Log In Sign Up

NFT Wash Trading: Quantifying suspicious behaviour in NFT markets

by   Victor von Wachter, et al.

The smart contract-based markets for non-fungible tokens (NFTs) on the Ethereum blockchain have seen tremendous growth in 2021, with trading volumes peaking at 3.5b in September 2021. This dramatic surge has led to industry observers questioning the authenticity of on-chain volumes, given the absence of identity requirements and the ease with which agents can control multiple addresses. We examine potentially illicit trading patterns in the NFT markets from January 2018 to mid-November 2021, gathering data from the 52 largest collections by volume. Our findings indicate that within our sample 3.93 addresses, processing a total of 2.04 of market abuse. Flagged transactions contaminate nearly all collections and may have inflated the authentic trading volumes by as much as 149,5m for the period. Most flagged transaction patterns alternate between a few addresses, indicating a predisposition for manual trading. We submit that the results presented here may serve as a viable lower bound estimate for NFT wash trading on Ethereum. Even so, we argue that wash trading may be less common than what industry observers have previously estimated. We contribute to the emerging discourse on the identification and deterrence of market abuse in the cryptocurrency markets.


page 1

page 2

page 3

page 4


On the Bound of Cumulative Return in Trading Series and the Verification Using Technical Trading Rules

Although there is a wide use of technical trading rules in stock markets...

Panoptic: a perpetual, oracle-free options protocol

Panoptic is a perpetual, oracle-free, instant-settlement options trading...

The Effects Of Technology Driven Information Categories On Performance In Electronic Trading Markets

Electronic trading markets have evolved rapidly with continued adoption ...

Platform Criminalism: The 'Last-Mile' Geography of the Darknet Market Supply Chain

Does recent growth of darknet markets signify a slow reorganisation of t...

Emergence and structure of decentralised trade networks around dark web marketplaces

Dark web marketplaces (DWMs) are online platforms that facilitate illici...

Detecting and Quantifying Wash Trading on Decentralized Cryptocurrency Exchanges

Cryptoassets such as cryptocurrencies and tokens are increasingly traded...

Understanding Security Issues in the NFT Ecosystem

Non-Fungible Tokens (NFTs) have emerged as a way to collect digital art ...

1 Introduction

A non-fungible token (NFT) is a unique digital representation of a digital or physical asset. While the NFT standard is used widely to designate ownership of artefacts such as domain name registrations or concentrated liquidity positions in constant function market makers (CFMM) [uniswap_2021], the arguably most recognized use of the NFT standard is within the representation and trade of digital art and collectibles. Here, the NFT is typically used to represent the ownership of a digital image externally stored, either on a server or, more commonly, on censorship resistant distributed file systems such as the Interplanetary File System. A basic NFT standard such as the ERC721 [entriken_2018] typically denotes an interface implementing the ability to own, transfer and trade the NFT. Standardization led to the emergence of NFT markets, facilitating primary and secondary trading, the presently most dominant of which is OpenSea. Permissionless NFT markets, themselves implemented as smart contracts, enable users to sell and purchase NFTs in two ways: as a fixed-price sale or auction, in which competing bids are locked by the smart contract together with the NFT until a winner is found and the auction is cleared. With the admission of NFTs into popular culture, trade volumes on these markets have seen dramatic growth from a mere $12m settled in September 2020, to volumes exceeding $3.5b in September of the following year, a surge of over 29,060% 111

Users typically connect to the permissionless markets through public-key cryptography capable of generating an arbitrary number of addresses [jensen_2021]. As a consequence, user identities remain entirely pseudonymous in NFT markets, making the obfuscation of illicit practices challenging to prevent. As the unique properties of the Ethereum blockchain simplifies adversarial agents to hide in plain sight, we hypothesize that wash trading and strategic bidding amongst multiple addresses controlled by a single or colluding agent, may be a frequent occurrence. As there are no theoretical limits to the number of pseudonymous addresses a single agent can control, we conjecture that adversarial agents likely employ a mixture of manual trading and bots to trade NFTs between clusters of addresses in their control. This behaviour serves the strategic purpose of artificially inflating the trade volume of a given NFT, creating an impression of desirability to uninformed traders [imisiker_2018]. The uninformed traders, looking for a great opportunity to buy a ‘hot’ NFT will interpret the transaction volume as an authentic expression of interest from other collectors and immediately place a bid or purchase the NFT at an artificially inflated price.

