Binance Spoofy Bots Cause Mass Liquidations

Price Manipulation Bots Caused Mass Binance Liquidations on 26 July 2021

The class actions against Binance for irresponsible behaviour leading to mass long and short liquidations on 19 May 2021 are in progress so I will not be posting about that today. Instead, this blog takes a deep dive into a similar but less complex sequence of events on 25-26 July 2021. My evidence is based on analysis from real-time recordings of Binance order books. Many thanks to Coinstrats for providing the data and for such brilliant charts to support the graphical story telling here. Many thanks also to my colleague and trader friend Sam Baker, an expert in market abuse, for some very helpful comments.

Matt Rainger’s blog also analyses Coinstrat’s data but on the inverse BTC-USD futures, which are margined in BTC not tether (USDT). However, the tether flows of 300 million USDT to Binance just before the event would have been used on the tether-margined (direct, linear) perpetual, which I analyse here. The tether perpetual shows much stonger eveidence of manipulation than the inverse one and I also present evidence of this manipulation precipotating the mass liquidation event.

A Graphical Analysis

A picture tells a thousand words, they say, and Coinstrats pictures really are something to write about. So, before I blog about any background story, reasoning or supporting links and papers, let me just annotate and present their series of charts, following the leading picture of this blog which is more kind of pretty but not so much the focus of this story…...

Figure 1: Binance BTC Direct and Indirect Perpetual and Spot Prices 25 July 23:00 to 26 July 03:00 UTC

The manipulation of the direct (tether) perpetual spills over into the indirect perpetual and spot prices where the price effect is much lesser. Figure 7 shows that liquidations are also much greater on the tether perpetual.

Figure 2: Price Dislocation for 10mins from 01:00 to 01:10 UTC

The perpetual price spikes as the ask side of the order book collapses completely once the Binance insurance fund ceases to trade at 01:03. Since liquidations are less on the inverse perpetual and spot, their prices are not so chaotic.

Figure 3: Order Book Dynamics of BTC-USDT Perpetual for 15mins from 00:50 to 01:05 UTC

The price starts at about 36,000 USDT and rises normally until about 01:01 when it is pumped up to around 40,000 in less than 2 minutes. The entire order book prices are depicted with the size of the marker proprtional to the order size at that price. Sometimes it seems there are asks in the bid side of the book and conversely, but this is likely due to granularity issues. That is, the ticker price was actually above the bid and below the ask, but the market moved so fast that even 1/1000 millisecond granularity could not capture this properly. The shaded area is zoomed into on the next graph.

Figure 4: Order Book Dynamics of BTC-USDT Perpetual for 5mins from 01:00 to 01:05 UTC

Unusual activity at around 01:35 precipitates a series of price rises until the order book breaks down in chaos less than 2 mins later. The ticker moves so rapidly up and down that bids appear above asks and conversely. It may also be that the large orders at 01:02 were real bids above the ticker, in which case they would have eaten all the asks below that price, thus thinning out the ask side and moving the ticker up further. The shaded areas are analysed in more detail in the next two plots.

Figure 5: Order Book Depth of BTC-USDT Perpetual for 15 Seconds from 01:00:30 to 01:00:45 UTC

Ask volumes escallate on very tight trading. Clear evidence of spoofing between 01:00:33 and 01:33:34 but price impact is small. Then, at 01:00:35 a classic layering strategy starts on the ask side while the market price (left-hand scale) remains constant for more than 1 second again in very tight trading. The volume is measured 10 price levels deep into the book, although layering may have been even deeper than this. At 01:00:36 the layers are cancelled all at once and the release of sell-side pressure allows bids to move rapidly up the price ladder as spreads widen.

Figure 6: Timeline of Long and Short Liquidations on the BTC-USDT Perpetual Contract

As the price shoots up following the layering release, short positions are liquidated in rapid succession and so more and more shorts are taken over by the Binance Insurance fund trading bots, who will need to clear them in the open market. But they have no obligation to do so immediately … and they may have learned from the events of May 19 that is it better to switch off the bots on one product than to close down their entire futures platform.

Figure 7: Cumulative Short Liquidations on Binance Direct and Inverse Perpetual and Prompt Futures

Liquidations of the direct perpetual shorts started with the ask-side spoofing before 01:00 but then, shortly after the massive layering strategy was lifted from the perpetual, liquidations spilled over into similar positions on the inverse perpetuals but there is little effect on either of the prompt futures contracts. Cumulative liquidations on the direct perpetual reached almost 3 million USDT whereas those on the Inverse were less than 1 million USDT (using a 1:1 conversion rate here for simplicity).

Read on now for my story…..

A History of Mass Liquidations

Table 1 provides a chronology of mass BTC liquidation events over the last two years. Most affect long positions (in green) rather than short positions (in red). This is not surprizing because most happened in 2021, as retail investors were drawn into long positions hoping to profit from the BTC price bubble starting at the end of 2020. But our event on 26 July 2021 is notable as one of the largest market-wide short liquidation events.

