Now, we focus on a new kind of pump operation. We will call it crowd pump—a pump and dump event that results from the non-directly organized actions of a crowd of people. We analyze how these operations happen, and we illustrate the differences from standard pump and dumps. Lastly, we offer that it is possible to leverage our dataset to build a classifier that can also detect crowd pump events.
5.1 A Description of the Crowd Pump Phenomenon
In January 2021, the stock market was puzzled by an unprecedented rally of GameStop (GME). The GME stock had been gradually losing value for a couple of years, as sales of physical copies of video games plummeted due to the shift towards digital purchases [
43]. During the COVID-2019 pandemic, the situation worsened to the point that GameStop announced it would close more than 1,000 stores by April 2021 [
36]. GME quickly became easy prey for short-sellers, economic agents that bet on the fall of specific securities. Short-sellers borrow stocks, sell them, and buy them later, when the price is expected to be lower, to give them back to the lender.
This operation would have gone unnoticed, as this market practice, albeit somewhat controversial, is common. The turning point came when a group of users active on Reddit [
67], one of the most popular social news aggregation and discussion websites [
23], started to buy large quantities of GME stocks. These users communicated in a
subreddit—a user-created board that covers a specific topic—called
r\wallstreetbets. Initially, the users started to invest in the GME stocks because they believed they were undervalued. Only later they began to do it as a political statement against hedge funds [
63]. The operation was a great success and the subreddit users managed to raise the stock price of GME by more than 1,900%, from $17.25 on January 4 to $347.51 on January 28 [
55]. Due to the media interest, the subreddit gained more than 3 million followers in that period. GME became the most traded stock in the U.S. stock market on January 26 [
54]. Due to the results of this operation, people started collaborating to buy other stocks such as AMC (AMC Entertainment Holdings), BB (BlackBerry Ltd.), and NIO (NIO Inc.). Their prices increased rapidly in a few days [
65]. In response, several digital trading services like Robinhood began restricting trades on the stocks that were getting pumped [
29].
Due to these limitations, the attention moved to cryptocurrencies—less regulated and still with a combined market capitalization that topped $1 trillion [
22]. The first coin to get widespread attention was DogeCoin. DogeCoin was originally founded as a joke on December 6, 2013 [
62]. The price of the coin skyrocketed on January 28, 2021, after a Reddit group, called
\SatoshiStreetBets, proposed to make it the equivalent of GME for the cryptocurrency market. DogeCoin had an increase in the price of over 800% in 24 hours, from $0.0077 to $0.07 according to data of CoinGecko [
1]. The price increased in several distinct phases, driven by the tweets of well-known personalities like Elon Musk, rock star Gene Simmons, and rapper Snoop Dogg, reaching its highest value ever of $0.079 [
10].
The second target was the Ripple (XRP) crypto-coin. At the time of these events, the XRP suffered a challenging moment due to a lawsuit that started on December 22, 2020. The SEC accused Ripple of performing illegal security offerings of $1.3 billion in XRP for seven years beginning in 2013 [
57]. This action caused a drop in the coin price from $0.42 on December 22 to $0.18 on January 4. Several exchanges delisted XRP, including Coinbase, one of the largest [
60]. The delisting reduced the liquidity of the coin significantly, creating the perfect breeding ground for market manipulations [
7]. In this case, the operation was organized on a Telegram group called “Buy & Hold XRP FEB 1st, 2021” that was later renamed “BUY & HOLD XRP FEB 1st, 2021 @8:30AM” [
33]. The group grew exponentially in the 24 hours following its creation, reaching the limit of 200,000 members of Telegram. The group aimed to buy massive quantities of XRP at a precise date and hour—February 1, 2021, at 13:30 UTC. However, many members started buying it massively the days before the pump, and the cryptocurrency jumped
\(56\%\) up in price, reaching the biggest single-day percentage gain since December 21, 2017 [
29]. So, the price was already high at the pump, and the group could not increase it any further.
