it is
possible to note that until May 2019 pump and dumps are evenly distributed among the four exchanges. After this date,
Binance has become the most popular exchange among the groups.
Looking at Figure 5, we can see that most of the pump and dump events are organized in the late afternoon of
the European timezones. Hours in which European web users are more active, according to [33, 52]. Moreover, the
2 According to CoinMarketCap data retrieved on February 18, 2021
10 La Morgia, et al.
300
250
Number of pump and dumps
200
150
100
50
0
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
Hours ofthe day (UTC)
Fig. 5. Pump and dumps during the hours of the day.
Table 2. YoBit pump and dumps.
Currency Date Volume($) Open price($) Max price($) Price increase

Putin Coin 2018-10-10 955, 077 0.0075 0.1131 1408%
Lambo Coin 2018-10-15 980, 645 158.08 320, 000 2024%
Chat 2018-10-17 661, 109 0.0320 0.3839 1099%
Binance exchanges do not allow US citizens to use their service. This information could indicate that the admins and
the members of the groups under investigation are mostly Europeans.
4.2 YoBit
YoBit is a Russian exchange active since August 2014. In October 2018, it processed almost 1 billion USD and it was the
43rd exchange by monthly traded volume. YoBit trades 485 different cryptocurrencies—4th exchange by number of
coins—with 7,899 different active trading pairs.
In October 10th, 2018, YoBit sent an email to all its users. In the email YoBit declares that it is arranging a pump and
dump event, and that the event will happen in 21 hours. At the same time, YoBit spread the news on its Twitter account
and set up a count-down web page. More in detail, the news claimed that the exchange would choose a random coin
and buy in a single shot 1 Bitcoin of the coin every 1-2 minutes for 10 times for a total of 10 Bitcoins. After the first
pump, done on the Putin Coin, YoBit repeated the event twice—on October 15th on the Lambo Coin and on October
17th on Chat. All the three cryptocurrencies had practically no transactions—in the 24 hours before the pump the three
coins moved $36, $800, and $59 respectively. In Table 2, we can see the volumes and the prices during the events. The
price of the Putin Coin, for example, has reached a peak of 14 times the opening price. The huge volumes and the high
prices of the coins during the events went back to their original state a few hours later.
This unprecedented behavior of an exchange hit the news—many tabloids reported on the event [23, 41, 73] and the
community started to tweet about it. We collected all the tweets sent as a reply to the announces by YoBit to see the
impact that the event had on the community and their feelings about pump and dump schemes. We got 517 tweets,
among which we removed 46 tweets that contained images only and 157 tweets actually not related to the pump and
dump events. We analyzed the remaining 314 tweets with the Google Cloud Natural Language API [36] to get the
sentimental score on the reaction of the community. After the analysis, we got that the 46.5% of the tweets had a
negative sentiment on the events. 42% a neutral feeling, and only 11.5% of the tweets a positive feeling. Moreover, several
crypto-influencers, experts on cryptocurrencies that have more than 30K followers on Twitter, strongly commented
against YoBit. Rudy Bouwman, co-founder of DigiByte, the 37th cryptocurrency in the World by market capitalization
at the time, tweeted about his will to remove DigiByte from YoBit and complaining about the impossibility to do it.
4.3 The Big Pump Signal group

With a peak of more than 200, 000 members on Telegram and 250, 000 members on Discord in January 2018, Big
Pump Signal (BPS) is arguably the largest pump and dump public community in the Internet. Reading the pump
announcements on the Telegram channel of Big Pump Signal, we found 41 pumps organized by them, 36 of which
carried out on the Binance exchange and 5 on Cryptopia. Throughout all their pump and dump operations, the group
moved globally $129, 674, 881 within an average of 5 minutes from their start; including the time interval of the whole
operations, the group moved globally $343, 433, 660. Their most successfully pump and dump was arranged on May 10,
2018, when they targeted the SingularDTV (SNGLS) alt-coin. In this operation, the value of the SNGLS coin sharply
oscillated for more than 9 hours and recorded a volume of around 5, 176 Bitcoin ($36, 750, 000). BPS has an affiliation
hierarchy. The highest level is achievable after inviting 250 new members. In ranked pump and dump operations,
the affiliation guarantees the members to receive the signal between 1 and 10 seconds before the unranked members.
The Big Pump Signalers have, since the beginning, promoted the group in many ways: advertisement on main social
networks like Twitter and Quora, through the affiliation systems, and by organizing lotteries inside the groups with
prizes in Bitcoin or Ethereum. Thanks to the aggressive marketing campaigns and the hype on the cryptocurrencies in
late 2017, the Big Pump Signal group has grown extremely fast.
The organization of the BPS pump and dumps steadily improved over time. In the beginning, they operated on a
single coin while double trading on the Bitcoin and Ethereum target pairs. The admins revealed the target coin to
the members in plain text. They also gave a target price to push the pump up to the target, attract external investors,
and profit by selling them afterwards. However, this strategy was the opposite of being optimal for the admins: They
noticed that greedy members started to sell below the target price value, preventing the pump and dump operation to
reach the highest peaks. So, they stopped target price actions and moved to a single trading pair to get maximum gain.
Successively, the admins discovered the presence of bots inside the channel. The bots were very fast at buying, much
quicker than the group members. So, the admins changed the pump and dump signal–from text to image–so it was
challenging for bots to read.
As the group grew larger, the admins started also targeting cryptocurrencies with medium market capitalization. The
admins claim that they base the choice of the coin on technical analysis. They also claim to re-pump the cryptocurrencies
by collaborating with a small investment firm. The investment firm is believed to be frequently involved in organizing
pump and dumps on their own. Examples are the pump and dumps of the Monetha coin (MTH) and the WePower (WPR)
coin on the Binance platform on September 17, 2018. Our analysis shows that BPS typically chooses cryptocurrencies
with a steady price and news coverage in the recent past. They leverage the news coverage to generate interest and
attract external investors. An example is the retweets of news from the fake Twitter account of John McAfee (e.g.
@oficiallmcafee, and @TheJohnMcafee) belonging to the admins of the group.
2018-01-03 PPT
2018-01-04 KMD
2018-01-07 NAV
Cryptocurrencies manipulated by the BPS group 2018-01-09
2018-01-13 GVT
DGD
2018-01-15 ICN
2018-01-20 BNT
2018-01-23 XZC
2018-01-27 BNT
2018-02-12 MOD
2018-03-11 DLT
2018-03-24 DNT
2018-04-04 ICN
2018-04-10 SNGLS
2018-04-14 TNT
2018-04-29 OAX
2018-05-12 YOYOW
2018-06-10 CHAT
2018-07-01 CLOAK
2018-07-04 NXS
2018-07-28 QLC
2018-09-09 VIBE
2018-09-22 NAV
2018-09-29 DATA
2018-10-06 EVX
2018-10-17 POLY
2018-10-20 XZC
2019-01-06 BNT
2019-05-26 POA
2019-06-02 SNM
2019-06-16 NEBL
2019-12-08 EDO
2020-12-04 PNT
2020-12-26 DLT
2021-01-02 NEBL
2021-01-09 EVX
$0 $10,000,000 $20,000,000 $30,000,000 $40,000,000
Pump and dump volume in USD
Fig. 6. Big Pump Signal pump and dumps.
Buy
60 Sell
50
40
Volume (BTC)
30
20
10
0
19:00:15 19:00:20 19:00:25 19:00:30
Time (UTC)
Fig. 7. Pump and dump on the OAX coin.
4.3.1 Analysis of the BPS pump phase. The BPS group moves large volumes of Bitcoins in each operation. Figure. 7
represents a zoomed image on the very first 30 seconds of the pump on the OAX cryptocurrency. The blue line in the
figure represents the volume of buys; the orange line the volume of sells. We observe that the buy and sells volume
in the first seconds is very close to zero. Then, there are two buy peaks (blue line in Figure 7) of approximately 65
Bitcoins (sec. 19) and 26 Bitcoins (sec. 21) respectively. The two peaks correspond to the actions of VIPs and the common
members—a normal behavior, considering that the group has a ranked policy. We also observe a peak in the sell volumes
(orange line in Figure 7) of almost 10 Bitcoins at the moment of the first buy peak, the 19th second. Considering that
group members are still buying and that the reaction time for outsiders is too short, this sudden big sell volume is
abnormal. There can be only two possible actors to sell their shares: the bots and the admins. To discern among the
two, we need to investigate the single transactions. Our analysis shows that, as the price rises, there are many small
sell operations at incremental values, probably by the arbitrage bots. Then, we observe a last single shot transaction
for over 4 Bitcoins when the OAX coin reaches the trading value of 0.00012 BTC, probably done by the admins of the
group. We believe they have operated through a sell limit trade order—a conditional order triggered when the price
of a trading pair reaches/out-tops a given value. Of course, the same order could have also been placed by an outside
investor. However, we believe that a sell limit of that amount, 41% more than the initial price, is most likely due to an
insider.
5 PUMP AND DUMP DETECTION