Furthermore, novel markets tend to be driven by a volatile search for suitable pricing models [khuntia_2018]. This is undoubtedly the case for the blossoming crypto markets on which the current level of ‘irrational exuberance’ may result in inefficient markets given the presence of uninformed traders looking to strike gold. Adversarial market participants have been shown to exploit these conditions, primarily by employing strategic wash trading on centralized and decentralized central limit orderbook (CLOB) exchanges [aloosh_direct_2019, cong_crypto_2020, pennec_wash_2021, victor_detecting_2021].

Yet, the extent to which these or equivalent practices are being used on NFT markets, remains unclear. To fill the gap, in this paper we study activities between addresses participating in the NFT markets on Ethereum. We pursue the research question: ‘To what extent does wash trading occur in smart contract-based NFT markets on Ethereum, and to which extent does this practice distort prices?’. Conceptualizing trading patterns as a graph and proposing two detection algorithms, we identify 2.04% as the lower bound of suspicious sale transactions that closely follow the general definition of wash trading.

2 Literature Review

Wash trading is a well-known phenomenon in traditional financial markets and refers to the activity of repeatedly trading assets for the purpose of feeding misleading information to the market [cao_2014]. Typically, one or more colluding agents conduct a set of trades, without taking market risks, that lead to no change of the initial position of the adversarial agents. Most of the early academic publications on wash trading in financial markets focused on colluding investor behaviour (e.g. [grinblatt_2004]). Cao et al. [cao_2014] were among the first to analyse wash trading by specifying trading patterns. Later, they extended their study using directed graphs on order book data [cao_detecting_2016]. The literature on the identification of wash trading patterns in the cryptocurrency markets primarily emphasizes CLOB models on decentralized exchanges [victor_detecting_2021] and centralized exchanges, where wash trading practices have been shown to be especially prevalent[aloosh_direct_2019, cong_crypto_2020, pennec_wash_2021]. Perhaps because the introduction of CFMMs has nearly eliminated the efficacy of wash trading in smart contract-based markets for fungible assets, research on NFTs tends to emphasize either market dynamics and pricing [nadini_mapping_2021, dowling_is_2021] or the technical design considerations [regner_nfts_2019, wang_non-fungible_2021]. Thus far, little academic research has examined market abuse in smart contract-based NFT markets [das_2021].

3 Methodology

The Ethereum blockchain is a type of permissionless ledger, in which all transactions and state changes introduced by smart contracts are replicated across all participating nodes in the network [antonopoulos_2018]. This introduces a high level of integrity to the database, but simultaneously requires the pseudonymization, as anyone with access to the database would otherwise be able to view the balances of users on the network. In Ethereum, this problem is solved with public-key cryptography [antonopoulos_2018]. Any user on the network can generate a public/private key pair, which can subsequently be used to generate an arbitrary number of addresses. This design presents a fascinating paradox from the perspective of identifying market abuse: Pseudonymous identities are essential in protecting the privacy of benevolent users but, at the same time, they allow adversarial agents to hide in plain sight. Yet, due to the strict ordering of transactions and unique properties of NFT markets, blockchain transaction data presents a powerful and unique opportunity for pattern detection utilizing graph-based algorithms [victor_detecting_2021, chen_graph_2020, weber_2019] and address clustering [victor_clustering_2020, harrigan_2016].

Data Aggregation and Cleaning: We collect transaction data on the 52 leading ERC721 NFT collections on the Ethereum blockchain by trading volume, covering a period between the 1st of January 2018 until 21st November 2021. The dataset contains 21,310,982 transactions of 3,572,483 NFTs conducted by 459,954 addresses. Collectively, the dataset represents $6.9b of the $12.3b total trading volume (49.5%)222 on all NFT markets since the first block of the Ethereum blockchain333

The authors will open-source scripts and data upon publication.


