Fake Demand, Real Losses: How Popular Crypto Schemes Work

In the crypto market, not every green chart or active order book indicates genuine demand. Behind them may lie artificial volumes, fictitious orders, or coordinated price pumps. Such tactics are sometimes presented as entirely legitimate earning strategies, although their use can lead to account bans, while other traders may incur losses due to misleading signals. How can one distinguish a permissible strategy from manipulation or rule circumvention and avoid becoming a participant in a scheme or its victim? Let's break down the mechanics of several common practices.

Wash Trading: Why Traders Trade with Themselves

Wash trading is the execution of artificial trades between controlled accounts or participants acting in collusion. Buy and sell orders appear in the trading feed, but the actual owner of the asset does not change, or the trades are coordinated to simulate independent trading. This practice is used to create the illusion of high liquidity, boost a token in rankings, or inflate turnover for trading bonuses and contest prizes.

For an individual user, the temptation may lie in the calculation of receiving more rewards from the platform than will be spent on fees. In user guides, this practice may be presented as a way to improve one's ranking among traders. However, the publication of such advice does not imply its permissibility: for example, in the rules of the Binance Alpha contest, wash trading is explicitly stated as grounds for disqualification from rewards.

The consequences of this practice have two dimensions:

• For the trader themselves — account and funds blocking. OKX's terms prohibit wash trading and allow for restricting or terminating account access, blocking transactions, or freezing funds upon detection or reasonable suspicion of such activity. The VIP Referral Program rules from Bybit provide for the cancellation of rewards for wash trading and the right to suspend or close related accounts without notice.

• For the rest of the market — a misleading perception of liquidity. The inflated volumes create a false sense of confidence that an asset can be easily sold. However, the history of artificial trades does not guarantee the presence of independent buyers at the moment of exiting a position.

At the same time, a high frequency of trades is not a violation in itself: a trader can buy and sell an asset many times to independent market participants. The problem arises when trading is deliberately simulated through one's own accounts or agreements with others. In the U.S. securities market, trades without changing the actual owner, aimed at creating the appearance of trading activity, are also prohibited manipulation.

Spoofing and Layering: Fake Signals in the Order Book

Spoofing is the placement of fictitious orders in the exchange order book to create the illusion of high demand or supply and provoke other traders into actions beneficial to the manipulator. When such orders are placed at several price levels, the practice is called layering. They are initially planned to be canceled before execution: they are needed to influence others' decisions, not for actual buying or selling.

For example, seeing a massive "buyer wall," traders may perceive it as price support and start buying. The manipulator uses this demand to sell their tokens at a better price, after which they remove the fictitious order. Buyers are left with positions opened based on support that did not actually exist. The mirror variant is the "seller wall," which encourages others to sell and helps the manipulator buy cheaper.

The risks of this practice:

• For the manipulator — account restriction or blocking. Weaker oversight of individual crypto markets does not mean permission for spoofing. For example, OKX Singapore explicitly prohibits spoofing and layering and allows for restricting traders' access. In the U.S. stock market, such manipulations are also prohibited and can lead to criminal liability.

• For other traders, deals based on false signals. The <> in the order book shows an order that can be canceled, rather than a completed buy or sell. If the decision relies solely on its size, expected support or resistance may disappear before the trade is executed.

At the same time, canceling an order is not in itself proof of manipulation: traders and market makers can legally adjust quotes according to the market. The constant disappearance of large orders before potential execution is a reason to be cautious and not rely on such <>, but it is not sufficient grounds to definitively establish spoofing.

Bonus and Airdrop Farming: When Multiple Wallets Become Violations

Farming is the practice of completing specific tasks (network testing, trading, topping up balances) to receive rewards: free tokens from new projects (airdrops) or bonuses from exchanges. Participation in such programs is entirely legitimate, as projects themselves allocate these budgets to attract real users.

The line of violation is crossed when a participant begins to circumvent the rules of the promotion. When one person creates dozens or hundreds of controlled addresses, passing them off as different independent users, this is called sybil farming. In training courses, this is often presented as <>, but the technical ability to manage a network of wallets does not mean it is allowed by regulations.

Using sybil schemes carries risks for both sides:

• For the farmer: costs for network fees, proxy rentals, and time have already been incurred, while rewards may not be credited after the final verification. For example, Optimism reported an additional exclusion of 17,000 addresses from the first airdrop after checking for sybil activity and redistributing 14 million OP among the remaining participants. Bybit also explicitly provides for disqualification for registering multiple accounts for bonuses.

• For the community: mass imitation of new users can reduce the share of rewards for other project participants.

At the same time, the mere fact of owning multiple wallets is not a violation, as this is a normal practice for risk diversification and security. The main caution concerns the artificial circumvention of the <> restriction.

Pump and Dump: When <> Become Manipulation

The essence of the pump and dump scheme lies in artificially inflating the price of a low-liquidity token to sell one’s positions to attracted buyers. Organizers accumulate the asset at a low price in advance, after which they call on the community for mass purchases and actively promote the token on social media. When the wave of demand from outside traders raises the price, the organizers discreetly lock in profits at their expense.