5.1 The idea
As we know, standard investors are the victims of pump and dump schemes. When they see that the price of a
cryptocurrency rises, they can believe it can be a good investment opportunity. This is not the case when a pump and
dump scheme is in action—the rise does not have economic grounds. It is just market manipulation. In order to protect
investors, it is crucial to understand if we can detect a pump and dump in action and how quickly. This is the goal of
this section.
To better understand how we can detect pump and dumps, it is essential to have some basic notions. The pending
orders for a cryptocurrency, like any other security, are listed in the order book for that cryptocurrency. The book is
a double sorted list of sell (ask) and buy (bid) orders not yet filled. The asks are sorted from the lowest price to the
highest, the bids from the highest to the lowest. The fastest way to buy on the market is through a buy market order.
A buy market order looks up the order book and fills all the pending asks until the requested amount of currency is
traded. Although a market order completes almost instantly, the price difference between the first and the last ask
needed to fill the order can be very high, especially in markets with low liquidity. So, the total cost of the order can
be impredictably high. A more careful investor would use limit buy orders, orders to buy a security at no more than a
specific price. Buy market orders are not frequent in everyday transactions, and investors use them when they need
fast execution, just like the members of pump and dump groups in action. Our idea is to use this pattern and other
information about volume and price to detect when a pump and dump scheme starts.
5.2 The data

As highlighted by Kamps et al. [46], it does not exist a dataset in the literature of the confirmed pump and dumps. Thus,
we need to build one for this work. From the 20 groups we joined, we select only the pump and dump schemes carried
out on Binance. We made this choice for two main reasons. The first one is that Binance exposes APIs [9] that allow
retrieving every single transaction in the whole history of a trading pair differently from other exchanges. The second
is that pump and dumps on other markets are usually carried out by groups with few active members and economic
resources. These groups can only target alt-coins that have almost no volume of transactions for days before the scheme.
Thus, we believe that pump and dumps carried out on Binance are the most interesting and challenging to detect.
From the initial set of pump and dumps, we select all the events on Binance—317 pump and dump events. We
retrieved the historical trading data for each pump and dump for 14 days, seven days before and seven after the event.
Some pump and dump are a few days apart on the same alt-coin, so we discarded duplicate days. In the end, we have
globally about 900 days of trading. The data are a list of trade records: Volume, price, operation type (buy or sell), and
the UNIX timestamps. The records belonging to the same order at the same price have aggregated quantities, and a
single order filled at different prices is split into more records.
Unfortunately, the Binance APIs do not tell the kind of order (e.g.: Market, Limit, Stop Loss) placed by the buyer, so
we need to infer this information. To do this, we can use the fact that market orders complete instantly, and so we can
aggregate the trades filled at the exact millisecond as a single market order. Since we do not know the original nature of
these orders, we define them as rush orders. A problem with this inference method is that it misses the market orders
that are filled by the first ask of the order book. Still, we believe that we have a good witness of market orders’ abrupt
rise even with this approximation. As a contribution to the community, we will publicly release this dataset[72].
5.3 Features and classifiers

To detect the start of the fraudulent scheme, we analyze several kinds of features. Then, we use them to feed two different
classifiers: Random Forest and AdaBoost. A Random Forest [12] is an ensemble learning method consisting of a collection
of decision tree classifiers such that each tree depends on the values of a random vector sampled independently, each
tree casts a vote, and the prediction is the most popular class between all the votes. An AdaBoost [28] is a meta-estimator
that ensembles multiple weak classifiers—a classifier that performs slightly better than a random guess into a stronger
one. It starts by training a weak classifier that assigns the same weight to all the dataset instances. It then fits additional
copies of the classifier on the same data, tuning the weights in favor of the previously misclassified instances. In our
case, the weak classifier is a Decision Tree [68] with a maximum depth of 5. We built our features upon the idea of [71]
for the detection of Denial of Service attacks through an adaptive threshold. Since we do not want to find a threshold in
our case, we rework their idea in this way: We split data in chunks of 𝑠 seconds, and we define a moving window of size
𝑤 hours.
We conduct several experiments with different sets of features and settings regarding the window and the chunk
sizes. Since our goal was to build a classifier able to detect a pump and dump scheme as soon as possible from the
moment it starts, the chunk size must be reasonably short. At the end of our study, we achieved the best F1-score with a
chunk size of 25 seconds and a window size of 7 hours; and the best speed with a chunk size of 5 seconds and a window
size of 35 minutes. Here are the features we used:
• StdRushOrders and AvgRushOrders: Moving standard deviation and average of volume of rush orders in
each chunk of the moving window.
• StdTrades: Moving stardard deviation of the number of trades.
• StdVolumes and AvgVolumes: Moving standard deviation and average of volume of trades in each chunk of
the moving window.
• StdPrice and AvgPrice: Moving standard deviation and average of closing price.
• AvgPriceMax: Moving average of maximum price in each chunk.
• HourSin, HourCos, MinuteCos, MinuteSin: The hour and minute of the first transaction in each chunk. We
encoded this feature with the sine and cosine function to express their cyclical nature.
Once a pump is detected, we pause our classifier for 30 minutes to avoid multiple alerts for the same event.
5.4 The importance of rush orders

In this section, we explore how the rush orders are important to detect the start of a pump and dump operation. Fig. 9
1.0
0.8
0.6
Precision
0.4
0.2 Train
Test
0.0 Threshold
0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0
Recall
Fig. 8. Precision recall curve for train and test sets.
shows the number of rush orders during a pump and dump scheme on the VIBE cryptocurrency on September 9th,
2018. As we can see, the rush orders are rare during the hours before the pump and suddenly grow just at the start of
the scheme. This experiment aims to understand if the rush orders are a practical feature to detect the beginning of
a pump and dump scheme and find a threshold beyond which the growth can be considered abnormal. To learn the
threshold, we proceed as follows: we compute the StdRushOrder feature as described in Section 5.3. Then we label
each chunk as True if the timestamp of the pump and dump signal falls into the chunk time range, False otherwise. We
randomly split our dataset into the train (50%) and test (50%) sets, we compute the precision-recall curve for the train
set, and we pick a threshold that is a trade-off between the precision and the recall. Then we evaluate the same metrics
at the picked threshold for the test set. Fig. 8 shows the results. We choose 12.8 as the value for the threshold (the black
dashed line in the figure). This value provides a precision of 81.2% and a recall of 91.1% on the train set (the blue line).
As we can see, the same threshold provides a very similar score on the test set, too (the red dashed line). Given these
results, we can claim that the rush orders feature is an excellent parameter to evaluate the start of a pump and dump.
5.5 The results

Although we retrieved 2 weeks of data for each pump and dump scheme, initially, we use only 3 days—the day of the
fraud, the day before, and the day after. We can reasonably assume that no other scams are present for the same coin in
this time frame. Indeed, among the market manipulations we collected, different groups arrange schemes on the same
alt-coin a few days apart. However, we are aware that some groups delete the pump and dump signal from the chat
history and that there are groups that we cannot monitor, such as groups that communicate in Chinese or Russian.
Since our dataset consists of 317 pump and dumps, we do not split the dataset into the standard train test sets. We
performed a 5 folds cross-validation to get a more reliable evaluation of the performance.
For the Random Forest classifier, we use a forest of 200 trees and a maximum depth of 5 for each tree. Table 3 shows
that the Random Forest classifier has outstanding results in terms of precision. However, the recall drops quickly, from
91.2% to 72.9%, when we reduce the chunk size from 25s to 5s. To address this issue, we introduce a new approach with
140
120
Number of rush orders
100
80
60
40
20
0
18:00 18:15 18:30 18:45 19:00 19:15 19:30 19:45 20:00
Time (UTC)
Fig. 9. Number of rush orders during the pump and dump on VIBE cryptocurrency.
Table 4. Features importance.

