I show how price manipulation to liquidate traders is done in cryptocurrency markets. I point fingers at people.
Thanks to Coinstrats for allowing me to use their order book data for the analysis. Also see Carol Alexander’s blog about similar events on 25 – 27 July.

It’s commonly said that “cryptocurrency markets are manipulated”. Today, you’ll see one example of how that particular sausage is made.

The SEC cites price manipulation as a primary concern when rejecting bitcoin ETF applications. Some crypto hedge funds retort that “markets can’t be manipulated because they’re too big”, which we’ll show is nonsense.

While cryptocurrencies have grown in popularity and market capitalization, the volatility of the price has not diminished. One recurrent feature of crypto price is the BART pattern, where periods of low volatility are punctuated by spikes of extreme volatility. The name comes from the resemblance to Bart Simpson’s head[footnote]And the fact that it apparently eats shorts[/footnote]:

Volatility spikes like the ones in BART patterns are caused by cascading liquidation events. Speculators making leveraged bets get forcefully wiped out.

Today, we’ll dive into one such market manipulation event with loving detail, the July 26th Bitcoin short squeeze. The data I’ve used to research this is the full Binance orderbook (data courtesy of CoinStrats) at the millisecond level. Here’s what the price data for the event looks like:

All charts have hi-res versions if you click on their links

Note the extreme spike in BTC Futures price compared to other markets. Among Bitcoin mass liquidation events in 2021, this isn’t the largest:

The largest liquidation events are forced selling (red bars on the bottom chart, AKA long squeeze). This is because many more crypto speculators are taking leveraged long bets (borrowing to buy more BTC) than short positions (betting that the BTC price goes down). People who speculate on Bitcoin are as a group an optimistic bunch.

The reason we’re looking at July 26th rather than April 18th, May 19th, or December 4th is that it’s a better example to write an article about.

The July 26th event has both a clear order book manipulation as well as a classic media manipulation campaign, showing how actors that profit from these events operate.

The Bullshit Amazon Bitcoin story

The BART pattern in this short squeeze is punctuated by two major pieces of news.

Leading into the upward price spike was a false story about Amazon accepting cryptocurrency payments.

The downward part was instantly triggered by Amazon’s official denial of the false story.

In between the up and down part, there’s a side-story about Tether receiving target letters from the DOJ, which had a very short lived price effect.

Timeline of Events

Here is the timeline of relevant events:

Before we get into the actual data analysis, let’s take a stroll through the dismal state of online media and how it plays with cryptocurrency.

July 23rd: Amazon job posting

On July 23rd at 4PM, Business Insider published an article about an Amazon job posting looking for a “Digital Currency and Blockchain Product Lead” in their Seattle office.

This article is better than the abysmal displays of journalism we’ll see later. But still takes considerable liberties to maximize its clickthrough rate.

Reading the job post, you’ll see it is looking for a manager to “develop strategy and product roadmap”. Translation from business-speak: nothing is built and we don’t have an idea of what, if anything, to build, so we’re hiring someone to look into it. This is what the amazon spokesperson says in the BI article:

“In an email to Insider, an Amazon spokesperson confirmed the job posting and the company’s ambition to eventually accept cryptocurrency from its customers.”

Over the next few hours Business Insider AB tests the headline away from reality and into fiction. We can trace this thanks to the web archive:

A handful of publications report on this over the 24hr, with no measurable reaction in the cryptocurrency markets.

July 25th 9AM: The CityAM article

The next important event is Darren Parkin’s CityAM article titled “Amazon ‘definitely’ lining up Bitcoin payments and token, confirms insider”, alleging that Amazon will imminently accept Bitcoin payments. All important information in the article comes from an unnamed “insider”.

36 hours later, Amazon will deny the article wholesale.

By September Amazon will have removed the job ad. I searched private job ad databases, and that job was never actively advertised or promoted before being taken down. [footnote]This sequence implies one of two things: either the job was already filled internally and the job ad was put up to comply with HR procedures, or Amazon took the position down. Given the position was for a new team’s manager, and no subsequent development positions were advertised, it’s safe to say Amazon has scrapped the entire cryptocurrency project.[/footnote]

Note: I have made requests for comments to both Darren Parkin and the CityAM editorial team. None have been answered.

