DE EN RU
SpoofScan – Header
← Back to overview: CEX TRADER GUIDE – Articles & Resources
Article 5

Market Anomaly: Pump and Dump

Short explanation: Coordinated buying waves push the price sharply up ("Pump"), after which the initiators aggressively sell into the demand ("Dump"). From the outside it looks like sudden momentum followed by a sharp reversal. Social channels are often used to create attention. These moves have short holding periods and above-average reversal rates. For beginners: Do not chase the first spike - watch volume quality and retracement.

Market CEX Spot, CEX Derivatives
Evidence status & as of Spot-evidenced · As of: October 18, 2025, 12:00 UTC

Documented scenarios (CEX-based)

  • YoBit (10 October 2018): The exchange publicly announced that it would actively buy randomly listed coins within a fixed time window ("Pump"). The event is documented with date, wording and schedule.
  • Peer-reviewed analyses 2018–2023: Several studies identified hundreds of coordinated Pumps organized in Telegram groups and executed on centralized exchanges. A USENIX paper analyses 412 documented events and shows typical patterns (price/volume peak, rapid reversal). Further work confirms the mechanism and the short time scales.
  • Regulators (advisories): The CFTC explicitly warned about P&D schemes in thinly traded coins or on platforms with many pairings; the advisory emphasises these actions can take place within minutes.

How it works

Short & understandable

  1. Coordination: An initiator announces in chat groups (e.g. Telegram) a time and often the trading pair. The goal is to direct many traders into the same asset at once.
  2. Pump phase: Directly after T0 rapid buy sequences begin. Price shoots up in seconds/minutes; volume explodes. Outsiders interpret it as a "real" trend.
  3. Unload (Dump): Early coordinators sell their cheaply acquired holdings into the hype to latecomers. The price then drops sharply, often within minutes.
  4. Why it works: Many inexperienced traders react to strong, sudden moves and social signals. In illiquid markets relatively small amounts can change price patterns. Studies document the repeated sequence: sharp rise, peak in minutes, then fast reversal.

Clear detection features (observable live)

  • Seconds-to-minutes spike in price and volume; unusually short time to the local high.
  • Rapid reversal: clear return toward pre-pump levels within the same hour.
  • Social correlation: Telegram / social mentions spike precisely around T0 (announcement/call to buy).
  • Illiquidity context: events cluster in small caps / pairs with thin order books.

Why CEXs are vulnerable

  • Many small-cap listings and thin books: coordinated flows of modest size can produce large price moves.
  • 24/7 trading, global user base: coordination and simultaneous execution are easy.
  • Fragmented transparency: without cross-venue audit trails it is difficult to prove the full causal chain (chats → orders → fills) in real time. Regulators therefore warn especially for thinly traded coins.

Comparison: regulated exchanges

  • Rulebook: In the EU MAR (Art. 12) prohibites spreading misleading signals; in the US the SEC/CFTC pursue comparable misconduct.
  • Surveillance: Exchanges / SROs operate multi-venue surveillance with full order trails (e.g. CAT, SEC Rule 613). This enables targeted investigations of price/volume anomalies plus communication traces where permissible.

Why early detection is critical – and what's changing in the EU

  • For the market: P&D episodes temporarily distort price discovery, create slippage and transfer wealth from latecomers to early coordinators. Studies document these effects.
  • EU context (MiCA): As of December 30, 2024 MiCA largely applies; existing providers may-depending on member state-operate under transitional arrangements until July 1, 2026. ESMA expects effective monitoring against market abuse including coordinated price inflation during this phase.

Concrete thresholds / alert rules (E3/E2/E1)

Adaptive, quantile-based, per symbol/venue against a 30-day baseline for the same time of day. Required: price/volume (≥10-sec resolution). Ideal: social signals.

E3 (high) – "classic Pump signature"

  • Price ≥+20% in ≤2 min and volume ≥50× 30-day median (same bucket) and
  • T+30 min reversal ≥40% of the increase or T+60 min ≥60%,
  • (optional) social burst ≥ p99 (mentions/min) within ±5 min of T0.

E2 (medium)

  • Price +10–20% in 5 min and volume ≥20×, and partial reversal ≥25% in 30 min.

E1 (low)

  • Price +6–10% in 5 min and volume ≥10× without clear reversal → watchlist.

Rationale: thresholds reflect studies showing short time horizons (peak in minutes, quick retracement) and volume explosions.

Practical tips (minimising false positives)

  • News filter: Check for genuine issuer news (partnerships, listings, security incidents) first; real news can cause similarly fast moves.
  • Monitor liquidity regime: Spreads/ticks/fees change pump amplitude – recalibrate thresholds per symbol regularly.
  • Cross-venue comparison: If the peak occurs only on one venue, exercise caution (local incident).
  • Use social signals responsibly: Mentions/message counts are supplementary indicators, not standalone proof.

Why this matters (trader value & compliance)

  • For traders: Recognising the Pump signature avoids FOMO entries at the top, reduces slippage and protects capital.
  • For operators/compliance: Well-documented real-time metrics (timestamps, z-scores, reversal proof) simplify internal reviews, customer communication and cooperation with regulators under MiCA/MAR.

Relevant sources

  • CFTC – Customer Advisory "Beware Virtual Currency Pump-and-Dump Schemes", 15 February 2018 (warnings on thinly traded coins and fast, coordinated actions).
  • J. Xu & B. Livshits – "The Anatomy of a Cryptocurrency Pump-and-Dump Scheme", USENIX Security, 2019 (analysis of 412 Telegram-organised events; timing profiles & precursors).
  • M. La Morgia et al. – "Analysis and Detection of Pump-and-Dump Cryptocurrency Scams", ACM, 2023 (detection features, illiquid pairs, social signals).
  • T. Li, D. Shin, B. Wang – "Cryptocurrency Pump-and-Dump Schemes", SSRN (updated 2021) / Cambridge Univ. Press, 2025 (short-term price/volume spikes, rapid reversals, clear wealth transfers).
  • YoBit – public pump announcement, 10/11 October 2018 (documented in industry media).
  • ESMA – "Statement on MiCA Transitional Measures", 17 December 2024; ESMA – MiCA overview (grandfathering until 01 July 2026 possible; national deviations).
>