Worked example · 2017-01
Big Pump Signal Telegram / Discord coordinated pump-and-dump cohort — multi-CEX (Binance / Cryptopia / Bittrex) — 2017–2018 (canonical academic anchor); cohort recurs through 2024
Summary
Through 2017–2018 a cohort of public Telegram and Discord channels — among them Big Pump Signal (BPS), VIP Signal, Crypto Bullets, Pump King's Community, Gold Pump Signal — established the canonical coordinated-signal-group pump operating model:
- The channel announces a future pump event via a countdown message ("PUMP IN 24 HOURS"), naming the venue (typically Binance, Bittrex, or Cryptopia) but not the target coin.
- The target-coin announcement is published at the pump-time minute as an image / capitalised text designed to defeat OCR-based exchange surveillance ("BUY $XYZ NOW").
- Channel members race to buy the announced coin; the resulting demand surge produces a sharp price spike on rising volume.
- The coordinators — who acquired position in the target coin during the accumulation window before the announcement — exit into the demand surge during the peak window.
- The price collapses within minutes-to-hours as the demand surge exhausts and downstream sellers exit.
The May 10, 2018 BPS pump of SingularDTV (SNGLS) on Binance is the canonical anchor: announcement at the pump-time minute generated approximately 5,176 BTC of trading volume during the pump window — the largest single-pump volume in the public record at that time. The cohort recurred at scale: Hamrick et al. documented 3,767 Telegram-advertised pump signals + 1,051 Discord-advertised pump signals over a six-month 2018 measurement window, promoting >300 cryptocurrencies; Xu and Livshits documented 412 Telegram pumps over June 2018 – February 2019. The cohort-level structural finding from both studies: pumped coins experience a modest positive price impact during the pump window — higher for less popular coins and for "brazen" pumps that openly state the pumping intent — but the price impact decays within a short post-pump window, leaving downstream entrants with realised losses.
The Big Pump Signal channel itself reported >200,000 Telegram members + ~250,000 Discord members at its January 2018 peak. The channel organised at least 41 documented pump events during the public measurement window (36 on Binance, 5 on Cryptopia). BPS subsequently lost prominence as the cohort fragmented into smaller channels, exchange surveillance improved, and venues delisted thinly-traded altcoins favoured by the pump cohort.
Why this is structurally novel
The 2017–2018 BPS-class cohort is OAK's earliest worked example of a coordinated-signal-group pump-and-dump operating at industrial scale, and its academic measurement is the calibration anchor for T3.003's Telegram-coordinated sub-pattern. Three structural features distinguish this cohort and motivate its anchor status:
The channel-as-coordinator topology is the structural primitive. The pump operator is not a deployer-author (as in T1 / SafeMoon-class cases) and not a promoter-cohort with off-platform reach (as in celebrity-shill / HAWK-class cases). The operator is the channel-administrator cluster — a small group with administrative control over a high-membership Telegram / Discord channel, who use the channel's broadcast reach as the coordination surface. The structural feature that makes the topology durable is the information-asymmetry within the channel itself: the administrator cluster announces the pump after they have already accumulated position; the channel members race to buy after the announcement; the administrator cluster exits into the demand surge. The asymmetry is structural to the channel-administrator relationship, not to any specific token or venue.
The cohort is venue-portable. The same channel-administrator cohort coordinated pumps across Binance, Bittrex, Cryptopia, Yobit, and other 2017–2018 spot venues. The portability indicates that the structural primitive is the channel-coordinator topology, not the venue's market-microstructure — a finding that subsequently generalised to Discord, X / Twitter Spaces, and the Solana-bonding-curve coordinator cohorts (PumpCell, the Perseus-tracked 438-mastermind cohort). The venue-portability is also why exchange-side surveillance alone is insufficient: a venue that successfully pushes the cohort off its surface does not eliminate the cohort, only redirects it.
The academic measurement is what makes T3.003 calibratable. Both
[hamrick2019economics]and[xulivshits2018]published reproducible measurement methodologies with quantitative findings — pump-window price-impact distributions, post-pump decay shapes, channel-concentration distributions, exchange-concentration distributions. The 2024–2025 follow-up corpus ([bolz2024],[karbalaii2025],[fu2025perseus]) extends the measurement into real-time NLP detection, microstructure-based detection on CEX OHLCV, and graph-neural-network-based mastermind tracing. T3.003's Detection signals section is what it is precisely because this cohort generated a multi-paper academic corpus that calibrated the joint-series detection primitives.
