Detecting Wash Trading on DEXs: AMM Heuristics, Graph Forensics, and Risk

• Wash trading on AMMs is round-tripping through a pool to pump volume while keeping net exposure close to flat.
• Points, airdrops, and leaderboard incentives keep this alive even with gas fees and LP fees.
• Scam launches use wash volume to manufacture “market traction,” then pull liquidity once real money shows up.
• LP impact depends on the pool. Extra fees can help, LVR and toxic flow can still wipe the edge out.
• Detection is mostly high-signal heuristics plus graph analysis: short-window buy/sell matching, controller-funded wallet swarms, SCC loops, and flash-loan volume bursts.

Decentralized exchanges (DEXs) offer permissionless access to digital asset liquidity, replacing proprietary matching engines with open-source smart contracts. However, the pseudonymous nature of blockchain infrastructure and the ease of automated execution introduce specific attack vectors for market manipulation.

Chief among these tactics is wash trading. In an order book, wash trading traditionally involves an entity acting as both buyer and seller simultaneously. On an Automated Market Maker (AMM), where the counterparty is the pool itself, the definition shifts: wash trading is the practice of continuously round-tripping an asset through a liquidity pool to artificially inflate trading volumes without taking on actual market risk or changing net exposure.

The future of finance is here. Trade crypto and more

Historically, investigators focused on centralized platforms, where platform operators or colluding market makers can fabricate volume in off-chain databases with zero friction. Decentralized exchanges operate differently. Every transaction must be committed to the public ledger, incurring network execution costs (gas fees) and liquidity provider tolls. Despite this inherent economic friction, on-chain data reveals that wash trading on DEXs is prevalent and executed at a massive scale.

This report deconstructs the mechanics of deceptive liquidity in the digital asset ecosystem. By examining the microstructures of AMMs, the economic incentives driving manipulation, high-signal detection heuristics, and the 2026 regulatory landscape, we establish a technical framework for identifying on-chain wash trading.

The Microstructure of Decentralized Market Manipulation

To understand on-chain manipulation, one must look at the engine powering decentralized exchanges: Automated Market Makers (AMMs). Unlike traditional finance, which relies on limit order books, DEX volume is largely algorithmic.

Constant Product and Concentrated Liquidity

The foundational AMM model uses a Constant Product Market Maker (CPMM) formula, mathematically defined as x * y = k. Here, x and y represent the reserve balances of two distinct tokens locked in a smart contract, and k is the invariant constant. A wash trader executing a swap against this pool alters the reserve ratio, causing the price to slip along the bonding curve. To complete a wash trade cycle, they must approximately reverse the transaction to return net exposure close to flat. The cost includes gas fees and a percentage-based fee paid to the pool’s liquidity providers.

The evolution to concentrated liquidity allowed providers to allocate capital within specific, custom price ranges rather than spreading it infinitely across the curve. This drastically improved capital efficiency but altered the landscape of manipulation. Wash traders exploiting these modern pools deploy custom routing contracts that execute high-frequency buy and sell orders within extremely narrow price bands. This isolates their capital into highly active “ticks,” generating massive artificial volume while minimizing slippage costs, often by also being the LP.

The Economics and Motivations of Deceptive Liquidity

Why would a rational actor pay continuous network fees to wash trade on a transparent ledger? The answer lies in the asymmetric payoffs of the modern crypto market, where the secondary benefits of artificial volume often dwarf the execution costs.

The Token Reward Ecosystem

NFTs serve as the cleanest historical example of volume-mining wash trading, and modern DEX points programs repeat these same incentive structures. When platforms use aggressive token airdrops to bootstrap liquidity, users calculate the expected value of the distributed governance tokens against the cost of gas and marketplace fees. If the airdrop value is higher, they will programmatically round-trip assets between controlled wallets.

Skip the wait. Buy a licensed company.

Dune Analytics data estimates that of the historical NFT trading volume on Ethereum, approximately 45% (or over $30 billion) was artificial. Platforms that aggressively rewarded users based purely on trading volume, such as LooksRare and X2Y2, historically saw up to 98% and 87% of their respective activity flagged as highly suspicious, closed-loop bilateral trades. The financial value of the farmed tokens simply exceeded the friction paid to generate the artificial volume.

Leaderboard Exploitation and Serial Rug Pulls

Liquidity inherently begets liquidity. Token issuers have strong incentives to inflate volumes to boost rankings on third-party aggregator websites. Wash trading propels obscure tokens to the top of these leaderboards, triggering organic retail participation.