Table 1: Mass BTC Liquidation Events with Aggregated Volumes over All Exchanges.

A position is automatically liquidated by the exchange if there is no collateral in the margin account. Many exchanges allow 100X leverage in which case the margin is tiny and the investor must continually monitor their account to avoid unintentional liquidation of their position. Total short liquidations over all exchanges and all BTC-USD and BTC-USDT futures are in light red for 2020 and dark red for 2021 and long liquidations are in light green for 2020 and dark green for 2021, with apologies if you are colour blind. The 26 July short liquidation event is picked out in bold. Liquidations are underreported on Binance. On 26 July they reported just 10% of the total liquidation volume yet trading volume on Binance accounted for 50% of total trading volumes on BTC futures over all exchanges in July 2021. Sources: CryptoQuant and TheBlock.

Why Binance?

Products: There are hundreds of linear and inverse BTC futures contracts available on multiple centralised and decentralised exchanges.[1] But the undisputed king of these is the Binance tether perpetual, which is a linear (also called direct) product that is margined and settled in USDT. Like other perpetuals, the Binance tether perpetual does not expire. It is tied to the spot price using a funding rate mechanism which is depicted in Figure 9. Alexander, Heck and Kaeck (2021) show that almost all volatility transmissions to other exchanges have been coming from this product since the beginning of 2021, see Figure 8. Red are flows from the direct (USDT) perpetual and black are flows from the inverse (BTC margined) perpetual. Obviously, the king influencer is the tether perpetual. Disruptive strategies aims to create volatility on this product spillover to all other products, where trades have probably been set to profit from the tether perpetual manipulation. In July 2021 Binance futures trading volume was a little over 1 trillion USD, almost exactly half the total trading volume on all BTC futures that month. This paper also shows that Coinbase, not Binance, is the main volume transmitter.

Figure 8: Volatility flows between Main BTC Instruments

The figure shows the magnitude of volatility flows between six major BTC-USD instruments including: Coinbase spot (CB); Binance spot (BI Spot); Huobi spot (HU); Binance tether-margined BTC perpetual (BI USDT), Binance USD perpetual (BI USD) and Bybit USD perpetual (BY). The flows are estimated using a multivariate LogMEM on the five-minute realised volatility between 1 January and 31 March 2021. The parameters that are not significant are set to zero. The direction of flow is indicated by its colour, and the size is proportional to the width at its origin or destination, these being equal. Our findings suggest that trading bitcoin against tether on Binance is the main source of volatility. Binance’s indirect USD perpetual emits much less volatility and mainly receives flows from the tether-margined product.

Traders: Professional manipulators are informed by many signals. They monitor news and when a bitcoin-relevant piece hits social and mainstream media they watch Coinbase volume growth, looking for signals about the direction of herding from the retail (uninformed) crowd. When the signal has a strong enough direction, they initiate a manipulation event on exchanges where their activities are not yet regulated, especially on Binance – not only because it is the BTC price leader but because it has the least toxic flow. In other words, Binance has much the greatest proportion of uninformed traders for the informed traders to exploit. Also, if the intention is to profit from trades set up on other exchanges, Binance is the most reliable ground on which to play this sport; price manipulation on Bybit, Huobi or any other less informative BTC derivatives platforms would be less sure of spreading systemically.

Bear Signals Before the Event

Binance funding rates are the sum of a very small positive interest and a premium determined by the difference between the perpetual and spot prices. When the premium is positive so is the funding rate, meaning the long contract holder pays the short contract holder, and the payment goes the other way when the funding rate is negative, which only happens when the premium is negative and larger than the interest rate, so most of the time it is positive. But the events of 19 May 2021 precipitated the first negative funding rate for six months, because the BTC price dropped nearly 40% at one point in time on that day. Unusually, between 20 June and 25 July, the funding rate was negative most of the time, indicating a situation called ‘backwardation’ where the spot price was above the futures, and which is normally taken as a bear signal in commodity markets.

Figure 8: Funding rate on Binance’s BTC-USDT perpetual.

The rate determines the payment from long to short perpetual positions. It is positive when the perpetual price is above the spot and negative when it is below the spot. Negative funding rates (in red) occurred after the 12 March 2020 pandemic crash, and at a few other times before July 2021 but mostly the funding rate is positive (in green). There is a significant correlation between the funding rate and the return on the BTC perpetual with large positive returns and high positive funding rates both present in strong bull markets.

Pump-and-Dump

However, something happened on July 25 to change this bear market perspective and present an opportunity for professionals to make a play on retail investors’ exuberance to buy BTC. They did this using a super-rapid pump-and-dump on Binance executed using a series of layering and spoofing.[2]

This event was more complex than a stock pump-and-dump in terms of trade execution, but it had one thing in common with stock pump-and-dumps – in that it was based on false rumours. Specifically, a piece of fake news about Amazon accepting bitcoin payments which provided a signal to professional manipulators that a pump-and-dump on Binance would be highly profitable. The Amazon rumour was spread by CityAM who misinterpreted a Business Insider story about Amazon developing a blockchain. Then the story was amplified on Twitter and Reddit and finally broadcast widely by reputable crypto news outlets such as Cointelegraph.