CityAM has never published a retraction or correction on their article. Rather, they doubled down on their claims, insulting “anonymous critics”.

We’re not here to take a third rate rag and their inept journalistic practices to the pillory. We’re here for the market manipulation. CityAM is but an unknowing cog in a greater machine, happily amplifying the lies from a planted fake source.

Trading up the chain

Everyone who consumes articles online should read Trust Me, I’m Lying by Ryan Holiday. The book describes how economic incentives in the online media industry has brought about a second era of yellow journalism[footnote]Recently, subscription based revenue models like Substack, Patreon or the NYT/FT/WSJ subscriptions have started making inroads. Subscription revenue is incentivized towards quality, unlike advertising revenue, which incentivizes clickthrough rate and hence sensationalism[/footnote].

More importantly, Holiday details a common strategy to exploit the broken state of click-driven media, called “Trading up the chain”. This scheme starts by planting a lie or half truth at a low quality source (blog, twitter, low-tier news site, etc.). You then “trade it up the chain” by having successively more reputable sites report on the report.

Often, by the time you see something bending the truth on your twitter feed or the front page of Reddit, it has gone through 3-4 iterations of this. Each iteration further optimizes for attention by shedding context, exaggerating, foregoing important details, rewording claims, or just outright lying. See Business Insider’s headline optimization in our example, for instance.

Media bubbles where fact checking is light, like cryptocurrency reporting, are subject to this. This is also true of politically charged topics, a good example is detailed in this article on “Hydroxychloroquine as a COVID treatment” and how it was traded up the chain from a Google Doc to Elon Musk and Donald Trump.

Preparing the field

Planted false stories being traded up the chain, like the CityAM piece, are part of a pattern. These stories prepare the field for market shenanigans triggering mass liquidation events.

Another example of this are the fake “tether/deltec leak” stories from February 2021, which are detailed in this skippable blue box on the deltec leaks:

Similarly to the July 26th event, Feb 22nd liquidation event was punctuated by fabricated news. This time it was bad false news for Bitcoin, because the point was to make the price go down to liquidate long positions.

Around a week before the event, false leaks were being spread to journalists, presumably to start some trading up the chain. Around 90min before the large liquidation event, a twitter account called @deltecleaks posted text that looks like hacked data from tether’s bankers, Deltec Bank. The false leaks continued for around a week after the liquidation event, after which they stopped.

Now, before we dive into the financial aspect of the price manipulation story, we need to cover some background knowledge.

The Cryptocurrency financial ecosystem

While people think the main innovation of cryptocurrencies are public blockchain ledger transactions, the vast majority of crypto trading happens on private centralized exchanges. Crypto exchanges like Binance, Coinbase or FTX are interesting because they fill multiple functions that are typically segregated in financial markets:

• A Custodian for crypto assets. Getting hacked is a big problem in cryptocurrencies. Blockchain transactions are irreversible, unless your name is Vitalik Buterin. This makes crypto a great asset to steal or use for ransom payment. Exchanges solve custody problems because they’re less likely to get hacked than you are.

• A cryptocurrency Brokerage. An individual can use the exchange as a broker to place buy and sell orders, which the exchange will go execute for them.

• A trading Clearinghouse. The exchange will match brokerage orders together and act as the final intermediary between a buyer and seller.

It’s important to realize that leverage works differently in crypto markets than regular commodity or stock markets. In a market like the NASDAQ or CME, the brokers are separate entities from the clearing firms. In a crypto exchange, the exchange does both functions at once.

In normal markets, if you get unlucky with a leveraged position, you get margin called. Your broker gives you some time to give them more collateral or they’ll liquidate positions. The broker itself also keeps a margin with the clearinghouse, as a secondary buffer to ensure proper delivery of all orders.