Kaiko shows a repeated pattern where token issuers create short-lived Uniswap pools, amplify activity with multiple wallets, then withdraw all liquidity about ~10 days later, after accumulating ETH and fees.

Scale and the Impact on Liquidity Providers

The scale of this activity actively distorts macroeconomic indicators. According to a 2025 Chainalysis report, suspected wash trading on Ethereum, BNB Smart Chain, and Base accounted for an upper bound of $2.57 billion in trading volume. Using high-signal heuristics, analysts identified 23,436 unique addresses responsible for this volume, with the top 10% of those addresses driving 43% of the deceptive trades. However, because these heuristics may overlap, these totals shouldn’t be treated as exact.

Slippage and Loss-Versus-Rebalancing (LVR)

Wash trading degrades execution quality by rapidly cycling assets through a pool, continuously altering the exchange rate, and subjecting organic users to severe slippage.

For passive Liquidity Providers (LPs), the economic impact of wash trading is nuanced when measured using metrics such as Loss Versus Rebalancing (LVR). LVR represents the adverse selection cost an LP suffers when arbitrageurs trade against stale pool prices. Wash traders induce artificial, high-frequency volatility within the pool, which can exacerbate these LVR costs.

Try the leading VASP data free for 1 month. No card required.

However, LPs also collect a trading fee on every wash swap executed. The net effect on LP profitability depends heavily on the pool’s fee tier, the toxicity of the overall flow, and whether the wash trader is hedging their positions elsewhere. If the artificial volume generates fee revenue that outpaces the LVR, the pool might net positive. If not, the wash trading acts as a direct tax on organic liquidity provision.

Heuristic Estimation: On-Chain Detection Methodologies

Because blockchain data is public, analysts use high-signal heuristics to flag potential manipulation. However, these methods are not definitive proofs of intent. MEV bots and complex arbitrageurs can sometimes trigger false positives, as AMMs remove the clean order-book pattern of a single trader sitting on both sides of a centralized trade.

To separate wash trading from legitimate MEV or arbitrage in practice (even if imperfectly), analysts look for repeated near-zero PnL cycles, the same sizing, the same timing cadence, the same controller funding patterns, and trading concentrated in tiny sets of pools. This alignment ensures that heuristics do not capture genuine market efficiency bots.

Foundational Heuristics

Blockchain analytics firms deploy foundational algorithms to filter out noise and flag strong indicators of manipulation:

1. Temporal Volume Matching: This heuristic tracks high-velocity, bidirectional trading pairs executed by the same entity. An address is flagged if it executes a buy and a sell within an extremely narrow temporal window (e.g., 25 blocks) where the dollar-value difference between the trades is less than 1%. This indicates an attempt to return to a risk-neutral position rather than secure a directional profit.
2. Disperse-Based Multi-Sender Networks: Sophisticated manipulators use complex, multi-tiered wallet clusters to mimic an organic user base. Analysts monitor “controller addresses” that inject capital into subordinate wallets using multi-sender smart contracts. If these managed addresses subsequently execute trades in the same liquidity pool with a buy/sell volume difference of less than 5%, it provides strong attribution indicators of a coordinated ring.

AMM-Native Wash Patterns

Rather than relying on traditional order-book definitions, on-chain analysts classify deceptive behavior into AMM-specific categories:

• Single-Address Round Trips: A single wallet executes rapid buy-and-sell swaps within the same pool to generate volume while maintaining flat exposure.
• Controller-Managed Wallet Swarms: A central funding address orchestrates dozens of subordinate wallets to simultaneously buy and sell, creating a deceptive illusion of diverse market participation.
• LP-Self-Trading: An entity provides concentrated liquidity to a pool and subsequently wash trades against their own position, effectively recycling the trading fees they pay back to themselves minus gas costs.
• Flash-Loan Volume Bursts: Attackers use flash loans to borrow massive capital, executing large swaps back and forth in a single block to inflate volume metrics with zero upfront capital.
• Cross-Pool Loops: A more complex obfuscation where an asset is routed through multiple different liquidity pools (e.g., swapping Token A for Token B in Pool 1, and Token B back to Token A in Pool 2) to break basic bilateral heuristics.

