Fake activity, transparency and wallet tracking

Wonder

1. Why does a token with zero external buyers still appear on trending lists?
2. How can a single actor make a project look like it has ten thousand holders?
3. What economic cost structure makes wash trading profitable in some markets but unviable in others?

Explore

Part IFake activity: wash trading and volume bots

1. Wash trading is the act of buying and selling an asset to oneself to inflate reported volume. It creates a false signal of liquidity and interest, attracting organic traders who mistake the activity for genuine demand. Cong, Li, Tang & Yang (Management Science, 2023) estimated that over 70% of reported volume, on average, on the unregulated centralized exchanges they studied was fake. On centralized platforms, this is often done through matched internal orders; on decentralized chains, it requires actual transaction fees to be paid.
2. On-chain, the equivalent activity takes the form of ‘volume bots.’ These are scripts that churn a token between two or more wallets controlled by the same actor. The goal is to climb trending lists on explorers and aggregators like DexScreener or Birdeye. Since these platforms rank tokens partly by recent trades and volume, a bot can artificially boost a token’s visibility. This draws new buyers who see the high activity and assume the market is healthy.
3. Fake holder counts are another layer of social proof. A project might spray dust amounts of its token to thousands of fresh addresses. These addresses are typically Sybil wallets—many identities controlled by one entity. The result is a holder count that looks distributed and organic, but is actually concentrated. Funding-graph tools can expose this clustering by tracing wallets back to a common source; Bubblemaps, for example, maps the largest holders and the transfers between them.
4. The profitability of fake activity depends entirely on cost structures. If every trade pays a significant network fee or protocol tax, wash trading becomes expensive. An actor burning capital just to appear active is unsustainable unless the resulting price appreciation allows for an exit. Conversely, in low-fee environments with high reward incentives per transaction, the math favors botting. The design of the fee schedule directly determines how much fake activity a market can absorb.
5. Trending algorithms that weight unique wallets are vulnerable to Sybil attacks. If a ranking system gives bonus points for new addresses or diverse holders, an attacker can game this by creating thousands of fresh wallets. This is why sophisticated detection relies on funding-graph analysis rather than simple counts. By mapping where each wallet received its initial funds, analysts can collapse clusters of Sybils back into their controlling entity.
6. To check a token’s activity manually, open a block explorer and inspect the transaction history for a specific pair. Look at the ‘From’ and ‘To’ addresses in recent swaps. If the same few wallets are repeatedly buying from and selling to each other, or if many new wallets received dust amounts from a single source, the volume is likely inflated. This visual inspection reveals the mechanical nature of fake activity that raw numbers hide.

Part IITransparency as a defense

7. Some abuse cannot be prevented by code: insiders concentrating supply, a creator selling a large holding, a promoter selling to followers. There, exposure becomes the main defense. Full on-chain data availability ensures every state change is recorded on the base chain. Anyone can rebuild the system’s history without trusting a third-party indexer. This raw transparency makes abuse traceable to specific addresses and transactions.
8. Hash-chained logs extend this principle to project-specific records. Each entry references the previous hash, making tampering detectable. If a team alters a past log entry, the chain breaks. Public creator wallets and funding-graph visualizations reveal early buyers and insider holdings. Tools like Bubblemaps map these connections, showing whether initial supply is concentrated in few hands or distributed broadly. This lets buyers see concentration before they act.
9. Canonical contract addresses published in verifiable locations reduce phishing. Users can confirm they are interacting with the legitimate token rather than a lookalike. Etherscan and Solscan provide this verification layer, allowing anyone to audit the code and transaction history of any address. This public scrutiny creates a deterrent: developers know their actions are permanent and visible. The threat of reputational damage and legal traceability disciplines behavior in ways that private systems cannot.
10. Bitcoin’s genesis block exemplifies this principle. Its coinbase text, ‘The Times 03/Jan/2009 Chancellor on brink of second bailout for banks,’ is immutable and public. Every node verifies it. Anyone can check it, and no one can change it. In token markets, similar transparency allows participants to verify that rules are followed. If a team promises fair distribution but dumps tokens, the chain records the betrayal permanently.
11. The trade-off is cognitive load. Data shown is not data understood. Most users cannot read Solidity code or interpret complex funding graphs. They rely on simplified interfaces or influencers who may have biases. This creates an information asymmetry where sophisticated actors exploit naive ones. Transparency does not eliminate this gap; it merely makes the exploitation visible after the fact. Users must invest time to learn how to read the chain effectively.
12. Open a block explorer and look up a recent token launch. Check the funding graph for the top ten holders. Note if any single wallet holds more than five percent of supply. Verify the contract address against official documentation. This hands-on check reveals whether early buyers are insiders or organic participants. The data is public, but interpreting it requires practice. Transparency is a tool, not a guarantee.

Part IIITrading terminals and wallet tracking

13. Since 2024, memecoin trading has shifted from standalone wallets to integrated web terminals. These interfaces combine candlestick charts, one-click swap buttons, live feeds of new token launches, and wallet-tracking tools into a single screen. The primary function is speed: in markets where prices move within seconds, navigating between separate charting applications and wallet extensions introduces latency that can mean the difference between a profitable entry and holding an illiquid bag.
14. The trade-off for this integration is custody. Many terminals work by holding the user’s trading key or using an embedded wallet provider to sign transactions on their behalf. This grants the platform immediate execution capability but also control over the assets. If the terminal’s backend is compromised, or if the provider suffers a security breach, the funds held in that session are at risk. The convenience of one-click trading comes with the vulnerability of centralized key management.
15. Wallet-tracking tools allow users to monitor specific addresses in real-time. When a followed wallet executes a swap, the terminal triggers an alert. This creates a transparent market where the activity of successful traders is visible to everyone. However, this transparency cuts both ways: tracked wallets know they are being watched. Sophisticated operators may use this knowledge to sell into their own followers or manipulate volume to attract attention before exiting.
16. Phishing clones pose a persistent threat to terminal users. Attackers create identical interfaces with slightly different domain names or visual elements, luring traders into connecting their wallets to malicious sites. Once connected, the attacker drains assets through signatures the user approves without realizing what they do. The speed that makes these terminals valuable also reduces the time available to verify authenticity before signing a trade.
17. Fees per trade vary by terminal and underlying protocol. Some platforms charge a flat percentage on each swap, while others integrate with automated market makers where fees are built into the liquidity pool. Copy-trading bots may add additional subscription costs or performance-based fees. The cumulative effect of these charges can significantly impact net returns in high-frequency trading strategies.
18. Open a block explorer and select an active memecoin token. Identify the wallet that initiated the first large buy order. Then, scan the subsequent transactions to note how quickly other wallets purchased the same token after that initial move. This manual observation reveals the latency gap between human traders and automated bots, and demonstrates how rapidly information propagates through the market.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• L. W. Cong et al., 'Crypto Wash Trading' (Management Science, 2023)
• Chainalysis, Crypto Crime Report (2025)
• Bubblemaps documentation
• Satoshi Nakamoto, 'Bitcoin: A Peer-to-Peer Electronic Cash System' (2008), §2
• Bubblemaps documentation on funding-graph visualization
• Etherscan and Solscan documentation
• Solana Wallet Adapter documentation