Table 3. Classifiers performance with K-Fold cross validation.
Feature Importance
Classifier Chunk size Folds Precision Recall F1 StdRushOrders 0.251
Kamps (Initial) 1 Hour - 15.9% 95.3% 27.2% AvgRushOrders 0.123
Kamps (Balanced) 1 Hour - 38.9% 93.2% 54.9% AvgVolumes 0.081
Kamps (Strict) 1 Hour - 52.1% 78.8% 62.7% StdTrades 0.073
StdVolumes 0.073
Random Forest 5 Sec 5 94.6% 72.9% 82.4%
AvgPriceMax 0.055
AvgPrice 0.032
MinuteCos 0.031
AdaBoost 5 Sec 5 90.0% 79.2% 84.2% MinuteSin 0.022
AdaBoost 15 Sec 5 91.7% 87.7% 89.7% StdPrice 0.013
AdaBoost 25 Sec 5 95.4% 90.9% 93.1% HourSin 0.011
HourCos 0.003
respect to the one used in previous work [53] that leverage an AdaBoost classifier. This approach is more balanced
in terms of precision and recall and has better results in terms of F1-score. Moreover, from the classifiers’ results, it
is possible to note the relationship between the chunk size and the performance of the classifiers. Indeed, while the
precision is relatively stable in all the time frames, the recall increases as we increase the chunk size.
In Tab 4, we list the importance, computed with the Gini Impurity, of each feature used with the Random Forest
classifier. As we can see, the best are the ones based on the rush orders and the number of trades. Once we defined
our methodology, we trained a 25-second detector classifier with the 3 day dataset and used the remaining part as a
test looking for other suspect events. After the evaluation, we got 86 events that we are not able to link to evidence.
Looking at the dynamics of the events, we believe that virtually all of them are pump and dumps whose evidence has
been deleted or organized by groups that may not be public or that we cannot monitor.
Fig. 10. DLT candlestick chart.
Fig. 10, for example, shows the candlestick chart for the Agrello coin (DLT) from May 8 to 13. The event in the center
is a pump and dump for which we have evidence. The other two are suspects detected by the algorithm. As you can see,
the behavior is almost the same, including the fact that the currency goes back to the regular price quickly (the dump).
Our classifier, based on the detection of the abnormal presence of rush orders and not just on the price of the security,
does a good job in detecting pump and dumps and suspect events that, anyways, the mindful investor wants to stay
away from. The classifier is very fast—it detects all the frauds in at most 5 seconds and, when there is a pre-pump, even
before the start.
5.6 Comparison with other pump and dump detectors

To the best of our knowledge, the best detector of pump and dumps in the literature is Kamps et al. [46]. We use their
algorithm as the baseline. Their detector takes as input candlesticks of 1 hour. So, the best performance, in expectation, is
of 30 minutes. Their methodology leverage two anomaly thresholds: Transaction volume and coin price. They compute
the values of the thresholds using windows on the recent history of the candlestick under observation. If both the
price and the volume are higher than the calculated thresholds, they mark the event as a pump and dump. Kamps et
al. provide three different parameter configurations to compute the threshold: Initial, Balanced, and Strict. The Basic
configuration maximizes the recall, the Strict the precision, while the Balanced is a trade-off of the two. In their work,
they mention the number of alleged pump and dumps that their classifier detects. Unfortunately, they don’t provide
scores in recall and precision since their dataset lacks ground truth.
To use the Kamps et al. detector as the baseline for our task, we implemented their classifier and tested it on their
dataset. We detected the same number of the pump and dumps they declare in their work. Then, we apply their
methodology to our dataset—Table 3 shows the results. As we can see, all our classifiers outperform in terms of F1-score
the Kamps et al. detectors. Our detector’s performance is considerably better, we score 98.2% of precision and 91.2%
recall against their 52.1% precision and 78.8% recall, and our detector is faster as well. These results also show that, due
to the cryptocurrency market’s high volatility, the detectors based only on the coin price and transaction volume are
prone to many false positives.
Differently from or work, Xu et al. [76] build a classifier able to predict the next pump and dump’s currency target to
provide a tool for strategic trade. Since the goals are different, we can not make a comparison in terms of performance
between our work and their solutions. Indeed, they prefer to maximize the probability of gain from the investment,
maximizing the recall at the expense of low precision. Xu et al. assume that buying wrong currencies does not affect
the trading strategy because, on average, this does generate an economic loss. Instead, in our case, we want to provide
a reliable approach—with high precision and recall— to help investors stay out of the market when a pump and dump
scheme is in action and to analyze anomalies in historical data.
6 CROWD PUMPS
Now, we focus on a new kind of pump operation. We will call it crowd pump—a pump and dump event that results from
the non-directly organized actions of a crowd of people. We analyze how these operations happen, and we illustrate
the differences from standard pump and dumps. Lastly, we offer that it is possible to leverage our dataset to build a
classifier that can also detect crowd pumps.
6.1 A description of the crowd pump phenomenon

In January 2021, the stock market was puzzled by an unprecedented rally of GameStop (GME). The GME stock had
been gradually losing value for a couple of years, as sales of physical copies of video games plummeted due to the
shift towards digital purchases [45]. During the period of the COVID-2019 pandemic, the situation worsened to the
point that GameStop announced it would close more than 1, 000 stores by April 2021 [38]. GME quickly became easy
prey for short-sellers, economic agents that bet on the fall of specific securities. Short-sellers borrow stocks, sell them,
and buy them later, when price is expected to be lower, to give them back to the lender. Many of them, including
Melvin Capital—a hedge fund that manages 13 billion dollars [69]—have seen the opportunity to make a profit from
short-selling GameStop stocks.
This operation would have gone unnoticed, as this market practice, albeit somewhat controversial, is common. The
turning point came when a group of users active on Reddit [67], one of the most popular social news aggregation and
discussion websites [25], started to buy large quantities of GME stocks. These users communicated in a subreddit—a
user-created board that covers a specific topic—called r\wallstreetbets. Initially, the users started to invest in the GME
stocks because they believed they were undervalued. Only later they began to do it as a political statement against
hedge funds [64]. The operation was a great success and the subreddit users managed to raise the stock price of GME
by more than 1900%, from $17.25 on January 4 to $347.51 on January 28 [56]. Due to the media interest, the subreddit
gained more than 3 million followers in that period. GME became the most traded stock in the U.S. stock market on
January 26 [55]. Due to the results of this operation, people started collaborating into buying other stocks such as
AMC (AMC Entertainment Holdings), BB (BlackBerry Ltd.), and NIO (NIO Inc.). Their prices increase rapidly in a few
days [65]. In response, several digital trading services like Robinhood began restricting trades on the stocks that were
getting pumped [31]. The Robinhood users reacted fiercely against this act, seen as a way to protect the hedge funds
that were losing money [8].
Due to these limitations, the attention moved to cryptocurrencies—less regulated and still with a combined market
capitalization that topped $1 trillion [24]. The first coin to get widespread attention was Dogecoin. Dogecoin was
originally founded as a joke on December 6, 2013 [63]. The price of the coin skyrocketed on January 28, 2021, after
a Reddit group, called \SatoshiStreetBets, proposed to make it the equivalent of GME for the cryptocurrency market.
Dogecoin had an increase in the price of over 800% in 24 hours, from $0.0077 to $0.07 according to data of CoinGecko [4].
The price increased in several distinct phases, driven by the tweets of well-known personalities like Elon Musk, rock
star Gene Simmons, and rapper Snoop Dogg, reaching its highest value ever of $0.0798 [13].
The second target was the Ripple (XRP) crypto-coin. At the time of these events, the XRP suffered a challenging
moment due to a lawsuit started on December 22, 2020. The SEC accused Ripple of performing illegal security
offerings of $1.3 billion in XRP for seven years beginning in 2013 [58]. This action caused a drop in the coin price
from $0.42 on December 22 to $0.18 on January 4. Several exchanges delisted XRP. Including Coinbase, one of the
largest [61]. The delisting reduced the liquidity of the coin significantly, creating the perfect breeding ground for market
manipulations [11]. In this case, the operation was organized on a Telegram group called "Buy & Hold XRP FEB 1st,
2021" that was later renamed "BUY & HOLD XRP FEB 1st, 2021 @8:30AM" [35]. The group grew exponentially in the
24 hours following its creation, reaching the limit of 200,000 members of Telegram. The group aimed to buy massive
quantities of XRP at a precise date and hour—February 1, 2021, at 13:30 UTC. However, many members started buying
it massively the days before the pump, and the cryptocurrency jumped 56% up in price, reaching the biggest single-day
percentage gain since December 21, 2017 [31]. So, the price was already high at the pump, and the group could not
increase it any further.
6.2 Analysis of crowd pumps

Although it is well-known that the Dogecoin pump starts from some popular subreddits [60], it is unclear who started
the pump and how they carried out the operation. We analyze all the Reddit users’ posts on the subreddits mentioned
above to answer these questions. A submission is the first post of a new discussion thread, and it may contain links, text,
and images. To perform our analysis, we downloaded all the submissions from January 01, 2021 to February 02, 2021 of
some popular crypto-related subreddits: r\SatoshiStreetBets, r\WallStreetBets, r\Cryptocurrencies, r\DogeCoin subreddits.
We downloaded data from these subreddits since in the period the terms "Doge" and "Dogecoin" appear mainly in them,
according to the Redditsearch tool [66]. To retrieve the submissions, we leveraged Pushshift [7], a service that provides
access to Reddit data overcoming the limit of 1,000 posts of the official APIs.
We globally retrieved 656, 146 submissions, of these 626, 700 (95.5%) from r\WallStreetBets, 23, 485 (3.6%) from
r\SatoshiStreetBets, 5, 443 (0.8%) from r\Cryptocurrencies and lastly 518 (0.07%) from r\DogeCoin. From the downloaded
data we took into account only the submissions that contain the name of the coin ("DOGE", "Dogecoin") and some of their
very popular variations used in the cryptocurrencies slang, such as: "DOGIE", and "DOGUE". In the end, we get 27, 868
submissions with the following partition: 19, 016 (68.2%) from r\WallStreetBets, 8, 383 (30.1%) from r\SatoshiStreetBets,
194 (0.7%) from r\Cryptocurrencies, and 275 (1%) from r\DogeCoin. Finally, we study the message distribution over time
and their relationship with the price of Dogecoin.
Figure 11 shows the number of submissions posted in the subreddits that mention the Dogecoin (solid blue line) and
the price of Dogecoin in Bitcoin (dashed gold line). As we can see in the upper left chart of the figure, subreddits rarely
mention the coin in the weeks before the pump, and the price is stable. In the 24 hours before the pump (vertical dashed
line), it is possible to note that some submissions about the coin begin to pop up steadily. However, the price is still
stable. After the vertical dashed line, the coin gets a massive spike in popularity, and the price abruptly rises. From this
moment, the price of the Dogecoin and the number of submissions on Reddit follow the same pattern. In the light of
this analysis, we dig into the posts before the pump. The goal is to understand how the users arranged the operation.
We find out that most of these posts tried to drum up the attention on the Dogecoin proposing to pump the currency.
Initially, the users did not welcome these posts. Very often, the administrators removed the content because it violated
the netiquette of the subreddit. Among these submissions, we found a particularly interesting one on the r\DogeCoin
Pump starts 1e 6
500
500
1e 6
2.5
2.5
400 2.0
400
Number of submissions
300 2.0
DogeCoin price (BTC)