5.2 Analysis of Crowd Pumps
Although it is well-known that the DogeCoin pump starts from some popular subreddits [
59], it is unclear who started the pump and how they carried out the operation. We analyze all the Reddit users’ posts on the subreddits mentioned above to answer these questions. A
submission is the first post of a new discussion thread and may contain links, text, and images. To perform our analysis, we downloaded all the submissions from January 01, 2021 to February 02, 2021 of some popular crypto-related subreddits:
r\SatoshiStreetBets, r\WallStreetBets, r\Cryptocurrencies, and r\DogeCoin subreddits. We downloaded data from these subreddits since in the period the terms
“Doge” and
“DogeCoin” appear mainly in them, according to the Redditsearch tool [
66]. To retrieve the submissions, we leveraged Pushshift [
3], a service that provides access to Reddit data overcoming the limit of 1,000 posts of the official APIs.
We globally retrieved 656,146 submissions, of these 626,700 (95.5%) from r\WallStreetBets, 23,485 (3.6%) from r\SatoshiStreetBets, 5,443 (0.8%) from r\Cryptocurrencies, and lastly 518 (0.1%) from r\DogeCoin. From the downloaded data we took into account only the submissions that contain the name of the coin (“DOGE”, “DogeCoin”) and some of their very popular variations used in the cryptocurrencies slang, such as: “DOGIE”, and “DOGUE”. In the end, we got 27,868 submissions with the following partition: 19,016 (68.2%) from r\WallStreetBets, 8,383 (30.1%) from r\SatoshiStreetBets, 194 (0.7%) from r\Cryptocurrencies, and 275 (1%) from r\DogeCoin. Finally, we study the message distribution over time and their relationship with the price of DogeCoin.
Figure
10 shows the number of submissions posted in the subreddits that mention DogeCoin (solid blue line) and the price of DogeCoin in Bitcoin (dashed gold line). As we can see in the upper left chart of the figure, subreddits rarely mention the coin in the weeks before the pump, and the price is stable. In the 24 hours before the pump (vertical dashed line), it is possible to note that some submissions about the coin begin to pop up steadily. However, the price is still stable. After the vertical dashed line, the coin gets a massive spike in popularity, and the price abruptly rises. From this moment, the price of DogeCoin and the number of submissions on Reddit follow the same pattern.
In the light of this analysis, we dig into the posts before the pump. The goal is to understand how the users arranged the operation. We find out that most of these posts tried to drum up the attention on the DogeCoin proposing to pump the currency. Initially, the users did not welcome these posts. The administrators often removed the content because it violated the netiquette of the subreddit. Among these submissions, we found a particularly interesting one on the r\DogeCoin subreddit. Here, a few users were trying to arrange a pump on the DogeCoin on January 28 at 10 AM, five hours later than the actual start of the pump. Nonetheless, none of these submissions had any effect on the price of the DogeCoin, as shown in Figure
10. In our opinion and news [
45], the message that triggered the rally of the DogeCoin, for timing and users welcoming, was posted on January 28, 2021, at 4:05:50 UTC and states:
“Let’s make DOGIECOIN a thing. That’s it, that’s the post”. The submission had only the title, no message body, and no picture.
To better understand why this message triggered the pump, we investigated the creator of the submission, expecting her to be popular on the Reddit community. Surprisingly, we found out that, although the user is very active on Reddit with more than 854 submissions and 769 comments, only four submissions (0.4%) and 17 comments (1%) are related to crypto or finance. Thus, it is doubtful that the author is a crypto-influencer, and it is hard to understand why so many users followed this message.
We performed a similar analysis also on the crowd pump carried out on the Ripple cryptocurrency. For this case study, we analyze the messages on Reddit in the same time frame we did for the DogeCoin, since the two events occurred within a few days of each other. We consider the same subreddits of the previous analysis, with the exception of r\DogeCoin subreddit and including the r\XRP (5,444 submissions), obtaining globally 661,072 submissions.
