Us vs. Markus & Willy

Recently a group of researchers from The University of Tulsa and Israel’s Tel Aviv University wrote a report titled “Price Manipulation in the Bitcoin Ecosystem.” This 26-page report takes a look the Bitcoin/USD(BTCUSD) exchange rate from between February and November 2013. Their research is centered on identifying and analyzing the impact of suspicious trading activity (STA) on the Mt. Gox Bitcoin currency exchange during those 9 months mentioned. If you aren’t familiar with Mt. Gox just know that the Japanese exchange closed in February 2014 but previously handled over 70% of global bitcoin transactions before they began liquidation proceedings due to an April 2014 bankruptcy filing because they lost 600,000 bitcoins. I think now might be the time to let everyone know that Mt. Gox was started as a trading exchange for cards from the game Magic. The name Mt. Gox is actually an acronym for Magic The Game Online eXchange and was only converted to bitcoin trading because the domain name was already purchased and the market for Magic cards is good where it’s at.

The information uncovered in this report isn’t the most unique but it sheds light on the dark crypto-currency world that lurks behind the bright, chart displaying exchange software company’s use to attract their customers. It’s also organized and presented in a way that clearly underscores the how dangerous the crypto-currency markets can be to those who are not aware of the markets they’re entering. Besides the fact that all crypto-exchanges are OTC, most customers are retail traders with no experience trading any other type of asset. In other words, they don’t even know how an electronic exchange should work; the rules, parameters and expectations of users and the system.  These exchanges are working like equity dark pools for an asset that has no intrinsic purpose for customers that have no background or training in the fields.

These researchers went through the public blockchain data along with leaked transaction history from the Mt. Gox data dump that happened in early 2014 and discovered that just two traders were responsible for the rise in bitcoins price during the 9 month period studied. During this time the price of Bitcoin rose from roughly $105 to $1000 and 2 traders were responsible for nearly 40% of the total market volume. The two traders are referred to as Markus and Willy. They aren’t actual people but “bots.” For those that aren’t familiar with the word “bot”, know that they are also known as Internet bots and are software applications that run automated tasks over the internet.

Markus was actually a group of users who traded bitcoins on the Mt. Gox exchange that never paid transaction fees and paid seemingly random prices for bitcoins. This was all from a single userID and Markus made duplicate transactions in which the amount paid was changed from a random price to one that was consistent with the day’s price range. Markus was active for 225 days which he only traded 33 days. Markus acquired a total of 335,898 bitcoins during his active trading time. It appears that the bitcoins acquired were not purchased. Markus became inactive September 27, 2013.

Willy was a different case entirely because this group of trader bots only bought bitcoins on the Mt. Gox exchange. During the 65 days between the first day becoming active and the last day available for research, Willy trades were made on 50 of those days. While Markus used a single userID to manage trading activity Willy used 49 separate accounts. Only 7 hours and 25 minutes after Markus became inactive, Willy became an active trader on Mt. Gox. From each of the 49 accounts, buy orders were placed for $2.5million worth of bitcoins; once the order was filled the account became inactive. This cycle continued until all 49 accounts were inactive.

Now that we have the backstory let’s take a look at some evidence we’ll refer to as red flags. Upon further research into the user IDs and account IDs it was clear to see that there was some foul play at work. The manipulated duplicate records that are associated with Markus are a red flag. The sequential use of accounts and proximity to Markus a red flag for Willy. And for both bots, their accounts’ IDs don’t match account IDs for the users of Mt. Gox during that time period. Normal accounts for this time period had IDs that capped around 650000 where the bots had IDs in the range of 658152-832432. Additionally, trading API reports for Mt. Gox suggests that during offline periods only one user’s transactions were being processed at the time. While everyone else was unable to access accounts and money Willy was able to trade uninhibited for 90 minutes buying 10-19 bitcoins every 6-20 minutes. Willy was able to acquire 268,132 bitcoin for a little less than $112 million.

Together Markus and Willy “acquired” a total of 604,030 bitcoins which is very close to the 650,000 bitcoins that Mt. Gox claims they lost. These two users were able to obtain user IDs that were so different it wasn’t hard to pick them out. They were allowed access to markets when no other users were able to do any transactions. Let’s not forget the nominal accounting system that most digital financial networks use; Companies may not actually have in cash what they put in their systems. This all smells fishy. It isn’t a reach to say that this sounds like an inside job. Who else would have the authority to give user’s unique IDs, or access to markets when access is being denied to others. It appears that there was a mindful attempt to manipulate data and change Markus’s balance. And how do we explain Willy and the 49 accounts sequentially buying $2.5million worth of bitcoins and never selling? This sounds like someone was trying to create money through making “fake” trades that exploited Mt Gox’s systems to let account get credited without making the offsetting entry to any other account. Something only an internal employee could have access to and do. This was a very informative post and I hope it leads you to make good investment decisions.

These traders’ had impacts on other exchanges as well. It is shown that not only was Mt. Gox manipulated by Willy and Markus but Bitstamp, Bitfinex and BTC-e were all exchanges that saw the price of BTCUSD affected by the traders. Similar to when the STA was occurring Mt. Gox saw an increase in BTCUSD prices these prices rolled over in to the other exchanges creating differences in opening prices for the pair on different exchanges. With the right tools someone would be able to sell in to those markets taking advantage of the markets even more by creating arbitrage situations. At this point I think I should have named this article The Finesse or Racketchain.

For the last year I have been working with individuals and businesses managing their crypto-currency portfolios. I help them mitigate risk and create revenue from risks. They look to me for advice and clarity on the markets they trade and the assets they own. Not one of my clients would have been able to save themselves from something like this. Not only were the trusted market hosts taking advantage of their guests they were manipulating the market as a whole which sheds a light on the work that’s still left to do in the currency markets to improve the infrastructure.