In closed channels, this is often presented as a <>, where participants are promised the opportunity to enter before the rest of the market. Technically, this resembles ordinary project marketing, and paid VIP access is sold under the guise of an advantage — a guarantee to learn the token's name before others.

The key difference from legal promotion lies in the conflict of interest and deception. Joint purchases, discussions, or advertising of an asset are not violations in themselves. Manipulation occurs when demand is artificially inflated, urging people to buy for further growth while the initiators are already exiting the asset.

For participants, there are two immediate risks:

• Exchange sanctions. Coordinated price inflation followed by the sale of the asset to attracted participants may violate rules against market manipulation. Bybit explicitly describes such behavior as a violation. Suspicious activity may trigger checks and temporary restrictions, while confirmed violations can lead to permanent account bans.

• Trading losses. The attempt to <> relies on the illusion of equal conditions. Organizers may have bought long before the signal and at a much lower price. When mass selling begins, there are not enough buyers at the current price, quotes fall, and exiting at the displayed price becomes impossible.

Even if a trader understands the mechanics and plans to "sell before others," they do not know the volume of the organizers' reserves or when they will start to exit. An early signal may only mean that it was received earlier than part of the group, but already after the initiators' positions have been formed.

Front-running and Sandwich Attacks: Profiting from Others' Trades

On decentralized exchanges (DEX), a transaction enters the public queue (mempool) before it is executed in a block. Special bots track such pending operations and try to execute their own transaction before the user to profit from the upcoming price change. This type of preemption is called front-running.

The most common variant of this is the sandwich attack. Upon detecting a large purchase of a token, the bot buys the same asset first by paying a higher fee, artificially raising its price. Then, the transaction of an ordinary trader is executed, but at a worse rate. Immediately after this, the bot locks in profit by selling the acquired tokens. The other transaction ends up being squeezed between the two operations of the attacker.

This mechanism presents the following risks:

• For bot creators and users: They operate on the principle of "code allows it," but there is no guaranteed income here. Profit depends on speed races with other bots and high network fees (gas). An unsuccessful attempt to intercept a transaction often results in a direct loss due to burned fees. Additionally, regulatory scrutiny of transaction manipulation in many jurisdictions is becoming increasingly stringent.

• For ordinary traders (financial losses): The main threat is purchasing an asset at a significantly worse price than expected. The level of loss directly depends on the slippage settings: the higher this tolerance, the more room the bot has to artificially pump the price at your expense.

At the same time, not every automated trading or MEV extraction is an attack—legitimate arbitrage between exchanges also falls under this category. The main difference of a sandwich lies in the deliberate worsening of conditions for a specific buyer. To protect against such attacks, traders should use private RPC nodes (e.g., Flashbots) and monitor acceptable slippage in wallet settings.

How Not to Become a Participant in the Scheme or Its Victim

Although there are many such schemes in crypto trading, they often repeat the same tricks: imitating demand and trading activity, circumventing reward acquisition rules, or profiting from the deterioration of others' trades. These signs should be noted when evaluating a new "earning strategy," trading bot, or signal from a channel.

To reduce the risk of reward cancellation, account blocking, fund freezing, or liability for manipulation, it is essential to clarify where the profit comes from and whether the mechanics comply with platform rules and the law before using a strategy or bot. Particular attention should be paid to offers that imitate demand, conceal connections between accounts, or repeatedly receive rewards intended for one participant. The presence of a tutorial guide, advice from a popular trader, or successful examples does not confirm the legitimacy of such actions.

The next step is to check the rules of the specific platform. Permission for bots does not automatically extend to any of their behavior, and the ability to create sub-accounts does not imply the right to trade between them for artificial turnover. If the conditions leave questions, it is better to obtain written clarification from support before launching a strategy and depositing funds.

To protect against others' manipulations, it is important to verify what lies behind an attractive trading signal. The following may raise suspicion:

• High volumes with low liquidity. The turnover looks significant, but even a moderate transaction can significantly shift the price.

• Large orders that regularly disappear before execution. Visible support or resistance may not hold even with price approaching.

• Short bursts of activity without continued demand. An initial spike does not yet confirm the sustainability of the movement.

• Coordinated calls to buy on countdown. Especially if the early signal is sold separately, and participants are encouraged to attract new buyers.

Such signs should be evaluated together, comparing the order book with executed trades and price behavior. On decentralized exchanges, it is additionally important to monitor acceptable slippage and check the possibilities of securely sending transactions: a correct buying decision does not protect against unfavorable execution.

A separate missing order or an unsuccessful breakout does not prove manipulation. However, to refuse a deal, it is not necessary to establish someone else's intent. It is sufficient that the source of the promised profit is unclear or the decision depends on a signal whose reliability cannot be confirmed. Add as a desired source in Google