In this case, we focus on the submissions that mention one of the cryptocurrencies. Figure
11 shows the number of posts in the subreddit that mention Ripple (solid blue line) and the price of Ripple (dashed gold line). As we can see, the coin is rarely mentioned in the weeks before the pump, while it starts to get attention in the days before the pump. Similar to what happened in the case of the DogeCoin pump. Reading these messages, we find out that the cause of this increase in the posts is due to Redditors driven by anti-SEC sentiment and inspired by the DodgeCoin and GME pump operations. The birth of the Telegram group
“OFFICIAL BUY & HOLD XRP” gathered these users, and group members began to promote the group itself. Different from the DogeCoin crowd pump, where the number of posts on Reddit and the cryptocurrency price seem to follow the same trend, in this case, the two lines seem to be more independent, except for the price peaks. Analyzing the beginning of the pump (solid dashed line in Figure
11), it is possible to note that the price quickly rises while the number of submissions on Reddit does not. Some hours later, the price returns to its real value (January 29 at 5:00 UTC), and then the price increases again (January 30 at 16:00 UTC).
This behavior makes us suspect that the pump does not start from Reddit. Thus, we investigate the messages sent on the Telegram group, for which we were able to export all the messages, files, videos, and images. Since, to the best of our knowledge, the group is no longer accessible, and the group chat is not publicly available, we publicly release it as a further contribution [
72]. The Telegram group counted exactly 200,000 members and 45,548 messages. We do not know when the group was created, but the first message appeared on January 28 at 20:19:09 UTC. Unlike pump and dumps, the organizers did it on a Telegram Group instead of a Telegram Channel. Hence, all the group members could write in the chat, not only the admins. After the creation of the group, the chat was open, and the members could freely talk about the event and how to participate. However, the situation escalated around January 29 at 5:00 UTC. From this moment, maybe for a slight fluctuation of the Ripple’s price or an extra-group coordinated action of a set of users, the members start to urge the chat to
BUY! the coin, starting the pump way earlier than expected. This event occurs almost at the same time as the first spike in price that we see in Figure
11. The admins promptly reacted by turning off the chat and resumed it only twice before the day of the pump—the first time on January 30 at 20:05 UTC, the second one on January 31 at 6:03 UTC. In both cases, the chat opened only for 30 minutes, and the admins asked the member of the groups to indicate from which countries they were posting. Then, the chat was opened again nine hours before the pump for a few seconds. As discussed before, the pump was a failure as the group could not further raise the price of the coin.
At the end of our analysis, we find the following main differences between crowd pump and pump and dump operations:
•
Different goal: The aim of a crowd pump is not to inflate the price of an asset and sell it to scam unaware investors. In these kinds of operations, the organizer and part of the community often encourage the participants to hold their stock to keep the value high. We noticed this attitude in both the crowd pump events carried out on the crypto market. A clear example is the crowd pump organized on the XRP currency. In this case, the group creator clearly states in the Telegram group chat that the operation aims to hold the currency. The admin also publishes a disclaimer video on his YouTube channel explaining the purpose of the group. Quoting the description of the video: “This is not a “pump and dump” group. This is a community-led event to bring awareness to the XRP ledger” [
11].
•
Lack of coordination and leadership: Even if we saw on both the crowd pump events attempts to coordinate to buy at a specific hour, they always failed. Unlike standard pump and dump, the organizers reveal the coin to pump in advance. Thus, people start to buy the coin in advance or when they believe the operation has begun. A simple fluctuation of the market or a single post can trigger a ripple effect that leads to the start of the pump.
•
Different time frame and price increase rate: As we saw, in standard pump and dump, the operation lasts for a few minutes or rarely for a few hours, and the price grows almost immediately. In a crowd pump, the price increases abnormally, but it takes hours or days before the coin reaches its maximum peak. This behavior is due to several factors. The goal is different, and some investors do not immediately sell the coin to take a profit. No one knows when the pump will start. Therefore it can take time before the crowd realizes that the operation has begun. Finally, the news and influencers work as an echo chamber, and more and more people join the process making the price of the coin increase in waves. Consequently, while in standard pump and dump the price of the coin returns to its natural level as the event ends, in crowd pump and dump, after more than a month,
4 the price of the DogeCoin is still 500% higher than its pre-pump value, and the XRP is still 100% higher.