This is normally invisible, except in freak occurrences. One example is Robinhood in a meme stock frenzy, getting margin called by their clearinghouse because of the unprecedented increase in market volatility.

The fundamental problem of crypto leverage

Offshore crypto exchanges like Binance offer absurd leverage in the 20-125x range. But the exchange is both a broker offering leveraged products and the clearinghouse of the leveraged trades. This can easily create “failure to deliver” situations from the clearinghouse side. Take this example:

• We are the only two customers on the exchange. I buy half a BTC and leverage it 10x. You short sell one BTC and leverage it 3x.

• The market price instantly moves down 33%[footnote]as it tends to do[/footnote], which means you make 1 BTC in profit, and I lose the equivalent of 1.5 BTC

• I get liquidated from my leveraged position. You should earn a full BTC, but I only have half a BTC to give you!

The exchange has a problem. You’re owed more than I can pay you.

The exchange could resolve to pay you the difference from its insurance fund, and lose money. Carol Alexander suggests that in large liquidation events, like on May 19th, it’s possible the exchange misreports numbers to avoid losing money to their insurance fund.

The other option is for the exchange to auto-deleverage you, saying “actually you only get half a BTC”. In this case you lose money.

Interconnected poker tables

The best way to think of crypto markets is that each one is like a poker table. When a trader wins, it comes from someone else’s loss at the same table. The prices on all the tables are kept in line by arbitrage bots who simultaneously buy and sell on each market to keep prices in line.

Delivery is an issue in leveraged liquidations if you are on the winning side. You want to make trades in the place where most assets are. The market implicitly coordinates to a focal point, where having a deeper pool of liquidity means leveraged delivery issues are reduced.

This focal point used to be the Bitmex XBTCUSD perpetual futures, now it’s the Binance BTCUSDT perpetual futures.

The great “innovation” of perpetual futures is that it doesn’t require delivering much of anything. Unlike a normal futures contract, where one party has to deliver the commodity when the contract expires, perpetual futures “delivery” is only the difference between the spot price and futures price every 8 hours.

This “delivery-less” format allows gamblers to take on massive leverage, because little of anything has to be delivered.

Currently, the Binance BTCUSDT futures is where most cryptocurrency price movement originates from:

We can see this directly in the data. Here is a 10min slice of Binance’s orderbook chart of Binance BTC “spot” (buy orders yellow, sell orders green) and BTC perpetual futures (teal and purple).:

I encourage you to open this chart in high resolution in a separate tab and closely look at it.

You can see the bid-ask spread for both order books move around as the price goes up and down. This bid-ask spread in each market is provided by similar bots as the ones exploiting price spreads between the markets.

First, note how unstable the futures book is compared to the spot. The spot trades within a flat range, then jumps up or down to correct and realign itself with the futures price.

This is common behavior - the futures market trade with so much more leverage, and hence volatility. Futures price movement “leads” the spot price movement much of the time.

Also note that the futures price is slightly below the spot price. This is normal backwardation, and common in futures contracts prices.

Automated Markets

The crypto market also reacts instantly to relevant news. Amazon released their denial of the CryptoAM story at 15:59EST (19:59UTC). If you had a bloomberg terminal you’d have seen this:

Amazon makes these releases at the end of NASDAQ trading hours. This is normal if you have to announce news important to your stock price. It’s polite to give your shareholders time to think overnight before responding to important news.

On the other hand, crypto markets trade around the clock. High frequency trading bots reacted to the Amazon news in <50ms. Here are the order books around the event[footnote]The futures trade at a almost no backwardation here, so they overlap with the spot order book coming[/footnote]:

The price instantly drops in all markets. Market makers also show themselves to be fair weather friends - the order book vanishes instantly on the news of Amazon’s denial.