1.5
200
1.0
300 100
0.5 1.5
0
01/01 01/05 01/09 01/13 01/17 01/21 01/25 01/2902/01
200
1.0
100
0.5
0
01/24 01/25 01/26 01/27 01/28 01/29 01/30 01/31 02/01 02/02
Date
Fig. 11. Number of submissions mentioning the Dogecoin vs. Dogecoin price in BTC.
subreddit. Here, a few users were trying to arrange a pump on the Dogecoin on January 28 at 10 AM, 5 hours later than
the actual start of the pump. Nonetheless, none of these submissions had any effect on the price of the Dogecoin, as
shown in Fig. 11. In our opinion and news [47], the message that triggered the rally of the Dogecoin, for timing and
users welcoming, was posted on January 28, 2021, at 4:05:50 UTC and states: "Let’s make DOGIECOIN a thing. That’s it,
that’s the post". The submission had only the title, no message body, and no picture.
To better understand why this message triggered the pump, we investigated the creator of the submission, expecting
her to be popular on the Reddit community. Surprisingly, we found out that, although the user is very active on Reddit
with more than 854 submissions and 769 comments, only 4 submissions (0.4%) and 17 comments (1%) are related to
crypto or finance. Thus it is doubtful that the author is a crypto-influencer, and it is hard to understand why so many
users followed this message.
We performed a similar analysis also on the crowd pump carried out on the Ripple cryptocurrency. For this case
study, we analyze the messages on Reddit in the same time frame we did for the Dogecoin, since the two events occurred
within a few days of each other. We consider the same subreddits of the previous analysis, with the exception of
r\DogeCoin subreddit and including the r\XRP (5, 444 submissions), obtaining globally 661, 072 submissions.
In this case, we focus on the submissions that mention one of the cryptocurrencies. Figure 12 shows the number of
posts in the subreddit that mention Ripple (solid blue line) and the price of Ripple (dashed gold line). As we can see, the
coin is rarely mentioned in the weeks before the pump, while it starts to get attention in the days before the pump.
Similar to what happened in the case of the Dogecoin pump. Reading these messages, we find out that the cause of
this increase in the posts is due to Redditors driven by anti-SEC sentiment and inspired by the Dogecoin and GME
pumps. The birth of the Telegram group "OFFICIAL BUY & HOLD XRP" gathered these users, and group members began
to promote the group itself. Different from the Dogecoin crowd pump, where the number of posts on Reddit and the
cryptocurrency price seem to follow the same trend, in this case, the two lines seem to be more independent, except for
the price peaks. Analyzing the beginning of the pump (solid dashed line in Fig. 12), it is possible to note that the price
quickly rises while the number of submissions on Reddit does not. Some hours after, the price comes back to its real
value (January 29 at 5:00 UTC), and then the price starts to increase again (January 30 at 16:00 UTC).
Pump starts 1e 5
120 500
1e 6
2.5
2.2
400
100
2.0 2.0
300
Number of submissions
1.5
200
1.8
XRP price (BTC)

80 1.0
100
0.5 1.6
0
60 01/01 01/05 01/09 01/13 01/17 01/21 01/25 01/29 02/01 1.4
40 1.2
1.0
20
0.8
0 0.6
01/24 01/25 01/26 01/27 01/28 01/29 01/30 01/31 02/01 02/02
Date
Fig. 12. Number of submissions mentioning XRP vs XRP price in BTC.
This behavior makes us suspect that the pump does not start from Reddit. Thus, we investigate the messages sent on
the Telegram group, for which we were able to export all the messages, files, videos, and images. Since, to the best of
our knowledge, the group is no longer accessible, and the group chat is not publicly available, we publicly release it as a
further contribution [6]. The Telegram group counted exactly 200,000 members, and 45,548 messages. We do not know
when the group was created, but the first message appears on January 28 at 20:19:09 UTC. Unlike pump and dumps, the
organizers did it on a Telegram Group instead of a Telegram Channel. Hence, all the group members could write in the
chat, not only the admins. After the creation of the group, the chat was open, and the members were able to talk about
the event and how to participate freely. However, the situation escalated around January 29 at 5:00 UTC. From this
moment, maybe for a slight fluctuation of the Ripple’s price or an extra-group coordinated action of a set of users, the
members start to urge the chat to BUY! the coin, starting the pump way earlier than expected. This event occurs almost
at the same time as the first spike in price that we see in Figure 12. The admins promptly reacted by turning off the chat
and resumed it only twice before the day of the pump—the first time on January 30 at 20:05 UTC, the second one on
January 31 at 6:03 UTC. In both cases, the chat opened only for 30 minutes, and the admins asked the member of the
groups to indicate from which countries they were posting. Then, the chat was opened again 9 hours before the pump
for a few seconds. As discussed before, the pump was a failure as the group could not further raise the price of the coin.
At the end of our analysis, we find the following main differences between crowd pump and pump and dump
operations:
• Different goal: The aim of a crowd pump is not to inflate the price of an asset and sell it to scam unaware
investors. In these kinds of operations, the organizer and part of the community often encourage the participants
to hold their stock to keep the value high. We noticed this attitude on both the crowd pumps carried out on the
crypto market. A clear example is the crowd pump organized on the XRP currency. In this case, the group creator
clearly states in the Telegram group chat that the operation aims to hold the currency. The admin also publishes
a disclaimer video on his Youtube channel explaining the purpose of the group. Quoting the description of the
Elon Musk tweet

1000 Rush orders with 10 minutes chunks
Rush orders with 25 seconds chunks
800
Number of rush orders
600
400
200
0
06:00 06:30 07:00 07:30 08:00 08:30 09:00 09:30 10:00
Time (UTC)
Fig. 13. Number of rush orders before and after the tweet of Elon Musk about Dogecoin (February 4 at 7:57 UTC).
video: "This is not a "pump and dump" group. This is a community-led event to bring awareness to the XRP
ledger" [14].
• Lack of coordination and leadership: Even if we saw on both the crowd pumps attempts to coordinate to buy
at a specific hour, they always failed. Unlike standard pump and dump, the organizers reveal the coin to pump in
advance. Thus, people start to buy the coin in advance or when they believe that the operation has begun. A
simple fluctuation of the market or a single post can trigger a ripple effect that leads to the start of the pump.
• Different time frame and price increase rate: As we saw, in standard pump and dump, the operation lasts
for few minutes or rarely for a few hours, and the price grows almost immediately. In crowd pumps, the price
increases abnormally, but it takes hours or days before the coin reaches its maximum peak. This behavior is due
to several factors. The goal is different, and some investors do not immediately sell the coin to take the profit. No
one knows when the pump will start. Therefore it can take time before the crowd realizes that the operation has
begun. Finally, the news and influencers work as an echo chamber, and more and more people join the process
making the price of the coin increase in waves. Consequently, while in standard pump and dump the price of the
coin returns to its natural level as the event ends, in crowd pump and dump, after more than a month3 , the price
of the Dogecoin is still 500% higher than its pre-pump value, and the XRP is stll 100% higher.
6.3 Crowd pump detection