5.3 Crowd Pump Detection
In this section, we assess the potential of our machine learning model in detecting crowd pump operations. Although there are some key differences between the crowd pump and standard pump and dump, our intuition is that the rush orders are a very relevant feature also in this kind of operation.
In particular, we consider the number of rush orders in an interval of two hours around the publication of a tweet of Elon Musk that shill the DogeCoin [
10]. We make this choice because, in this case, we have the timestamp of the tweet and we can be sure about the moment in which the operation starts. Figure
12 shows the number of rush orders in two hours around the publication of the tweet. The purple line represents the number of rush orders grouped in chunks of 25 seconds, while the red line in chunks of 10 minutes. In the figure, it is possible to note a considerable number of rush orders after the tweet, precisely like in pump and dump events after the admin announces the target coin. However, looking at the purple line (25 seconds chunk), we find that the pattern of the rush orders is very different from the one we see for the standard pump and dumps (Figure
7). Indeed, there is no neat big spike in the number of rush orders, but a gradual increase with several small spikes. This behavior is not surprising. There is no synchronization of the investors—they jump into the market in waves depending on when the message hits the social platforms on the web and when they see it.
Due to this different behavior, our detector trained on the standard pump and dumps cannot capture the crowd pump analyzing short chunks of transactions. Moreover, we cannot efficiently train a new detector for the crowd pump operations because of the lack of a dataset. However, expanding the chunk’s time frame size makes it possible to collapse the different waves of rush orders into a unique chunk and get a well-outlined spike. The red line in Figure
12 shows the number of rush orders grouped in chunks of 10 minutes. Here, we can see that the pattern is very similar to a pump and dump operation, like the one we reported in Figure
7, and thus it is now reasonable to think that our detector can find these kinds of events.
5.3.1 The New Model.
To detect the crowd pumps, we trained a new classifier based on the Random Forest algorithm like the one used to detect standard pump and dumps. This time we trained the model on the full dataset (317 pump and dump events) described in Section
4.2. We used the same feature we leveraged to build the previous detector, except for the one related to the time. We removed these features because they are specifically tailored for the standard pump and dumps carried out by Telegram groups. The new detector achieves an F1-score of 89.4% in 5 fold cross-validation. In the case of crowd pumps, we test our approach only on two events: XRP and DOGE. For the training phase, we used 25 seconds chunks. Instead, we aggregate the trading data in chunks of 10 minutes for the test phase. After detecting an event, we pause our classifier for six hours to avoid multiple alerts. In this case, we pause the classifier longer than we did for the standard pump and dumps because the operations last more time.
5.3.2 The DogeCoin Pump.
To find out if our detector can catch the start of the DogeCoin crowd pump, we downloaded all the transactions from Binance from January 1 to February 10, 2021. Even though we know that the pump happened on January 28, 2021, we run the detector for some weeks before the pump to check if any suspicious activity is detected and to validate the classifier’s robustness on false positives. At the end of the execution, our classifier detects the following five events:
(1)
January 2, 2021, at 3:00 UTC: At first sight, the event seemed a false positive. However, after a search on the web, we found that the news [
30] reported a price surge of the DogeCoin driven by a tweet from the adult film star Angela White. The actress stated that she is a DogeCoin investor since 2014. The tweet features a photo of the actress wearing a T-shirt with a Shiba Inu image, the DogeCoin mascot, and received more than 10,000 likes.
(2)
January 28, 2021, at 4:10 UTC: This alert falls exactly in the same chunk of the Reddit post that sparkled the DogeCoin popularity in the
r\SatoshiStreetBets subreddit, discussed in Section
5.2.