Graph Theory in Blockchain Forensics

To map the architecture of large-scale wash trading rings, researchers view the ecosystem as a dynamic web using graph theory.

By representing cryptographic wallets as nodes and asset transfers as directed edges, analysts run algorithms (such as Kosaraju’s or Tarjan’s) to isolate Strongly Connected Components (SCCs). An SCC is a subgraph where every node is reachable from every other node. In a DEX environment, a highly frequent SCC indicates a cluster of accounts trading in collusive circles. Once an SCC is isolated, volume-matching algorithms sum the total traded volumes per account. If the aggregate position change across all accounts within the SCC approaches zero, the cluster exhibits strong attribution indicators of a wash-trading syndicate.

Buy bitcoin and stocks. Signup to Coinbase today

Applying community detection algorithms reveals distinct topological structures used by serial scammers :

• Star-Shaped Clusters: A single funding wallet acts as the core, distributing gas tokens outward to dozens of peripheral trading wallets that simultaneously wash trade against a target pool.
• Chain-Shaped Clusters: Designed for obfuscation, funds move sequentially from one wallet to the next in a long line, with wash trades executed at various intervals.
• Majority-Flow Clusters: Complex, mesh-like interactions where liquidity dynamically shifts between multiple high-activity nodes to simulate a diverse user base.

Advanced Primitives: Flash Loans and Intent-Based Protocols

Bad actors increasingly leverage unique DeFi primitives to maximize value extraction, while protocol developers design new architectures to mitigate these same risks.

Flash Loan Exploitation

Flash loans allow a user to borrow large amounts of uncollateralized assets from a lending protocol, provided the loan is repaid within the same transaction block. Malicious actors take out flash loans to route extraordinary amounts of capital through a DEX pool. This generates instantaneous, astronomical trading volume without the attacker risking underlying capital. Forensic systems now isolate transactions containing flash loan event logs; if the subsequent logic only involves cyclic swapping within a single pool without securing a legitimate arbitrage profit, it is flagged as a zero-risk wash trade.

The Rise of Intent-Based Protocols

The DeFi landscape has seen a major shift toward intent-based protocols like CoW Swap and UniswapX. Instead of specifying an exact execution path (e.g., “Swap Token A for Token B on Uniswap V3”), users simply declare their desired outcome. Specialized third-party actors called “solvers” then compete in batch auctions to fulfill these intents by finding the optimal routing.

This architecture changes the game for wash traders. Because trades are batched and settled collectively by external solvers that optimize for the best uniform clearing price, the mempool-timing edge and the precise tick manipulation required by wash-trading bots are significantly reduced. However, intent protocols do not eliminate the practice. If an intent protocol or a specific solver network directly incentivizes raw trading volume through a points program, bad actors will still farm it. They simply have to farm it through a different pipe.

Case Study: The NexFundAI Sting Operation

The heuristics used to detect wash trading were extensively validated during the U.S. Federal Bureau of Investigation (FBI) NexFundAI sting operation.

The FBI created a cryptocurrency called NexFundAI specifically to expose professional, institutional-grade “market making” firms that offer volume manipulation as a service. On October 9, 2024, the Department of Justice unsealed charges against 18 individuals and entities (including market makers ZM Quant, CLS Global, and MyTrade), with the SEC filing related actions shortly after.

The future of finance is here. Trade crypto and more

The on-chain footprints left by these firms matched expected forensic patterns:

• Block-Level Synchronization: Analysis of the involved wallets showed that 28% (148 wallets) were funded with gas for the very first time on the same Ethereum block, a hallmark of centralized algorithmic management.
• Perfect Symmetry: Aggregated daily data from the Uniswap secondary market showed mathematically perfect symmetry between buy and sell volumes, confirming that bots deliberately zeroed out their positions daily to remain risk-neutral.
• Exact Matching: The bots executed identical individual trades (matching exact token amounts and timestamps) consistently over a month-long period.

During the sting, the operators explicitly confessed on recorded lines, telling undercover agents, “That’s how we do market making on Uniswap”.

Forensic Analytics Infrastructure

Transitioning from theoretical detection to real-time surveillance requires robust data engineering. Forensic analysts rely heavily on specialized data platforms.

Dune Analytics and DuneSQL

Dune Analytics parses unstructured blockchain event logs into readable schemas. For DEX manipulation, analysts query the curated dex.trades table, which captures raw trade events across decentralized liquidity pools.