Not only that, the market is good at differentiating false news from real ones [footnote]or Bloomberg terminal curators are at least[/footnote]. The market didn’t react to the fake CityAM article. It instantly corrected on the Amazon denial. We also see instant reaction to the tether DOJ news

July 26th 00AM: Sharp price rise

Around Midnight UTC on the 26th, there’s an intense rise in price, leading to the liquidation event at 1AM UTC. Here’s the 15min period before the liquidation event:

We can’t track the origin of the increase in prices leading up to the liquidation spike - none of the products on Binance seem to “lead” each other in the data. This leaves two possibilities:

1. The price rise is organic. Maybe people woke up in China very excited about Bitcoin and Amazon!

2. The price rise comes from price manipulation, but elsewhere. The classic way to manipulate a price is wash trading(1, 2), where you both buy and sell to yourself at increasing (or decreasing) prices.

Wash trading works best when the market is thin. If your above-fair-price wash trades run into real orders from other traders, you’ll lose money! You want to maximize the likelihood that you actually sell to yourself.

An aside on NFTs Because they’re “unique” objects, NFTs are a perfect vehicle for wash trading. You can easily ensure you only wash trade to yourself. The common scheme is to wash trade with yourself until some credible dunce buys the NFT from you at your manufactured “fair” value, leaving you to walk away with real money.

If someone wanted to manipulate the price of bitcoin to approach a liquidation point, the origin point would not be a large and liquid order book like Binance BTC or ETH. The wash trading would happen at an illiquid and thin market, and the price movement would then propagate to Binance through arbitrage bots.

July 26th 1AM: Liquidation Event

At 1AM UTC, the liquidation spike starts. Here are the BTC orderbooks for the 4min period around the mass liquidation[footnote]y-axis truncated to $43,000. The spikes went to $48,000 in some places, but makes it harder to read[/footnote]:

The event starts with a suspicious series of orders in the futures market, which we’ll get into later. Then, a big price spike, with futures order book collapsing into chaos. The bid-ask spreads for both markets blow up.

We can’t know which orders in this chart are liquidation orders and which are “real” ones - Binance doesn’t provide this data anymore since the April 18th liquidation event.

We can still track what happened, however.

Momentum Ignition

The manipulative trade pattern to start volatile price movement is called momentum ignition. The ESMA notes that this is marked by high volumes of cancelled orders. Here is the relevant period’s chart[footnote]This chart also plots actual trades made as black X’s on the order books. They were distracting in the other order book plots, but since we talk about order cancellation here it might matter to people digging in[/footnote]:

The way momentum ignition works is by placing a large attractive order, and quickly cancelling it when an opposite order is placed in response[footnote]Some say that momentum ignition is done through wash trading. This is not what we see in our case.[/footnote]. This leaves the opposing order alone in the market, pushing up the price.

Here is an example from a 20 seconds before the liquidation event, where a large attractive sell order is placed, then quickly cancelled when a buy order is placed by a trading bot in response later:

What we see at the event start is such a spoofed order getting placed at 0:59:38 UTC. The price is flat for 2s, but eventually the spot price drifts up. This creates an arbitrage opportunity. Bots place buy orders to arbitrage the sell order [footnote]Presumably while while selling in another market. Apparently not binance spot as far as we see[/footnote].

The sell order is then quickly cancelled, partially filled. The opposing buy order is left buying into a smaller market than expected. This jumps the price up a little, hence the name “momentum ignition”. Interestingly this is quickly repeated in a “ladder” pattern.

This pattern is repeated at the critical moment before everything explodes:

We see one small cancelled sell order (almost unfilled), followed by a very large sell order cancelled (partially filled), then implosion of the markets.

Market making bots stopping

The second part contributing to the implosion of the futures market is the shutoff of market maker bots around 2.5s after the largest cancelled “momentum ignition” order. Here is the same plot as before in a “flattened” view:

We see the futures bid/ask spread holds for around 2s after the cancelled order. Then, instantly, the bots supplying the ask side are shut off. A gap develops between the bids and asks in the futures market. The spot market remains orderly.

In a few more seconds, around 1:00:40, the futures order book collapse into chaos. This starts dragging the spot market with it - notice the widening of spot bid-ask spreads. In a few more seconds, the futures prices are spiking all around the place between $40,000 and $48,000.