(3)
January 28, 2021 at 14:20 UTC: It is not easy to link this warning to an individual event. However, investigating on Reddit and Twitter, we find on Reddit an abrupt increase of messages that mention the coin (see Figure
10). Moreover, between 14:00 UTC and 15:00 UTC in the U.S.A., the hashtag
“#dogecoin” became a trending topic on Twitter, with more than 91,000 tweets. Two hours later
“#dogecoin” became a worldwide trending topic, accordingly with the data provided by ExportData.io [
25] and TT-History [
40]. In our opinion, it is safe to assume that this alert detected many investors that flooded the market.
(4)
January 28, 2021, at 23:40 UTC: This is very likely due to Elon Musk’s tweet (January 28, 2021 at 22:47 UTC) on DogeCoin. In particular, the tweet contains a picture that mimics the Vogue magazine with a dog picture on the cover, and the title of the magazine changed to “Dogue.” More than 450,000 users liked this tweet. The detector raised the alert about one hour later. However, looking at the price evolution of the DogeCoin in the hour following the tweet, it is possible to note that investors enter into the market slowly. Indeed, at the time of the tweet, the price of the DogeCoin was at $0.024; at the time of the alert, the price was $0.03 (+25%). The coin reached its first peak in price one hour later, touching $0.05 (+108%). Then, around the 4:00 UTC of January 29, the coin achieved $0.08 (+233%), its maximum price of the month.
(5)
February 4 at 8:00 UTC: This alert is also related to a tweet of Elon Musk. This time he posted a tweet that contained a meme portraying him as Rafiki from the Lion King—the animated movie, standing on Pride Rock and raising a Doge-headed Simba [
37]. In this case, our detector captured the abnormal market movements 13 minutes after the tweet was posted (i.e., the very first chunk computed after the tweet). Unlike the previous tweet, this one got much more attention, with more than one million likes on the social network, and the market reacted faster. In this case, our classifier detected the event when the price of the DogeCoin was at $0.04, while the coin reached its price peak at $0.06, almost one hour later.
5.3.3 The Ripple Pump.
Again, for the Ripple crowd pump, we run our classifier on all the transactions closed on the Binance exchange from January 1 to February 10, 2021. In the considered time frame, the detector raises the following four alerts:
(1)
6 January, 2021, at 14:40 UTC: To the best of our knowledge, this alert is not related to the Reddit community. Instead, the news that a petition to the White House to stop the SEC lawsuit against Ripple hits 35,000 signatures [
16] probably caused new trust in the XRP coin. The price went from $0.23, at the moment of the alert, to $0.37 (+38%) the following day.
(2)
19 January, 2021, at 5:50 UTC: This is the exact moment when several exchanges, including Coinbase, the
\(3{^{th}}\) exchange by volume of transactions, delisted XRP from the trading pairs [
60]. The delisting follows the SEC lawsuit. Two hours after the alert, we record an abrupt rise in transaction volume on Binance and the price from $0.29 to $0.33 (
\(+9\%\)). The alert is probably due to trading bots or investors that moved their assets from one exchange to another.
(3)
29 January, 2021 at 5:00 UTC: This is when we noticed the excitement in the “OFFICIAL BUY & HOLD XRP” group, with the members of the group that start to urge to buy the coin. As we discussed in Section
5.2, the users’ excitement comes together with the beginning of the XRP rally.
(4)
30 January, 2021 at 16:00 UTC: For this alert, we do not have clear evidence of what triggered the event. However, in the hour before this alert, the Ripple cryptocurrency starts to hit the news, becoming one of the most searched words worldwide on Google [
13,
35]. At the same time, the number of posts on Reddit about the Ripple cryptocurrency increased dramatically. Driven by the news, an odd number of investors may have joined the market and started to buy in a rush the currency to avoid missing a good profit opportunity, triggering our detector.
It is important to note that when the pump was scheduled (February the 1st, 2021, at 13:30 UTC), the detector did not raise any alert. This is not surprising since, as discussed before, the pump failed [
32]. Thus, the classifier detected the start of the pump two days before, catching the users that bought the coin in advance.
Looking at the results we achieved, we believe that our first attempt to build a classifier to detect crowd pump events shows excellent results. Nonetheless, we could further improve our detector by combining features from social media and related to the market exchanges’ financial transactions.