Follow the Money

I was alerted to July 25-26 by a rapid sequence of whale alerts on tether transfers to Binance. Between 16:00 and 20:00 UTC on Sunday 25 July, the same time as the fake news about Amazon was spreading, more than 300 million USDT was moved onto Binance.[3] A pump-and-dump starts by opening a very large, long BTC position, which needs a lot of tether (USDT) even with 100X leverage.[4] Starting soon after 16:00 our professional manipulator(s) purchased BTC on Binance in an orderly fashion to avoid slippage.[5] This way, the price remained stable at around 34,000 USDT until the manipulation began at around 01:00 UTC on Monday 26 July.[6]

Spoofing and Layering

Open-source market making software such as Hummingbot can easily be programmed to manipulate prices by spoofing and layering. It is illegal in traditional markets, but not on Binance. Spoofing refers to a single order which is quickly cancelled before being filled, typically at the best ask (sell) or bid (buy) price. Spoofing can also occur inside the spread, just above the best bid or below the best offer.

Layering is a series of spoofs whereby multiple orders are placed just inside one side of the book along a ladder of successively higher (layering offers) or lower (layering bids) prices. The intention is to create the impression of order book imbalance, where demand pressure is much greater on one side of the book. This pressure moves the market price towards the first rungs of the ladder, at which point the order is cancelled so the price moves to the next rung and so on. The layered orders are successively cancelled as the market price moves towards them.

A sign of bid-side layering is a sudden jump up in volumes just below the best bid followed by a cascade of cancellations at which point the market price moves down through the ladder. A sign of offer-side layering is a sudden jump up in volumes just above the best ask followed by a cascade of cancellations at which point the market price moves up through the ladder – this is what happened on Binance in the early hours of 26 July 2021.

This was one of the fastest pump-and-dumps we have seen on Binance. The perpetrator(s) closed their positions out, leaving the order book in chaos with uninformed traders wondering what just happened. After a few minutes both the price and the basis reverted to normal, albeit at a higher price than before the squeeze, at least until Amazon officially denied the CityAM claim.

Final Reckoning

From the tether whale alert evidence is it clear that a large amount of USDT was used to buy the tether perpetual mostly between 20:00 and 24:00 UTC on Sunday 25 July with trade sizes and times distributed so as not to move prices with too-large orders. This way the price paid would have been around 34,000. The actual position taken depends on the amount leverage used, and the profits depends on the exit price. For instance, Table 2 exhibits a few realistic scenarios, with different trade volumes, and exit prices and with leverage 5, 10, 50 – but leverage could actually have been much higher than this. Anyway, these scenarios show profits well in excess of 1 billion dollar, for a few minutes' work.

Table 2: Scenarios for Profits Made from 26 July Manipulation

Three realistic scenarios showing potential profits depending on trade size, leverage and exit price.

Finally, let me state my views on crypto derivatives exchanges that act as their own clearing house.[7] There is nothing intrinsically wrong with an automatic liquidation process or any of the other operational processes associated with an exchange operating as a clearing house ….. provided the exchange understands this complex business well enough to protect their clients. But there are two issues with Binance: (1) It does not offer its own clients sufficient protection against professional traders running market-making spoofing bots that would be against the law on properly regulated exchanges; and (2) this manipulative activity on Binance spills over into other exchanges so that Binance now presents a systemic risk to the entire crypto asset ecosystem.

Carol Alexander

17 January 2022

Notes:

[1] The BTC-USD products are usually inverse futures, so called because they are margined and settled in BTC, whereas the BTC-USDT (or BTC vs other stable coin) direct products are linear -- like normal futures, except they are margined an settled in USDT (or another stable coin).

[2] A pump-and-dump starts with taking a very large, long position then artificially making the price inflate before selling at the top of the market.

[3] See, for instance, TRON transfers of 58 million at 16:56 , 67 million at 20:18 and several more in short succession documented on Matt Rainger’s blog.

[4] Leverage could have been up to 125X on the inverse products and 100X on the directs, see this blog.

[5] The term ‘slippage’ refers to the movement of price when an order is so large that it must eat into the order book in order to complete. Slippage on a large buy order would mean that it fulfils at higher and higher prices. Similarly, on a large sell order the ticker price would drop and drop until the order is complete. By contrast, orderly trading breaks an order down into smaller orders that are of the ‘normal’ size for the market, and this size depends on the liquidity as measured by order-book depth just either side of the ticker.

[6] During the night, traders tend to grab some sleep and let their bots manage alone, albeit after setting alerts. Alexander, Heck and Kaeck (2021) show that volumes on all exchanges drop immediately after the funding rate payments at 00:00 UTC and remain low until 12:00 UTC when the East Coast starts trading. Low volumes enhance the effectiveness of spoofing and layering because order books are less resilient to unusually large orders, making it easier to manipulate prices.

[7] See another blog for details on the clearing-house activities of Binance.