In this section, we assess the potential of our machine learning model in detecting the crowd pumps. Although there
are some key differences between crowd pumps and standard pump and dumps, our intuition is that the rush orders are
a very relevant feature also in this kind of operation.
In particular, we consider the amount of rush orders in an interval of the two hours around the publication of a tweet
of Elon Musk that shill the Dogecoin [13]. We make this choice because in this case we have the timestamp of the tweet
3 March 2, 2021
and we can be sure about the moment in which the operation starts. Figure 13 shows the number of rush orders in two
hours around the publication of the tweet. The purple line represents the number of rush orders grouped in chunks of
25 seconds, while the red line in chunks of 10 minutes. In the figure, it is possible to note a considerable amount of rush
orders after the tweet, precisely like in pump and dump events after the admin announces the target coin. However,
looking at the purple line (25 seconds chunk), we find that the pattern of the rush orders is very different from the one
we see for the standard pump and dumps (Figure 9). Indeed, there is no neat big spike in the number of rush orders,
but a gradual increase with several small spikes. This behavior is not surprising. There is no synchronization of the
investors—they jump into the market in waves depending on when the message hits the social platforms on the web
and when they see it.
Due to this different behavior, our detector trained on the standard pump and dumps cannot capture the crowd
pump analyzing short chunks of transactions. And we cannot efficiently train a new detector for the crowd pumps
because of the lack of a dataset. However, expanding the chunk’s time frame size makes it possible to collapse the
different waves of rush orders into a unique chunk and get a well-outlined spike. The red line in Figure 13 shows the
number of rush orders grouped in chunks of 10 minutes. Here, we can see that the pattern is very similar to a pump
and dump operation, like the one we reported in Figure 9, and thus it is now reasonable to think that our detector can
find these kinds of events.
6.3.1 The new model. To detect the crowd pumps, we trained a new classifier based on the Random Forest algorithm
like the one used to detect standard pump and dumps. This time we trained the model on the full dataset (317 pump and
dump events) described in Sections 5.2. We used the same feature we leveraged to build the previous detector, except
for the one related to the time. We removed these features because they are specifically tailored for the standard pump
and dumps carried out by Telegram groups. The new detector achieves an F1-score of 89.4% in 5 fold cross-validation.
For the training phase, we used 25 seconds chunks. Instead, for the test phase, we aggregate the trading data in chunks
of 10 minutes. After detecting an event, we pause our classifier for 6 hours to avoid multiple alerts. In this case, we
pause the classifier longer than we did for the standard pump and dumps because the operations last more time.
6.3.2 The Dogecoin pump. To find out if our detector can catch the start of the Dogecoin crowd pump, we downloaded
all the transactions from Binance, from January 1 to February 10, 2021. Even though we know that the pump happened
on January 28, 2021, we run the detector for some weeks before the pump to check if any suspicious activity is detected
and to validate the classifier’s robustness on false positives. At the end of the execution, our classifier detects the
following 5 events:
(1) January 2, 2021, at 3:00 UTC: At first sight, the even seemed a false positive. However, after a search on the
web, we found that the news [32] reported a price surge of the Dogecoin driven by a tweet from the adult film
star Angela White. The actress stated that she is a Dogecoin investor since 2014. The tweet features a photo of
the actress wearing a T-shirt with a Shiba Inu image, the Dogecoin mascot, and received more than 10,000 likes.
(2) January 28, 2021, at 4:10 UTC: This alert falls exactly in the same chunk of the Reddit post that sparkled the
Dogecoin popularity in the r\SatoshiStreetBets subreddit, discussed in Section 6.2.
(3) January 28, 2021 at 14:20 UTC: It is not easy to link this warning to an individual event. However, investigating
on Reddit and Twitter, we find on Reddit an abrupt increase of messages that mention the coin (see Figure 11).
Moreover, between 14:00 UTC and 15:00 UTC in the U.S.A., the hashtag "#dogecoin" became a trending topic on
Twitter, with more than 91.000 tweets. 2 hours later "#dogecoin" became a worldwide trending topic, accordingly
with the data provided by ExportData.io [27] and TT-History [42]. In our opinion, it safe to assume that this
alert detected a large number of investors that have flooded the market.
(4) January 28, 2021, at 23:40 UTC: This is very likely due to Elon Musk’s tweet (January 28, 2021 at 22:47 UTC)
on the Dogecoin. In particular, the tweet contains a picture that mimics the Vogue magazine with a dog picture
on the cover, and the title of the magazine changed to "Dogue." More than 450,000 users liked this tweet. The
detector raised the alert about one hour later. However, looking at the price evolution of the Dogecoin in the
hour following the tweet, it is possible to note that investors enter into the market slowly. Indeed, at the time of
the tweet, the price of the Dogecoin was at $0.024; at the time of the alert, the price was $0.03 (+25%). The coin
reached its first peak in price one hour later, touching $0.05 (+108%). Then, around the 4:00 UTC of January 29,
the coin achieved $0.08 (+233%) its maximum price of the month.
(5) February 4 at 8:00 UTC: This alert is also related to a Tweet of Elon Musk. This time he posted a tweet that
contains a meme portraying him as Rafiki from the Lion King—the animated movie, standing on Pride Rock
and raising a Doge-headed Simba [39]. In this case, our detector captured the abnormal market movements 13
minutes after the tweet has been posted (i.e. the very first chunk computed after the tweet). Unlike the previous
tweet, this one gets much more attention with more than 1 million likes on the social network, and the market
reacts faster. In this case, our classifier detects the event when the price of the Dogecoin was at $0.04, while the
coin reaches its price peak at $0.06, almost one hour later.
6.3.3 The Ripple pump. Again, for the Ripple crowd pump, we run our classifier on all the transactions closed on the
Binance exchange from January 1 to February 10, 2021. In the considered time frame, the detector raises the following 4
alerts:
(1) 6 January, 2021, at 14:40 UTC: To the best of our knowledge, this alert is not related to the Reddit community.
Instead, the news that a petition to the White House to stop the SEC lawsuit against Ripple hits 35,000 signa-
tures [18] has probably caused new trust in the XRP coin. The price went from $0.23, at the moment of the alert,
to $0.37 (+38% ) of the following day.
(2) 19 January, 2021, at 5:50 UTC: This is the exact moment when several exchanges, including Coinbase, the 3𝑡ℎ
exchange by volume of transactions, delisted XRP from the trading pairs [61]. The delisting follows the SEC
lawsuit. The 2 hours after the alert, we record an abrupt rise of transaction volume on Binance and the price
from $0.29 to $0.33 (+9%). The alert is probably due to trading bots or investors that moved their assets from one
exchange to another.
(3) 29 January, 2021 at 5:00 UTC: This is when we noticed the excitement in the "OFFICIAL BUY & HOLD XRP"
group, with the members of the group that start to urge to buy the coin. As we discussed in Section 6.2, the users’
excitement comes together with the beginning of the XRP rally.
(4) 30 January, 2021 at 16:00 UTC: For this alert, we do not have clear evidence of what triggered the event.
However, in the hour before this alert, the Ripple cryptocurrency starts to hit the news, becoming one of the
most searched words worldwide on Google [15, 37]. At the same time, the number of posts on Reddit about the
Ripple cryptocurrency increased dramatically. Driven by the news, an odd number of investors may have joined
the market and started to buy in a rush the currency to avoid missing a good profit opportunity, triggering our
detector.
It is important to note that when the pump was scheduled (February the 1st, 2021, at 13:30 UTC), the detector did
not raise any alert. This is not surprising since, as discussed before, the pump failed [34]. Thus, the classifier detected
the start of the pump two days before, catching the users that bought the coin in advance.
Looking at the results we achieved, we believe that our first attempt to build a classifier to detect crowd pump events
shows excellent results. Nonetheless, we could further improve our detector by combining features from social media
and related to the market exchanges’ financial transactions.
7 RELATED WORK
The pump and dump phenomenon is older than the cryptocurrency revolution. Therefore, a vast portion of the literature
is about pump and dumps done in the traditional stock market. Allen et al. in [5] identifies three categories of market
manipulation schemes: Information-based, action-based, and trade-based. The pump and dump schemes are usually a
combination of information-based and trade-based manipulation. In 2004, Mei et al. [59] show that it is possible to
carry out pump and dump schemes just leveraging the investors’ behavioral biases. They test their theory on the pump
and dump cases prosecuted by the SEC from 1980 to 2002, which confirms their hypothesis.
Several case studies highlighted that emerging markets were prone to pump and dump schemes. Khwaja et al.
in [48] show that the limited Pakistani regulation on the national stock exchange allowed brokers of the Karachi Stock
Exchange to arrange pump and dump schemes. Jiang et al. [44] investigate the stock pools scheme of the ’20s using
daily trading volume from the New York Stock Exchange between 1927 and 1929. The stock pools are groups of traders
that delegate to a single manager to trade stocks on their behalf. Since a pool can move a large amount of money, it
can increase the volume of trades and attract outsiders to the market. When the stock pool exits the market, the price
quickly drops. As reported by the University of Innsbruck in [29], the internet boom in the early years of 2000 led to the
birth of a new email-based pump and dump scheme. In this new kind of fraud, the manipulators secure their position
on the market and then send millions of e-mails claiming to have private information about substantial increases in the
prices of specific stocks. After luring new investors, and the price higher, the manipulators sell the security and stop
the spam campaign. A subsequent analysis in 2013 by Siering in [70] shows that despite the authorities have taken
several countermeasures against fraudulent stock recommendations, email-based pump and dump campaigns are still
flourishing.
The work of Gandal et al. [30] show evidence that the first price spike to $1000 of the Bitcoin may be market
manipulation. Using the well-known dataset of the Mt.Gox exchange, they found suspicious trading activities carried
out by two actors, named ’Willy bot’ and ’Markus bot.’ The purpose of these actors was to buy Bitcoin to increase the
price and the daily volume artificially. Krafft et al. [49] investigate the behavioral patterns of the users on the Cryptsy
exchange market. In their work, they show that even tiny volumes of buy trades can influence the market. They use
bots to buy a small number of random currencies and conclude that traders tend to buy coins with recent activities.
Li et al. [54] conduct an empirical investigation on trading data obtained from the pump and dumps from Binance,
Bittrex, and Yobit, focusing on the economic point of view. They show that pump and dumps lead to a short-term
increase in prices, volume, and volatility followed by a reversal of the trend after some minutes. Moreover, they show
that the investors’ gain depends critically on the time they obtain the signal, and for this reason, outside investors
are systematically disadvantaged. Victor et al. [74] perform quantification and detection of pump and dump schemes
coordinated through Telegram and executed on Binance. They test their machine learning model considering 125
pump and dump collected from Telegram as confirmed pumps and the 20 most retweeted tweets of the official Twitter
accounts belonging to each coin as negative samples. They do not aim to catch a pump and dump in real-time as their
feature considers a 30 minutes interval and tries to capture both the pump and the dump phase. Hamrick et al. [40]
conduct an analysis on Discord and Telegram, identifying more than 5, 000 pump and dumps from January 2018 to early
July 2018. However, they use a different definition of pump and dump, including events that we define ’signals.’ With
our definition, they found 704 pump and dumps. They measure the factors that lead to the success of a pump, defined
as the increase in the price of the coin. Some of the most important being the volatility of the coin and the number of
people in the groups. Dhawan et al. [26] study 355 cases of pump and dumps in the cryptocurrency markets. They
show that pumps generate a price distortion of 65% on average, abnormal trading volumes in the millions of dollars,
and enormous wealth transfers between participants. They highlight that this kind of manipulation is likely to persist
as long as regulators and exchanges turn a blind eye. Nizzoli et al. [62] conduct a study on 50M messages collected
on Twitter, Telegram, and Discord. They highlight the existence of two different manipulations: Pump and dump and
Ponzi schemes. They found out that 56% of crypto-related Telegram channels are involved in manipulations and that
bots massively broadcast these deceptive activities. Chen et al. [17] develop an apriori algorithm to detect pump and
dump on Bitcoin using the leaked transaction history of Mt. Gox Bitcoin exchange. They do not have a ground truth
of confirmed pumps. Thus, they try to find groups of users who usually buy or sell the asset simultaneously. This is
possible thanks to each user’s complete transaction history–information typically unavailable and protected by privacy.
The work of Kamps et al. [46] shows a first attempt to detect pump and dumps using an adaptive threshold. They bring
up the issue that a reliable dataset of the confirmed pump and dumps scheme does not exist, so they can not fully
validate their results. A contribution of our work is to release such a dataset. Xu et al. [76] focuses on the difficult task
of predicting pump and dumps, using one-hour intervals data from Cryptopia and Yobit, also showing an approach to
leverage the prediction to invest in alt-coins. Since both works have some goals in common with ours, we conducted a
thorough analysis of their results on subsection 5.6.
8 DISCUSSION
Is it possible for pump and dump groups to avoid detection? We based our features on the abnormal change of
some market parameters and, at the same time, such that to be robust against the natural oscillations of the volatile
cryptocurrencies market. If the admins of groups or other members buy the currency gradually, and the users are few,
our classifier may not detect the pump and dump. Indeed, our classifier cannot detect four of the pump and dumps in
our dataset. These four events were all carried out by one group, and all of them record a consistent pre-pump phase in
the hours before the pump. Fortunately, admins cannot use this technique regularly to avoid detection. Indeed, outsiders
could detect this pattern to increase the probability of predicting the target coin. Moreover, these events often fail, and
most users could lose trust in the admins and leave the group.
Can pump and dump groups manipulate Bitcoin or major cryptocurrencies? To answer this question, we make
a short simulation. Let us take the buy volume on the first 10 minutes of the largest pump and dump we monitored. It
is 31 BTC on the SingularDTV (SNGLS). Now, we take a snapshot4 of the exchange order book for the trading pair
BTC/USD, and we assume that the market is frozen and only the members of the pump and dump group can take
actions. This is the best case for raising the price. We find that the amount of money at their disposal can increase the
BTC value by less than $5, which is way smaller than the natural oscillations of the coin in 10 minutes. So, the answer
is no. Though these groups are very large, they can’t attack coins with large volumes like Bitcoin.
4 Data retrieved on April 12, 2019