We capture all blockchain transactions related to the selected NFT collections via the OpenSea API. We parse the dataset by ‘sale’ events emitted by an NFT contract when it is transacted on a smart contract-based marketplace, indicating that a change of ownership has been recorded on the blockchain, and ‘transfer’ events indicating that the NFT has been transferred from one address to another. The dataset was subsequently enriched with (I) historic USD prices for settlements in crypto and stablecoins via the Coingecko API and (II) blockchain-specific data via the Etherscan services. (III) To maintain an accurate overview of the NFT markets in the dataset, we collected the deployment date of the four largest NFT on-chain markets manually (Foundation, OpenSea, Rarible, Superrare) and matched the deployment dates with the event emissions.

It should be noted that the dataset collected for this analysis pertains only to operations conducted within the Ethereum Virtual Machine (EVM), meaning that we knowingly omit any ‘off-chain’ transactions or bidding patterns from the analysis. Finally, we pre-processed the dataset with standardized scripts, eliminating a very small fraction of transactions due to obvious technical errors or trades against exotic assets for which the price data tends to be inaccurate.

Building Transaction Graphs: In order to identify suspicious behaviour conforming with wash trading activity, we model the transaction history of each NFT as a directed multigraph , where is the set of addresses and is the set of transactions between addresses. The direction of the edges is given by the transaction flow from sender to receiver, identified by the transaction hash. The weight of the edges represents the USD price at the time of the transaction. This denotation is amenable to the identification of clusters in which a sequence of transactions leads to no apparent position change for any of the addresses involved. Topologically, these patterns form closed cycles. Utilizing Deep-First-Search-Algorithm [tarajan_depth_1971] we identify closed cycles within the data set. We adjust and iterate the algorithm, using the temporal distance between transactions to detect sub-cycles. The proposed algorithm (Appendix) has a linear time complexity of for n nodes (addresses), e edges (transactions) and c cycles [johnson_finding_1975]. Figure 2 illustrates a few examples of suspicious cyclic activities. Transactions belonging to a suspicious cycle are marked in red, and potentially colluding trading addresses , are highlighted in grey.

Figure 1: Detection of suspicious activity through closed cycles. We exclude cycles involving only ‘transfer’ events.
Figure 2: Detection of suspicious activity through a rapid sequence of transactions without taking market risk.

Example 1 is a self-directed transaction. Examples 2-4 illustrate variations of a cycle with two transactions, where solid lines represent ‘sales’ and dotted lines represent ‘transfers’. Example six depicts a complex graph where edges {B, C} and {B, C, D} form two sub-cycles distinct by time.

Further, we analyze path-like transaction patterns, as agents could actively avoid closed cycles. Informed by the definition of wash trading, we consider rapid trade sequences without exposure to market risk as potentially suspicious. Erring on the side of caution, we apply relatively strict thresholds. First, we define the transaction velocity for a sequence as the time elapsed from the initiation to the end. We delimit a rapid trade sequence below 12 hours. Second, we delimit the deviation in USD values, a proxy for market risk, in a sequence to a maximum of 5% of the initial price. Combining both threshold flags 0.3% of the sale transactions as mildly suspicious. Figure 2 showcases these path-like trade sets.

The proposed algorithms are highly applicable, in that NFT marketplaces deviate from conventional markets in several ways: First, as NFTs are uniquely identifiable by smart contract address and id, detection does not require volume matching required for fungible tokens (e.g. [cao_detecting_2016, victor_detecting_2021]). Second, in contrast to other market designs such as CLOBs the seller can retain certain control over the opposing counterparty, making it potentially easier to conduct cyclical trades. Lastly, due to the transparency of the Ethereum blockchain, we can inspect trading behaviour at the account level without relying on statistical indicators [pennec_wash_2021].

4 Results

The analysis flags a total of 3.93% of the addresses as suspicious, indicating that these addresses might be controlled by single agents and used to conduct cyclical or sequential wash trading with NFTs. The flagged addresses processed 2.04% of the total sale transactions, inflating the trading volume by $149.5m or 2.17% for the period. Of the 36,385 flagged sale transactions, 30,467 were conducted in clusters of cyclical patterns whereas 5,918 were conducted as a rapid sequence. The suspicious activity was executed with just 0.45% of the NFTs in the dataset, indicating a high concentration of illicit activities around a few NFTs (Table 1).