To detect complex wash-trading loops efficiently, investigators deploy advanced Common Table Expressions (CTEs) in DuneSQL, breaking multi-step routing logic into readable, partitioned steps. Efficiency is critical when querying terabytes of historical data. Analysts strictly use time-based partition pruning (filtering by block_time) and specify the targeted blockchain to prevent catastrophic full-table scans.

Python Forensics: Web3.py and NetworkX

For script-based investigations outside of a browser, the Python ecosystem is the industry standard. The Web3.py library allows analysts to connect directly to blockchain nodes via JSON-RPC, fetch historical block data, and parse smart contract event logs.

Once raw transaction data is structured into DataFrames, researchers apply the NetworkX library to construct directed mathematical graphs. NetworkX provides prebuilt algorithms for community detection, allowing analysts to mathematically isolate Strongly Connected Components and visually map the topologies of suspected wash-trading rings.

Skip the wait. Buy a licensed company.

The 2026 Regulatory Landscape

As institutional capital integrates with decentralized networks, regulators are focusing heavily on distinguishing legitimate market making from illegal manipulation. A legitimate market maker continuously quotes both buy and sell prices to provide essential liquidity, assuming genuine market risk. Wash trading involves zero change in beneficial interest or market exposure.

The regulatory approach to DeFi shifted structurally in early 2026. The SEC and the CFTC announced a joint regulatory harmonization effort known as Project Crypto. The partnership aims to advance a clear digital asset taxonomy, clarify jurisdictional lines, and reduce duplicative compliance requirements for entities operating across both securities and derivatives markets.

While traditional centralized venues have strict surveillance mandates, the expectations for decentralized interfaces are still evolving. Regulators are increasingly signaling expectations that major DEX front-ends operating in the U.S. will need to implement monitoring systems to flag wash trading and spoofing. By treating decentralized markets as transparent ledgers, regulatory authorities recognize that mechanical, algorithmic wash trading patterns are largely identifiable when subjected to high-signal analytics.

Frequently Asked Questions (FAQs)

What is the core definition of a wash trade on a DEX?

On a decentralized exchange, wash trading is the practice of continuously round-tripping an asset through an AMM liquidity pool to artificially inflate trading volumes without taking on actual market risk or changing net exposure.

Why does this happen on decentralized platforms if users have to pay network fees?

While executing trades on a blockchain incurs continuous gas and liquidity provider fees, bad actors still do it because the external financial incentives outweigh the costs. They wash trade to farm highly lucrative protocol airdrops, artificially boost a token’s ranking on volume leaderboards, or create a false sense of momentum to lure victims into a scam liquidity pool.

How do analysts actually detect this behavior on a blockchain?

Analysts use high-signal heuristics rather than guessing. They look for “temporal volume matching,” tracking specific controller wallets that buy and sell the same asset within minutes with near-zero position changes. For more advanced, multi-wallet rings, they use graph theory algorithms to find circular trading loops (Strongly Connected Components). However, it is important to note that these are heuristics, and complex arbitrage or MEV bots can sometimes trigger false positives.

What is the impact of wash trading on Liquidity Providers (LPs)?

The impact is measured using metrics such as Loss Versus Rebalancing (LVR). Wash trading induces artificial volatility, which can exacerbate the adverse selection costs LPs face. However, LPs also collect a fee on every wash swap executed. The net effect depends on the pool’s fee tier, the toxicity of the overall flow, and whether the volume generated outpaces the LVR costs.

Try the leading VASP data free for 1 month. No card required.

How do intent-based protocols handle this kind of manipulation?

Modern intent-based systems (such as CoW Swap and UniswapX) allow users to specify their desired trading outcome, and third-party solvers compete in batch auctions to find the best price. Because trades are grouped and settled collectively, it reduces the mempool-timing edge and the precise tick manipulation that wash trading bots rely on. However, if an intent protocol incentivizes volume through a points program, actors can still farm it, and it just forces them to farm through a different pipe.

Are authorities actively prosecuting this behavior in DeFi?

Yes. High-profile actions, such as the FBI’s NexFundAI sting operation and the DOJ unsealing charges in October 2024, proved that authorities are actively deploying advanced on-chain forensics to prosecute entities that use automated bots to manipulate volumes under the guise of “market making.” Furthermore, 2026 initiatives like the SEC and CFTC’s joint “Project Crypto” are actively working to clarify jurisdictional lines and enforcement approaches.