Lesson 7 — Wash trading and insider-wallet patterns
Suspicious on-chain footprints show up in the data before they show up in the price. Today: the patterns that distinguish organic activity from manufactured.
Two of the most-common manipulation patterns in crypto leave visible traces on-chain. Wash trading (inflating volume to attract attention) and insider-wallet patterns (early addresses accumulating before announcements) are both detectable with the same block-explorer skills you've built through this course. This lesson is about training your eye to spot them.
**What wash trading looks like on-chain.** Wash trades are buy/sell pairs where the same beneficial owner is on both sides. The on-chain footprint typically includes: (1) round-trip transactions between two addresses with identical or near-identical sizes, (2) tight time clustering (sub-second to sub-minute round trips), (3) repeated patterns at fixed intervals or amounts, (4) addresses that interact only with each other or with a small cluster, (5) lack of correlated activity with the broader market. Sophisticated wash trades are harder to detect — multiple addresses, randomized sizes, timing variation — but the underlying behavioural pattern (no real risk transfer, no organic counterparty) leaves footprints.
**Where wash trading happens most.** Three contexts in order of prevalence. (1) **NFT marketplaces** — particularly during early collection launches, where artificially high 'floor sales' and 'volume' attract real buyers. Documented analyses of OpenSea, Blur, and other marketplaces have estimated 20–60 percent of certain collections' volume as wash-traded. (2) **Token DEX trading** — especially for tokens trying to qualify for CoinGecko / CoinMarketCap listings, where volume thresholds matter. (3) **Cross-CEX 'volume' metrics** — wash trading on small centralized exchanges to inflate ranking-list positions. The first two are on-chain detectable; the third requires CEX cooperation or off-chain data.
**The two-address pattern.** The simplest wash trade involves two addresses: A buys from B, then B buys back from A. Both addresses are controlled by the same operator. On-chain inspection: look at the address pair's transaction history. Do they trade only with each other, or with a small cluster? Are the sizes round numbers or near-identical? Are the timestamps clustered? Are there many round trips? A two-address pair making 50 round trips of similar size in a few hours is the textbook wash-trade pattern.
**The cluster pattern.** More sophisticated operators use clusters of 5–20 addresses that trade among themselves. The clusters often share a common funding source (one address sent ETH or stablecoins to each member of the cluster at launch) — tracing back through the funding tree is how analysts identify clusters. Tools like Arkham Intelligence, Nansen, and BreadcrumbsApp specialize in cluster identification; on Dune, public queries by analysts like hildobby have made cluster data available to anyone.
**Insider-wallet patterns before token launches.** A common pattern: addresses that are recently-funded (received their first ETH days or weeks before a token launch) immediately participate in the launch — buying meaningful sizes at the lowest prices. These wallets often have no other DeFi history. Tracing their funding source frequently leads back to the project team's wallets or to a small set of addresses that interact only with each other. The on-chain pattern is: address created → small ETH transfer in (from a team-linked source) → participates in launch → holds or sells at peak. Insider accumulation isn't always illegal (many token launches don't have insider-trading laws applied to them), but it materially changes the risk profile for retail buyers who buy later.
**Insider patterns after announcements.** When a project announces a major partnership, integration, or unlock event, look at addresses that received tokens immediately *before* the announcement. Funding traces sometimes reveal connections to team wallets or to addresses on related projects. The pattern is harder to prove definitively for any single wallet, but in aggregate it's visible: large pre-announcement accumulation by addresses without organic prior history is a statistical fingerprint of insider activity.
**Tools and resources.** Arkham Intelligence (free tier covers most retail use cases) is the leading platform for address-clustering analysis. Nansen's 'Smart Money' labels mark addresses that have shown profitable trading patterns historically, which is useful but should be read skeptically — past profitability doesn't mean future, and 'Smart Money' addresses are often themselves coordinated rather than independently profitable. For NFT-specific analysis, **CryptoSlam** and **NFT Wash Trading by hildobby on Dune** provide ongoing wash-trade estimates. For token-level analysis, **GoPlus**, **TokenSniffer**, and **DexCheck** offer automated red-flag scanners that include holder-concentration and insider-pattern checks.
**The honesty boundary.** Detecting wash trading and insider patterns gives you signal, not certainty. A wallet pattern that looks like wash trading might be a market-maker arbitraging the same token across two of their own desks — economically the same effect, but not 'wash trading' in any malicious sense. A wallet that accumulated heavily before an announcement might just be a smart trader who saw the catalyst. The right use of these tools is risk-weighting your exposure: if a token's on-chain footprint shows heavy wash-trade and insider patterns, your position size should reflect the risk that the displayed metrics aren't real.
Example
Walk through a real Dune query analysing wash trading on a specific token. The query identifies pairs of addresses that have round-tripped at least 10 times within 24-hour windows, with average size variance under 5 percent. The output: 23 address pairs accounting for 67 percent of the token's reported 24-hour DEX volume. The token's project page advertises '$50M daily volume.' The wash-trade-excluded reality is closer to $16M. Now look at the project's holder concentration: top 10 wallets hold 78 percent of supply, and 4 of those 10 are linked to the project team's funding source. Now look at price history: the token launched at $0.05, ran to $0.85 with the manipulated volume narrative, then collapsed to $0.07 over the following month as insiders distributed into the inflated volume. The whole arc was visible in the on-chain data from the first week.
Common mistakes
- Treating high volume as a positive signal without checking its composition. Inflated volume is one of the most-common manipulation tools.
- Trusting 'top holder' lists without cluster analysis. Apparently-distributed holdings often consolidate into a few effective owners once clusters are mapped.
- Ignoring wallet age. A wallet that received its first ETH a week before a token launch and immediately bought heavily is structurally suspicious.
- Believing automated 'Smart Money' labels uncritically. The labels are useful starting points, not conclusions.
- Forgetting that detection gives signal, not certainty. The right response to suspicious patterns is risk-weighted sizing, not categorical avoidance — though some patterns warrant categorical avoidance.
Check your understanding
You're researching a new token that advertises $50M daily DEX volume. Your on-chain analysis finds 23 address pairs round-tripping at least 10 times per day with near-identical sizes, accounting for 67 percent of the reported volume. The top 10 holders include 4 wallets funded from a single project-team source and hold 78 percent of supply. What is the most defensible conclusion?
Key terms covered
Sources & further reading
- Primary
- Primary
- Primary
- Primary
We prioritise primary sources. Where a topic moves quickly (regulation, security incidents), we re-check sources on the cadence shown by the page's "Next review" date.