Dataset Identified Percentage
Addresses 459,954 18,117 3.93%
Transactions 1,779,380 36,385 (cyclic: 30,467 sequential: 5,918) 2.04%
Volume in $ 6.9 b 149.5 m 2.17%
NFTs 3,572,483 16,289 0.45%
Table 1: Overview of the results.

While we identify suspicious activities in all NFT collections (Table 2, Appendix), the extent to which a collection is contaminated by flagged transactions ranges from 0.19% to 60.93%, indicating that adversarial agents tend to target specific collections for illicit practices. In general, we observe a predisposition for simple trading patterns. 60.6% of the identified clusters are simple variations with two transactions (equivalent to examples 2-4 in Figure 2). Complex variations of three (8.7%) or more than three transactions are less common (30.7%). However, we find no signs of self-directed trades. Cyclical patterns are conducted at relatively rapid intervals. Figure 3 illustrates the elapsed time from the first to last transactions, with respect to the number of transactions involved. Overall, 48.1% of the identified cycles happen within a single day. 13.2% happen within one to seven days and 13.0% are just below 30 days. Consequently, 74.3% are conducted within 30 days, an important threshold under US regulation444

Figure 3: Elapsed time to close a cycle with respect to the number of transactions involved. 48.1% of the identified cycles happen within a single day.

The identified 2-transactions variations have a median execution time of 4.2h (3-transactions: 54h), suggesting a preference for simple and fast patterns. We assume this to indicate that adversarial agents are not trading in an automated fashion, which would result in more complex patterns and execution times within a few minutes. Rapid sequential trades, in which a NFT is moved fast between accounts without any market risk, contributed to only 5918 suspicious transactions, equivalent to 0.3% of the transactions across all collections.

We investigate, at what point in the collections’ lifetime, suspicious activities occur. For each collection, we determine the mean suspicious activity starting with the creation date of the respective collection. Figure 4 (Appendix) shows a peak of suspicious activity in the first third of a collections’ lifetime, possibly in order to raise initial awareness to attract naive buyers. In absolute terms, wash trading is the highest at the beginning of a collections’ lifetime, however this is also matched by a high amount of organic traffic. Increasing the price of an asset by faking activity is a central motivation for agents in conducting illicit trading [imisiker_2018]. Analysing if the average price is inflated through wash trading practices, we find that the subsequent sale after a detected wash trade has, on average, an increased price of 30.53%. However, a regression on panel data to measure the impact on the price, led to insignificant results for a majority of collections. Looking into external factors, we found that age has a strong positive relationship with the price. While we expected an inverse relationship of the gas price, which impacts the costs per transaction, with the NFT price, we found the effect to be mixed in a majority of cases. We suspect these findings are influenced by the strong bull market, given the current overall positive public sentiment.

Finally, we explore the relationship between executed trades per address and unique trade partners per address. On NFT markets sellers can retain certain control over the opposing counterparty, thus a large number of trades with only few other addresses raises suspicion. Figure 5 (Appendix) visualizes this relationship, whereas addresses which conducted many trades with only a few other addresses would be tilted to the left. Each dot represents an address trading on NFT markets, positioned by the amount of trades and unique trade partners. The size of the dot depicts the number of empirically identified suspicious trades. We find a cluster of suspicious addresses, conducting 25-37 trades with only 12-17 unique trade partners. Furthermore, in contrast to other markets, addresses have relatively few trades, again suggesting a low level of automated trading in this nascent market.

5 Discussion

Given the challenges in interpreting pseudonymous blockchain based data, this study has multiple limitations. First and foremost, it should be made clear that none of the findings presented in this paper present any conclusive evidence of criminal activities or malicious intent. While we delimit a set of behaviours which we find unlikely to be conducted with benevolent intent, we leave it to the reader to assess the likelihood that flagged transactions constitute attempts at wash trading. Any, or all, of the flagged sequences may be erroneous but authentic transactions. Second, the decision of limiting our analysis to a specific subset of cyclical and sequential patterns may result in false negatives as sophisticated attempts at wash trading involving advanced address clusters over longer periods are not flagged by the analysis, at this point. Wash traders may me more careful and evade the analyzed heuristics. Similarly, the analysis pertains exclusively to on-chain transaction events emitted by the NFT contract and does not account for strategic bidding practices, which we suspect may be a popular methodology amongst adversarial agents. Because of these limitations, we hypothesize that the results presented here detect a lower bound for actual extent of adversarial behavior on NFT markets.