Timeline (UTC)
| When | Event | OAK ref |
|---|---|---|
| 2017 (mid–late) | Telegram and Discord pump-and-dump channels emerge at scale; BPS, VIP Signal, Crypto Bullets among the high-membership early cohort | T3.003 (cohort genesis) |
| 2018-01 | BPS reports peak >200,000 Telegram members + ~250,000 Discord members | (cohort scale signal) |
| 2018-05-10 | BPS coordinates pump of SingularDTV (SNGLS) on Binance; |
T3.003 (canonical anchor event) |
| 2018-06 → 2018-12 | Hamrick et al. measurement window: 3,767 Telegram + 1,051 Discord pump signals advertised across the cohort, promoting >300 cryptocurrencies | T3.003 (academic anchor) |
| 2018-06-17 → 2019-02-26 | Xu and Livshits measurement window: 412 Telegram pumps observed; predictive model published | T3.003 (academic anchor — predictive detection) |
| 2018-11 | Xu and Livshits "The Anatomy of a Cryptocurrency Pump-and-Dump Scheme" first arXiv submission (revised through August 2019) | (academic publication) |
| 2019 | Hamrick et al. "Economics of Cryptocurrency Pump and Dump Schemes" CEPR working paper / SSRN | (academic publication) |
| 2019–2021 | BPS prominence declines as cohort fragments; Binance and Bittrex delist thinly-traded altcoins favoured by the cohort; smaller channels persist | (cohort evolution — venue surveillance pressure) |
| 2021-06 | The Doge of Wall Street ([lapuschkin2022dogewallstreet]) extends the 2018 measurement methodology with the larger 2018–2021 corpus |
(academic publication — cohort continuation) |
| 2021–2024 | Cohort migrates to Solana / BSC / Base bonding-curve memecoin substrates; coordinator-channel topology recurs at higher per-launch tempo | (cohort evolution — substrate migration) |
| 2024-12 | Bolz et al. ([bolz2024]) publish real-time Telegram-NLP detector trained on 2,079 historical pumps — direct successor to the 2018 measurement work |
(academic publication — real-time detection) |
| 2025-03 | Fu / Feng / Wu / Xu ([fu2025perseus]) publish Perseus GNN-based mastermind tracing across 2018–2024 corpus; identify 438 "masterminds" + 4,300+ accomplices, attributing ~$3.24T of manipulated trading volume during 2024 deployment window |
(academic publication — operator-cluster identification) |
| 2025-04 | Karbalaii ([karbalaii2025]) publishes Poloniex P&D microstructure cohort (~1,021 confirmed events) — CEX-side companion to the Telegram-side measurement corpus |
(academic publication — microstructure detection) |
What defenders observed
- Pre-event: the academic corpus identifies pre-pump-window detection signals — channel-membership growth bursts ahead of an announced pump, coordinator-side accumulation in the target coin during the 1–24-hour window before the announcement — but these signals require the defender to ingest the channel's message stream, which is typically open to channel members but not to outside surveillance. The signal is therefore load-bearing for inside-channel defenders (regulators, academic researchers) but not for outside-channel retail defenders. The Bolz et al. 2024 real-time NLP detector is the v0.x productionisation of the pre-event channel-monitoring signal.
- At-event: the joint-series price / volume / unique-holder-growth / cluster-outflow alignment is the load-bearing at-event detection primitive. The 2018–2019 academic corpus established the calibration: pumped-coin volume in the pump window is typically multiples of the coin's prior 24-hour median; price impact is highest for low-cap target coins; cluster-outflow timing leads price-decline by 5–60 minutes for the modal pump shape. The Karbalaii 2025 microstructure corpus extends the calibration to CEX OHLCV at minute resolution.
- Post-event: the post-pump price decay shape (exponential decay over hours-to-days, with floor-price typically below the pre-pump baseline) is the structural feature that produces the realised retail loss. The academic corpus characterises the decay shape across hundreds of events; the calibration is what permits T3.003's Detection signals section to specify lag-window thresholds rather than just qualitative claims.
What this example tells contributors writing future Technique pages
- Academic corpora are first-class citations for cohort techniques. When a Technique has a multi-paper academic measurement anchor (as T3.003 does for the Telegram-coordinated sub-pattern), the corpus is the calibration source for the Technique's Detection signals section. Future cohort techniques should cite the academic corpus directly in Detection signals and reserve the Real-world examples section for events that anchor specific operating-model variations.
- The channel-coordinator topology is portable across venues and substrates. The 2017–2018 cohort, the 2024–2025 Bolz / PumpCell / Perseus cohorts, and the Solana-bonding-curve coordinator cohorts share the same channel-administrator-as-coordinator structural primitive. Future T3.003 sub-Technique splits should preserve the channel-coordinator topology as the load-bearing feature and split on the substrate dimension (CEX vs DEX vs bonding-curve launchpad vs cross-chain).