Is it possible for the exchange markets to stop pump and dump schemes? In this work, we show that it is
possible to detect a pump and dump scheme as soon as it starts. We also believe that exchanges can catch better than us
when a fraudulent scheme is in action. In fact, the data owned by the exchange is more fine-grained: It has complete
knowledge on the kind of operations performed, their amount, and precisely who performed them during the scheme.
Moreover, we notice that little policy enforcement can reduce the number of these market manipulations. As discussed
before, on November 25, 2017, the BitTrex exchange announced that it actively discourages any market manipulation
and will begin to punish the participants [10]. Since then, the amount of pump and dumps in the exchange drastically
decreased. We counted, before the statement, more than 50 pump and dumps in the five months from July to the end of
November 2017, and only 48 events in more than three years after the statement. Another possible counter-measure
could be to stop transactions on a security when it gains or loses more than some threshold or give special protection
to cryptocurrencies with extremely low market capitalization and trading volumes. Moreover, some exchanges list
cryptocurrencies with shallow trading volumes. De-listing these cryptocurrencies, as some exchanges do [20], could
make smaller groups desist.
Can signal groups manipulate the market? In our analysis, we found several signal groups, many more, and with
a more significant number of members than the pump and dump groups. As we discussed in 3.5, they leverage the
pump and dumps for a return of image, although we cannot be sure about the nature of their intention. Unfortunately,
detecting possible collusion between the pump and dump and the signal groups is very hard. Indeed, the pump and
dump group members know when the pump and dump signal will be released, while members of the signal group join
asynchronously. Considering the number of group members and that multiple signal groups recurrently and frequently
(every few hours) suggest buying the same cryptocurrencies, we believe that their good forecasts and their success rate
could often be self-fulfilling prophecy than the results of sound market analysis.
9 CONCLUSION
In this work, we conducted an in-depth analysis of the pump and dump ecosystem. We defined a taxonomy of all
the stakeholders involved in the market manipulation scheme. We studied the relationship between the groups, the
exchange, and the target cryptocurrencies in a longitudinal analysis that spans over three years. We performed a
thorough investigation on the Big Pump Signal group and the pump and dump operations carried out by the Yobit
exchange. Moreover, we introduced our classifier that leverages the rush orders, a peculiar kind of order that is particularly
effective for the detection. The proposed classifier outperforms state of the art both on performance (98.2% of precision
and 91.2% recall against 52.1% precision and 78.8% recall) and on speed, moving the expected time of detection from 1
hour to 25 seconds. Given the lack of a pump and dump dataset, as a further contribution, we release to the community
our resource [72] of more than 900 confirmed pump and dumps to enable further studies on the topic. precision and
78.8% recall) and on speed, moving the expected time of detection from 1 hour to 25 seconds. Finally, we moved on the
crowd pump. Here, we conducted the first analysis based on data on this kind of operation and show the potential of a
purely market-based approach to detect these kinds of events. The classifier achieved promising results, catching the
start of the two operations a few minutes after their opening and detecting the abnormal market conditions driven by
tweets of celebrities. We think that this work helps to understand a complex phenomenon, improve the awareness of
the investors interested in the cryptocurrency market, and can help the authorities regulate this particular market in
the future.
10 FUTURE WORK
A possible future direction for this work is to integrate inside our system new features based on information extracted
from social networks like Reddit or Twitter. As seen before, Figure 11 and Figure 12 show that there is some correlation
between Reddit submissions and the increase in the price of the coin. This suggests that information extracted from
social networks may be used as a feature to identify crowd pumps. In particular, the advantage of integrating social
media in the model may be crucial to help disambiguate cases where the rise in the price of the coin is not due to market
manipulation but to solid market fundamentals. Lastly, during our study, we found a large number of signal groups.
These groups are more significant than the pump and dump groups and arrange operations more frequently. As future
work, it would be interesting to study the impact of these groups and their activity on the market.
APPENDIX
A.1 Monitored Groups
Table 5. This table reports the acronym that we will use in the charts, the extended name,
and the Telegram link of each monitored group.
Group code Group name Telegram link