An aside on tether This shows why in the event where USDT breaks its dollar peg, a near-instantaneous market crash would happen. Because USDT denominates the volatile futures price but not the spot price, an arbitrage gap opens up. However, those bots are wired to assume the dollar parity, and thus are broken in this case. They will be quickly turned offline.The bots turning offline cause a low-liquidity environment in which the USD/USDT price parity correction happens.

How market manipulation is done

So the “market manipulation” in this event is done in two steps:

1. Spoofed orders that are quickly cancelled when opposing orders try to arbitrage them. This causes some “momentum ignition”. These seem to be done in a ladder-like sequence.

2. Turning off market-making bots at a critical juncture to ensure the thinnest possible liquidity environment for forced liquidations to happen in.

In this case, short sellers are liquidated and forced to close positions (placing buy orders). In the thin and chaotic futures order book that was created, this maximally increases the trading price, thus cascading liquidations.

We’re unable to trace the sharp price increase preceding the momentum ignition event. So even though it may be caused by something nefarious, we can’t confirm it.

Whodunnit?

A note on attribution: Any allegations made below are mine and mine alone. I don’t even think the party responsible for this event have done anything illegal. Cryptocurrency markets are a lawless wasteland! They are the winners, and the retail traders getting liquidated are the losers.

Here are my conclusion relating to attribution:

Most likely Alameda Research some algorithmic crypto trading firm, specifically DRW Cumberland or Jump Crypto

A note from the future While Alameda’s USDT transfers right before the event are suspicious, we found out Alameda was run by absolute morons in the FTX bankruptcy. I now doubt they’d have been able to pull this off given their lack of sophistication.

It’s reasonable to assume whoever planted the CityAM piece is related to the ones manipulating the price. However, the CityAM team does not respond to requests for comments, so this is a dead end[footnote]It’s also possible the media manipulation came from a different entity than the one doing momentum ignition. Both may simply have seen the opportunity and acted on it independently. This seems to have happened in the Febuary 2021 liquidation event, where the media manipulators kept going for a week after the liquidation spike[/footnote].

Whoever has done this is a well capitalized, sophisticated algorithmic trading firm. They have been doing this sort of stuff for a long time. The orders leading into the liquidation event are precisely coordinated by algorithms that take a long time to develop and fine-tune.

Both DRW and Alameda fit this description. Both have been unsuccessfully dragged into court for similar behavior (DRW lawsuit, Alameda lawsuit). It’s possible, though less likely, some smaller algorithmic trading shops like jump crypto or wintermute fit this bill.

Look at who profits

There are two ways to profit from such a liquidation event:

1. Take a long position before liquidating the short sellers. This doesn’t help us narrow it down.

2. Profit from the mayhem by having a bot arbitrage spreads in the broken order books.

As found in the excellent tether papers by Protos, both Alameda an DRW Cumberland commonly issue new USDT in high volatility events. You can manually trace these issuances on TRON and ETH. Digging into it, you will notice no new USDT have been issued prior or during the July 26th liquidation event.

This rules the “arbitrage profit” explanation out. Someone had to place large bets before triggering the liquidations.

Circumstantial evidence

If we can’t find new USDT being used to profit from the event, can we see suspicious movement on some blockchains that help us attribute it?

The answer is yes. Here is a list of suspicious transactions. They are large one-way USDT transfers to Binance totalling $290m between July 25th 16:00 UTC and 20:00UTC (1, 2, 3, 4, 5, 6, 7, 8):

Most of these addresses are payment rails to Binance. Algorithmic traders use such blockchain payment rails to move crypto between exchanges.

The simplest way to trace ownership of an address like this is to look at the first transaction. Here, the first inflows are from FTX and Huobi. FTX is owned by Alameda Trading and often used as their asset custodian[footnote]For instance, when Alameda issues new USDT they always send it to FTX first[/footnote]. The best guess then is that these $290m were sent to Binance from Alameda, right before the abrupt price rise and liquidation event.