- Cohort-level attribution and per-incident attribution differ in v0.1. This case is
inferred-strong at cohort level, pseudonymous per-incident— the cohort exists with measurement-grade evidence, but no individual operator is publicly named. Future cohort examples should preserve this distinction: a Technique can be load-bearing in OAK without per-incident named-operator attribution, provided the cohort-level evidence is methodologically rigorous. - The retail-loss surface is structurally diffuse but the throughput is measurable. The case-shape "thousands of pump events, no single anchor loss number, but reproducible measurement of coordinator-side throughput" is the canonical cohort shape. Future cohort examples should record coordinator-side throughput metrics (pump events per measurement window, target coins promoted, cohort channel membership) where per-victim retail loss is unavailable.
Public references
[hamrick2019economics]— Hamrick et al. "The Economics of Cryptocurrency Pump and Dump Schemes" (CEPR DP13404 / SSRN; subsequently published in Information Processing & Management 2021 as "An examination of the cryptocurrency pump-and-dump ecosystem"). Cohort academic anchor: 3,767 Telegram + 1,051 Discord pump signals over six-month 2018 window across >300 cryptocurrencies.[xulivshits2018]— Xu and Livshits "The Anatomy of a Cryptocurrency Pump-and-Dump Scheme" (arXiv:1811.10109; USENIX Security '19). Cohort academic anchor: 412 Telegram pumps June 2018 – February 2019; predictive detection model.[lapuschkin2022dogewallstreet]— La Morgia, Mei, Sassi, Stefa "The Doge of Wall Street: Analysis and Detection of Pump and Dump Cryptocurrency Manipulations" (ACM TOIT 2023; arXiv:2105.00733). Extends the 2018 measurement to a larger 2018–2021 corpus.[bolz2024]— Bolz et al. "Machine Learning-Based Detection of Pump-and-Dump Schemes in Real-Time" (arXiv:2412.18848). Real-time NLP detector trained on 2,079 historical pumps; direct successor to the 2018 measurement corpus.[fu2025perseus]— Fu / Feng / Wu / Xu "PERSEUS: Tracing the Masterminds Behind Cryptocurrency Pump-and-Dump Schemes" (arXiv:2503.01686). GNN-based mastermind tracing across 2018–2024; identifies 438 masterminds + 4,300+ accomplices; attributes ~$3.24T of manipulated volume during the 2024 deployment window.[karbalaii2025]— Karbalaii "Microstructure and Manipulation: Quantifying Pump-and-Dump Dynamics in Cryptocurrency Markets" (arXiv:2504.15790). Poloniex CEX-side microstructure companion to the Telegram-side corpus.
Discussion
The 2017–2018 BPS-class cohort is the v0.1 academic anchor for OAK-T3.003's Telegram-coordinated sub-pattern and is what permits T3.003's Detection signals section to articulate calibrated joint-series detection primitives rather than only qualitative pattern claims. The cohort's structural primitive — the channel-administrator-as-coordinator topology — recurs through 2024–2025 across new substrates (Solana / BSC / Base bonding-curve memecoins) and new tooling (Telegram-NLP detectors, GNN-based mastermind tracing). The cohort's retail-loss surface is structurally diffuse — no single anchor loss number exists at v0.1 — but the coordinator-side throughput is well-measured.
The cohort case is also a methodological signal for future OAK contributors: the strongest T3.003 evidence in the public record at v0.1 is academic, not regulatory. Through 2018–2024, US enforcement against named Telegram-coordinated pump operators has been sparse — the McAfee CFTC complaint (examples/2021-03-mcafee-cftc-pump-dump.md) and the Operation Token Mirrors / NexFundAI sting (examples/2024-10-operation-token-mirrors-nexfundai.md) are the headline named-defendant cases through the v0.1 cutoff, and both target promoter / market-maker operators rather than channel-administrator coordinators. The channel-coordinator topology specifically is therefore primarily an academic-evidence class at v0.1; future regulator-side enforcement against named channel-administrator clusters would shift the per-incident attribution surface from pseudonymous to verified.
The cohort is structurally adjacent to the wash-trading-as-pump-signal-service sub-pattern (the Operation Token Mirrors cohort) but distinct in operator topology: BPS-class coordinators monetise channel access and signal-fee income and accumulate position in the target coin themselves; the market-maker / wash-trader cohort monetises fee-for-service from token issuers and runs the wash trades on behalf of a third-party token issuer. The two sub-patterns share the T3.003 joint-series detection signature but differ in operator-side fee model and in the regulator-side evidentiary chain.