TCC Trading Crypto Coach https://t.me/tradingcryptocoach
TCG Trading Crypto Guide https://t.me/TCGFORYOU
BPS BigPumpSignal https://t.me/bigpumpsignal
BPG BigPumpGroup.com https://t.me/bigpumpgroup_com
MPG Trading Mega Pump Group https://t.me/mega_pump_group
C4P Crypto4Pumps https://t.me/Crypto4Pumps
PKG Pump King Community https://t.me/pumpingking
ATW AltTheWay https://t.me/AltTheWay
LUX Luxurious https://t.me/LuxuriousCrypto
CPS Cryptopia pump squad https://t.me/cryptoflashsignals
CCB Crypto coin B https://t.me/CryptoCoinsCoach
FCS Fast Crypto Signals https://t.me/fastcrypt
WCG Whales Crypto Guide https://t.me/Whalesguide
TWP Today We Push https://t.me/TodayWePush
CP CrypticPumps https://t.me/CrypticPumps
BPF Big Binance Pump Family https://t.me/rocketpumptrader
CW Crypto Waves https://t.me/CryptoCoinsWaves
CCS Coin Coach Signal https://t.me/CoinCoachSignals
SE Signal Express https://t.me/signalexpresss
CPI Crypto Pump Island https://t.me/crypto_pump_island
REFERENCES
[1] [n.d.]. Bitcointalk, official forum of Bitcoin. https://bitcointalk.org
[2] [n.d.]. CoinDetect. https://coindetect.org
[3] [n.d.]. PADL - Crypto Pump and Dump Groups -Signals - List. https://padl.mine.nu
[4] 2021. Dogecoin chart. https://www.coingecko.com/it/monete/dogecoin/usd
[5] Franklin Allen and Douglas Gale. 1992. Stock-price manipulation. The Review of Financial Studies 5, 3 (1992), 503–529.
[6] Anonymized. [n.d.]. The resource will be available after acceptance.
[7] Jason Baumgartner, Savvas Zannettou, Brian Keegan, Megan Squire, and Jeremy Blackburn. 2020. The pushshift reddit dataset. In Proceedings of the
International AAAI Conference on Web and Social Media, Vol. 14. 830–839.
[8] Allana Akhtar Ben Gilbert. 2020. Robinhood users are revolting against the trading app after it stopped trades of GameStop. https://www.businessinsider.
com/gamestop-stock-trading-robinhood-users-critics-revolt-2021-1?IR=T
[9] Binance. 2018. Public Rest API for Binance. https://github.com/binance-exchange/binance-official-api-docs/blob/master/rest-api.md
[10] BitTrex. 2018. What are my trade limits? https://support.bittrex.com/hc/en-us/articles/115003004171
[11] Charles Bovaird. 2021. XRP Plunged More Than 50% After Its Latest Pump. https://www.forbes.com/sites/cbovaird/2021/02/01/xrp-plunged-more-
than-50-after-its-latest-pump/?sh=4d162f3b70ac
[12] Leo Breiman. 2001. Random forests. Machine learning 45, 1 (2001), 5–32.
[13] Ryan Browne. 2021. Tweets from Elon Musk and other celebrities send dogecoin to a record high. https://www.cnbc.com/2021/02/08/tweets-from-elon-
musk-and-celebrities-send-dogecoin-to-a-record-high.html
[14] THE XRP BULLY. 2021. FEBRUARY 1ST, 2021 PUMP & HOLD XRP DISCLAIMER. https://www.youtube.com/watch?v=cv9eVZMbwt0&t=8s
[15] Trend Calendar. 2021. Trending words on 30th January, 2021. https://us.trend-calendar.com/trend/2021-01-30.html
[16] U.S. C.F.T.C. 2018. Customer Advisory: Beware Virtual Currency Pump-and-Dump Schemes. https://www.cftc.gov/sites/default/files/idc/groups/
public/customerprotection/documents/file/customeradvisory_pumpdump0218.pdf
[17] Weili Chen, YueJin Xu, Zibin Zheng, Yuren Zhou, Jianxun Eileen Yang, and Jing Bian. 2019. Detecting" pump & dump schemes" on cryptocurrency
market using an improved apriori algorithm. In 2019 IEEE International Conference on Service-Oriented System Engineering (SOSE). IEEE, 293–2935.
[18] Scott Chipolina. 2021. XRP Petition to the White House Hits 35,000 Signatures. https://decrypt.co/53326/american-public-asks-government-to-deem-
xrp-a-currency
[19] Jay Clython. 2017. Statement on Cryptocurrencies and Initial Coin Offerings. https://www.sec.gov/news/public-statement/statement-clayton-2017-
12-11
[20] Jay Clython. 2018. Customer Advisory: Beware Virtual Currency Pump-and-Dump Schemes. https://bit.ly/2pS66X1
[21] CoinGecko. 2021. CoinGecko API. https://www.coingecko.com/en/api
[22] CryptoCompare. 2021. CryptoCompare API. https://min-api.cryptocompare.com/i
[23] Eustace Cryptus. 2018. YoBit Inflates PutinCoin in Blatant Pump and Dump Promotion. https://bitcoinist.com/yobit-inflates-putincoin-in-blatant-
pump-and-dump-promotion/
[24] Anthony Cuthbertson. 2021. Dogecoin: GameStop frenzy takes crypto market over $1 trillion as Reddit stock investors switch to bitcoin rival.
https://www.independent.co.uk/life-style/gadgets-and-tech/dogecoin-price-stock-buy-gamestop-reddit-bitcoin-b1794695.html
[25] Geoff Desreumaux. 2018. Sorry Facebook, Reddit Is Now The Third Most Popular Site In The US. https://wersm.com/sorry-facebook-reddit-is-now-
the-third-most-popular-site-in-the-us/
[26] Anirudh Dhawan and Tālis J Putnin, š. 2020. A new wolf in town? Pump-and-dump manipulation in cryptocurrency markets. Pump-and-dump
manipulation in cryptocurrency markets (August 10, 2020) (2020).
[27] ExportData.io. 2021. Twitter Data Export & Analysis Tool. https://www.exportdata.io/trends/
[28] Yoav Freund and Robert E Schapire. 1997. A decision-theoretic generalization of on-line learning and an application to boosting. Journal of computer
and system sciences 55, 1 (1997), 119–139.
[29] Laura Frieder and Jonathan Zittrain. 2007. Spam works: Evidence from stock touts and corresponding market activity. Hastings Comm. & Ent. LJ 30
(2007), 479.
[30] Neil Gandal, JT Hamrick, Tyler Moore, and Tali Oberman. 2018. Price manipulation in the Bitcoin ecosystem. Journal of Monetary Economics 95
(2018), 86–96.
[31] Chaim Gartenberg. 2021. XRP Posted Biggest Single-Day Gain in 3 Years in a Coordinated Buying Attack. https://www.theverge.com/2021/1/28/
22254102/robinhood-gamestop-bloc-stock-purchase-amc-reddit-wsb
[32] Mustafa Gatollari. 2021. Angela White Tweeted About Dogecoin and Its Value Skyrocketed 125 Percent. https://www.distractify.com/p/angela-white-
dogecoin
[33] Phillipa Gill, Martin Arlitt, Zongpeng Li, and Anirban Mahanti. 2007. Youtube traffic characterization: a view from the edge. In Proceedings of the 7th
ACM SIGCOMM conference on Internet measurement. 15–28.
[34] Omkar Godbole. 2021. CXRP Pump Fails to Materialize as Price Crashes 40% From Day’s High. https://www.coindesk.com/xrp-pump-fails-to-
materialize-as-price-crashes-40-from-days-high
[35] Omkar Godbole. 2021. XRP Posted Biggest Single-Day Gain in 3 Years in a Coordinated Buying Attack. https://www.coindesk.com/xrp-ripple-price-3-
year-high-telegram-groups
[36] Google. 2018. Cloud Natural Language. https://cloud.google.com/natural-language/
[37] Google. 2021. Google trend. https://trends.google.com/trends/explore?date=2021-01-20%202021-02-04&geo=US&q=xrp
[38] B.A. Green. 2020. Gamestop Closing 1,000 More Stores By April. https://www.thathashtagshow.com/2020/12/09/gamestop-closing-1000-more-stores-
by-april
[39] Andy Gregory. 2021. Dogecoin, Elon Musk and the ‘joke’ cryptocurrency showing the power of memes. https://www.indy100.com/tech/dogecoin-elon-
musk-cryptocurrency-meme-b1797746
[40] JT Hamrick, Farhang Rouhi, Arghya Mukherjee, Amir Feder, Neil Gandal, Tyler Moore, and Marie Vasek. 2018. The economics of cryptocurrency
pump and dump schemes. (2018).
[41] Layla Harding. 2018. Yobit Pump and Dump Scheme: Everything you need to know. https://coinnounce.com/yobit-pump-and-dump-scheme-
everything-you-need-to-know/
[42] Mustafa Ilhan. 2021. A project that keeps history of trending topics on Twitter. https://tt-history.appspot.com/
[43] Discord Inc. 2018. Discord. https://discordapp.com/
[44] Guolin Jiang, Paul G Mahoney, and Jianping Mei. 2005. Market manipulation: A comprehensive study of stock pools. Journal of Financial Economics
77, 1 (2005), 147–170.
[45] Demitri Kalogeropoulos. 2020. Why GameStop Stock Dropped 52% in 2019. https://www.fool.com/investing/2020/01/07/why-gamestop-stock-
dropped-52-in-2019.aspx
[46] Josh Kamps and Bennett Kleinberg. 2018. To the moon: defining and detecting cryptocurrency pump-and-dumps. Crime Science 7, 1 (2018), 18.
[47] Arjun Kharpal. 2021. Reddit frenzy pumps up Dogecoin, a cryptocurrency started as a joke. https://www.cnbc.com/2021/01/29/dogecoin-cryptocurrency-
rises-over-400percent-after-reddit-group-talks-it-up.html
[48] Asim Ijaz Khwaja and Atif Mian. 2005. Unchecked intermediaries: Price manipulation in an emerging stock market. Journal of Financial Economics
78, 1 (2005), 203–241.
[49] Peter M Krafft, Nicolás Della Penna, and Alex Sandy Pentland. 2018. An experimental study of cryptocurrency market dynamics. In Proceedings of
the 2018 CHI Conference on Human Factors in Computing Systems. ACM, 605.
[50] David B Kramer. 2005. The Way It Is and the Way It Should Be: Liability Under § 10 (b) of the Exchange Act and Rule 10b-5 Thereunder for Making
False and Misleading Statements as Part of a Scheme to" Pump and Dump" a Stock. University of Miami Business Law Review 13, 2 (2005), 243.
[51] Albert S Kyle and S Viswanathan. 2008. How to define illegal price manipulation. American Economic Review 98, 2 (2008), 274–79.
[52] M. La Morgia, A. Mei, S. Raponi, and J. Stefa. 2018. Time-Zone Geolocation of Crowds in the Dark Web. In 2018 IEEE 38th International Conference
on Distributed Computing Systems (ICDCS). 445–455. https://doi.org/10.1109/ICDCS.2018.00051
[53] Massimo La Morgia, Alessandro Mei, Francesco Sassi, and Julinda Stefa. 2020. Pump and Dumps in the Bitcoin Era: Real Time Detection of
Cryptocurrency Market Manipulations. In 2020 29th International Conference on Computer Communications and Networks (ICCCN). IEEE, 1–9.
[54] Tao Li, Donghwa Shin, and Baolian Wang. 2018. Cryptocurrency pump-and-dump schemes. Available at SSRN (2018).
[55] Yun Li. 2020. Melvin Capital, hedge fund targeted by Reddit board, closes out of GameStop short position. https://www.cnbc.com/2021/01/27/hedge-
fund-targeted-by-reddit-board-melvin-capital-closed-out-of-gamestop-short-position-tuesday.html Accessed on 2021-01-28.
[56] Bailey Lipschultz. 2021. WallStreetBets Briefly Goes Dark After Fueling GameStop’s Surge. https://www.bloomberg.com/news/articles/2021-01-
26/gamestop-extends-gains-premarket-as-eye-popping-surge-continues Accessed on 2021-01-28.
[57] Telegram LLC. 2018. Telegram - a new era of messaging. https://telegram.org/
[58] Elizabeth Lopatt. 2021. SEC says third-largest cryptocurrency was sold all wrong. https://www.theverge.com/2020/12/22/22196064/ripple-sec-
cryptocurrency-security-currency-xrp
[59] Jianping Mei, Guojun Wu, and Chunsheng Zhou. 2004. Behavior based manipulation: theory and prosecution evidence. Available at SSRN 457880
(2004).
[60] Shalini Nagarajan. 2021. Dogecoin, a digital token that started as a joke, spikes 140% after traders in a crypto-themed Reddit forum trigger Wall Street
Bets copycat rally. https://markets.businessinsider.com/currencies/news/dogecoin-price-crypto-reddit-traders-satoshistreetbets-trigger-copycat-
wsb-rally-2021-1-1030015774
[61] Lawrence Lewitinn Nikhilesh De, Zack Seward. 2021. Coinbase to Suspend XRP Trading Following SEC Suit Against Ripple. https://www.coindesk.
com/coinbase-suspends-xrp-trading
[62] Leonardo Nizzoli, Serena Tardelli, Marco Avvenuti, Stefano Cresci, Maurizio Tesconi, and Emilio Ferrara. 2020. Charting the landscape of online
cryptocurrency manipulation. IEEE Access 8 (2020), 113230–113245.
[63] Caitlin Ostroff. 2021. What Is Dogecoin, How to Say It, and Why It’s No Longer a Joke (Thanks, Elon! https://www.wsj.com/articles/what-is-dogecoin-
how-to-say-it-and-why-its-no-longer-a-joke-thanks-elon-11612820776
[64] Jedidajah Otte. 2021. ’Sending a message’: GameStop investors on why they bought shares. https://www.theguardian.com/business/2021/jan/28/sending-
a-message-gamestop-investors-on-why-they-bought-shares
[65] Sebastian Pellejero and Marco Quiroz-Gutierrez. 2020. BlackBerry, AMC and Other Reddit YOLO Favorites That Aren’t GameStop. https://www.wsj.
com/articles/blackberry-amc-and-other-reddit-yolo-favorites-that-arent-gamestop-11611681716 Accessed on 2021-01-28.
[66] pushshift.io. 2021. Learn about Big Data ans Social Media Ingest and Analysis. https://redditsearch.io/
[67] reddit Inc. 2021. reddit: the front page of the internet. https://www.reddit.com/
[68] S Rasoul Safavian and David Landgrebe. 1991. A survey of decision tree classifier methodology. IEEE transactions on systems, man, and cybernetics
21, 3 (1991), 660–674.
[69] Niamh Shackleton. 2021. Reddit Mob Claims Victory As $13 Billion Hedge Fund Against GameStop Accepts Huge Losses. https://www.unilad.co.uk/
gaming/reddit-mob-claims-victory-as-13-billion-hedge-fund-against-gamestop-accepts-huge-losses/
[70] Michael Siering. 2013. All Pump, No Dump? The Impact Of Internet Deception On Stock Markets.. In ECIS. 115.
[71] Vasilios A Siris and Fotini Papagalou. 2004. Application of anomaly detection algorithms for detecting SYN flooding attacks. In IEEE Global
Telecommunications Conference, 2004. GLOBECOM’04., Vol. 4. IEEE, 2050–2054.
[72] SystemsLab-Sapienza. 2021. Pump and dump dataset. https://github.com/SystemsLab-Sapienza/pump-and-dump-dataset
[73] Cynthia Turcotte. 2018. Yobit Crypto Exchange Announces Public Pump and Dump Scheme. https://www.livebitcoinnews.com/yobit-crypto-exchange-
announces-public-pump-and-dump-scheme/
[74] Friedhelm Victor and Tanja Hagemann. 2019. Cryptocurrency Pump and Dump Schemes: Quantification and Detection. In 2019 International
Conference on Data Mining Workshops (ICDMW). IEEE, 244–251.
[75] Turner Wright. 2021. DOGE is ’not a bad look’ for crypto users, says Mark Cuban as price surges another 8%. https://cointelegraph.com/news/doge-is-
not-a-bad-look-for-crypto-users-says-mark-cuban-as-price-surges-another-8?_ga=2.121218379.2105071973.1613064889-172655719.1610466710
[76] Jiahua Xu and Benjamin Livshits. 2019. The anatomy of a cryptocurrency pump-and-dump scheme. In 28th {USENIX } Security Symposium
( {USENIX } Security 19). 1609–1625.

