Bitcoin Whales and Crypto Market Manipulation
$370 million worth of bitcoin and tether were sent to BitMEX, Huobi and OKEx on the same day that bitcoin’s price spiraled down to $3,800.
The distribution of crypto assets is often uneven, resulting in some entities holding large proportions of a crypto asset’s total supply. For instance, each one of approximately 9,000 addresses currently hold bitcoin (XBT) that is worth at least $1 million.[1] Such entities are called ‘whales’ because they have the potential to cause sudden and massive price moves. Blockchain transactions from such whales are worth monitoring especially if the funds are sent to an exchange as this can be an indicator of imminent large price movements.
We use data from Whale Alert to retrieve such large transactions on several of the main crypto asset blockchains.[2] Whale Alert uses the dollar value of a crypto asset transaction to decide whether it is a whale transaction. For instance, any bitcoin transaction worth at least $1 million from or to an identifiable entity is considered a whale transaction by Whale Alert.[3] During February and March 2020, very large trades were executed on BitMEX (on the bitcoin perpetual contract), Huobi (on the bitcoin quarterly futures expiring at the end of March) and OKEx (again on the bitcoin quarterly futures), so we focus on the on-chain transaction flows in and out of these three exchanges.
BitMEX
Looking at BitMEX, there was a massive inflow of bitcoin on Friday 13 March (Figure 1), on the same day that bitcoin’s price hit a downward spiral all the way to $3,800 with many BitMEX users losing funds via liquidations that ‘should not have occurred’.[4]
BitMEX claims that this happened because of two Distributed Denial of Service (DDoS) attacks at 02:16 UTC and at 12:56 UTC that took their REST API down, but several users are disputing these claims. Zooming in on BitMEX on-chain inflows on 13 March, we see that 3,000 ΧΒΤ ($12,947,515) were deposited to BitMEX in a single transaction at 02:00:34 UTC and a further 5,000 XBT ($22,131,398) were deposited at 02:10:37 UTC, mere minutes before the 02:16 UTC DDoS attack on BitMEX.
Moreover, another deposit of 3,000 XBT was made to BitMEX at 04:02:55 UTC, a little late for the 02:16 UTC DDoS attack but not to worry — the second DDoS attack on BitMEX came several hours later at 12:56 UTC, perhaps our whale needed a bit of sleep first. Note that funds are perhaps also being transferred to BitMEX via the Lightning Network which much harder to keep track of (see our article on this for more detail).
Such DDoS attacks on exchanges often form part of a well-known price manipulation strategy. The attacker places a large sell market order on an exchange and then launches a DDoS attack, preventing other trades from being placed on the exchange. The large sell order is filled with existing bid volume in the order book, creating downward price pressure on the exchange. As no new bids arrive the price continues to drop to fill the large sell order and stop-loss positions begin to trigger, causing a downward price spiral. Finally, the attacker stops the DDoS attack so new orders arrive and buys a large position at a very low price.
Price manipulation strategies can be seen in action by examining the trading and limit order books (see our article for one such case study). It is also worth noting that while the maximum leverage permitted on BitMEX’s bitcoin perpetual is 100x, there are reports that it is possible to synthetically create up to 700x leverage.[5]
Huobi
Later in the day (13 March 2020) Huobi also saw massive crypto asset inflows and outflows (Figure 2), but in this case it is mostly tether (USDT) that flowed into Huobi.
However, Huobi derivatives trades can only be funded with the corresponding crypto asset (e.g. a position on the XBT futures can only be funded with XBT, regardless of leverage).[6] These USDT inflows may have been directed at the Huobi spot market, but we do not observe significant trading volume or price action on the Huobi spot XBT/USDT pair or on any other of the main tether-based Huobi spot pairs.[7] We therefore examine all USDT whale transactions on 13 March for good measure (Figure 3).
Almost $40 million worth of USDT were transferred from Huobi to Bitfinex at 17:44 UTC on 13 March. And half an hour later almost $50 million worth USDT were transferred from Bitfinex back to Huobi (with an unknown wallet as intermediary). And a little later at 18:46 UTC another $40 million worth of USDT are transferred into Huobi. But we do not observe significant trading volume or price action on the Bitfinex XBT/USDT or USDT/USD pairs during or after that time. Speaking of tether, it is worth noting that its total supply increased by almost 1 billion tokens in the last two months: from 4.58 billion on 1 February 2020 to 5.34 billion on 18 March 2020.[8]
OKEx
Finally, there were large flows into OKEx during the past month and again especially on 13 March (Figure 4).
All the on-chain flows into OKEx on 13 March were XBT transactions totaling almost $210 million and were spread throughout the day (Figure 5).
It is highly probable that transactions of almost identical amounts with the same timestamps (because they are included on the same block) are from the same entity, possibly denoting a larger whale. Note that the XBT-settled OKEx futures contracts allow up to 100x leverage, so these transactions could support positions on the OKEx XBT futures that are up to 100 times larger than the amount transacted on-chain.[9]
Summary
Bitcoin’s downward price spiral on 13 March 2020 started from BitMEX a little after 02:00 UTC and was then propagated to the other exchanges throughout the day, causing interesting bitcoin and tether on-chain flows. The large bitcoin deposits to BitMEX preceding the 02:16 UTC DDoS attack indicate that the attack was part of a very successful price manipulation strategy. These whale transactions quite possibly originated from some kind of bitcoin tumbler to obfuscate the actual origin of the funds, but they provide the trail we need to follow. Happy hunting![10]
Michael Dakos
@CryptoMarketRisk, QFIN, University of Sussex
[1] See Bitinfocharts.
[2] See Whale Alerts website, a recent article by SFOX for more details on Whale Alert and a Bloomberg article on bitcoin whale activity.
[3] See Whale Alerts detailed explanation on defining whale trades.
[4] See Cointelegraph article.
[5] See BitMEX’s contract specifications and article on 700x synthetic leverage.
[6] See Huobi Derivatives Markets terms & conditions.
[7] See e.g. Cryptocompare data on the XBT/USDT Huobi pair.
[8] See tether’s balance sheet on the corresponding dates. See also here and here for our earlier articles on tether.
[9] See OKEx’s contract specifications.
[10] See here and here for the details of the two whale transactions right before the BitMEX DDoS attack, and here for another whale deposit to BitMEX a couple of hours later.