Should wash trading conducted according to the patterns explored in this paper increase over time, smart contract-based NFT platforms may consider the implementation of obligatory or voluntary identification initiatives. Alternatively, trading limitations on trading velocity, price deltas or counterparties can be implemented. In our sample self-directed trades have been non-existent, with indicates successful countmeasures at smart contract or frontend level. Nevertheless, any such attempt at introducing restrictions or limitations may stifle organic market activity and will inevitably create a cat and mouse game, as developers and wash traders race to identify and create increasingly sophisticated patterns.

More subtle countermeasures fostering the supervision of NFT markets are the expansion of NFT standards beyond ERC721 and ERC1155, as well as increased data ubiquity. Decentralized NFT markets are transparent, however NFT data is very diverse and difficult to retrieve. Fees potentially play a big role in preventing wash trading, as long as the rewards or incentives are less than the cost-of-attack. Fees on NFT markets are substantial. Fraudulent agents are less likely to perform a wash trade if they are losing several percentages with every transaction. Admittedly, this does neither stop marketplaces itself to perform wash trades nor prevents private offset agreements between the trader and a marketplace.

Even so, with $149.5m and a median of 2.04% suspicious sale transactions we argue that wash trading may be less common than what industry observers have previously estimated [coindesk_2020, bloomberg_2021].

6 Conclusion

We identify what we believe may serve as a lower bound estimation for suspicious trading behaviour on NFT markets, following the definition of wash trading: sets of trades between collusive addresses, without taking market risk, that lead to no change in the individual position of the participating addresses. Our findings indicate that (I) adversarial agents exhibit a clear preference towards fast and simple cyclical patterns, (II) the level of suspicious activity varies significantly across NFT collections, (III) illicit activity could still be done in a manual fashion, and (IV) the activities do not necessarily produce the intended price impact, as other exogenous factors such as age and sentiment are more relevant to price discovery.

As a theoretical contribution, we add descriptive knowledge to an emerging field of research where scientific studies are scarce. We contribute to the growing literature on the identification of illicit market behavior in centralized and decentralized crypto markets, by conducting the first in-depth examination of NFT wash trading on the Ethereum blockchain. We contribute empirical statistics of fraudulent behaviour and a set of suspicious transaction graphs to foster the understanding of wash trading in increasingly financialized NFT markets. The valuable insights we generate for practitioners are twofold: First, we provide valuable insights to prevent collectors from buying NFTs that are potentially inflated by wash trading. Second, we discuss practical countermeasures increasing the standards for the wider NFT ecosystem. Further research opportunities are manifold and include studying NFT markets on other blockchains as well as researching the correlation between suspicious behaviour and sentiment data.

7 Appendix


1:Input: timestamped blockchain transactions
2: empty list of
3:for  do
5:      identifier, weight
6:     label as discovered
7:     for all directed of  do
8:         test for adjacent edges
9:         if  is not labeled as discovered then
10:              continue
11:         else
14:              break and recurse
15:         end if
16:     end for
17:end for
Algorithm 1 The detection algorithm


Table 2: Results for each collection. Column (A) is the share of suspicious addresses, (B) the share of suspicious transactions, (C1) represents the total volume flagged denominated in USD, (C2) the share of the flagged volume and (D) the share of suspicious NFTs
Figure 4: Wash trading with respect to collections’ lifetime. In absolute terms, wash trading is the highest at the beginning of a collections’ lifetime, however this is also matched by a high amount of organic traffic.
Figure 5: Trades and unique trade partners. Each dot represents an address trading on NFT markets, positioned by the amount of trades and unique trade partners. The size of the dot depicts the number of empirically identified suspicious trades.