The Doge of Wall Street: Analysis and Detection of Pump and Dump Cryptocurrency Manipulations

Uploaded by

Copyright:

Available Formats

The Doge of Wall Street: Analysis and Detection of Pump and Dump Cryptocurrency Manipulations

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

The Doge of Wall Street: Analysis and Detection of Pump and Dump Cryptocurrency Manipulations

Uploaded by

Copyright:

Available Formats

The Doge of Wall Street: Analysis and Detection of Pump and Dump

2 PUMP AND DUMP GROUPS

2.1 Group organization

2.2 Group communication

2.3 Organization of the pump and dump operations

3 PUMP AND DUMP STAKEHOLDERS

3.1 Pump and dump groups

Table 1. Effect of arbitrage.

Trading pair Exchange Volume ($) Open ($) Max($)

3.3 The target cryptocurrency

3.4 Outside investors

3.5 Signal groups

3.6 The shilling and the snowball effect

4.1 The groups, the exchanges, and the target cryptocurrencies

Binance Yobit Bittrex Cryptopia

Fig. 5. Pump and dumps during the hours of the day.

Table 2. YoBit pump and dumps.

Currency Date Volume($) Open price($) Max price($) Price increase

4.3 The Big Pump Signal group

Fig. 6. Big Pump Signal pump and dumps.

5 PUMP AND DUMP DETECTION

5.2 The data

5.3 Features and classifiers

5.4 The importance of rush orders

5.5 The results

Table 4. Features importance.

Fig. 10. DLT candlestick chart.

5.6 Comparison with other pump and dump detectors

6.1 A description of the crowd pump phenomenon

6.2 Analysis of crowd pumps

DogeCoin price (BTC)

XRP price (BTC)

Elon Musk tweet

6.3 Crowd pump detection

4 Data retrieved on April 12, 2019

Group code Group name Telegram link

You might also like