OAK — OnChain Attack Knowledge

Worked example · 2024-02

Blur points-farming wash-trading ring — coordinated circular NFT trades across linked wallet clusters — Ethereum — 2023–2024

Loss
structural — the wash-trading ring inflated Blur's marketplace volume metrics, distorted collection-level floor prices and leaderboard rankings, and extracted BLUR token rewards through manufactured trading activity. The dollar-denominated extraction is primarily the BLUR token rewards earned through artificial volume rather than through legitimate liquidity provision; the secondary loss is to real buyers who entered collections at prices anchored to wash-inflated volume and floor metrics. A precise dollar figure at the ring level requires per-cluster forensic accounting; the cohort-scale estimate is that a material fraction of Blur's Season 1–3 BLUR token emissions (hundreds of millions of dollars in notional value at the token's peak) was captured by wash-trading clusters.
OAK Techniques observed
OAK-T12.001 (NFT Wash-Trade Volume Inflation — the coordinated circular-trade ring sub-pattern: a cluster of related wallets repeatedly transacts the same NFTs among themselves at escalating nominal prices to inflate collection-level volume, manipulate leaderboard rankings, and farm marketplace token rewards). The incentive-farming sub-motivation (BLUR token rewards) is the dominant driver; the price-discovery-distortion sub-motivation (inflating floor prices to attract real buyers) is the secondary driver.
Attribution
pseudonymous — on-chain analysts (Hildobby / Dune Analytics, Nansen, bitsCrunch) have identified and published wash-trading cluster addresses. The clusters operate as pseudonymous trading rings; no named-individual attribution at v0.1.
Key teaching point
Marketplace token-incentive programmes that reward raw trading volume without wash-trade exclusion create a deterministic incentive for wash-trading rings. The Blur points-and-airdrop programme (Seasons 1–3, 2022–2024) rewarded traders proportionally to their marketplace volume and loyalty score. The programme's design — volume-weighted points without per-cluster wash-trade exclusion at the protocol level — made wash-trading rings economically rational: the expected BLUR token reward exceeded the gas + marketplace-fee cost of executing circular self-trades. The ring structure (multiple wallets trading among themselves rather than a single wallet trading with itself) was specifically designed to evade naive same-address wash-trade detection while preserving the volume-inflation effect.

Summary

Blur launched in October 2022 as a pro-trader NFT marketplace and aggregator with a novel token-incentive programme: traders earned "points" based on their listing and bidding activity, with points convertable to BLUR token airdrops across three seasons (Season 1: February 2023; Season 2: November 2023; Season 3: mid-2024). The points formula rewarded volume, bid depth, and loyalty (defined as trading exclusively or primarily on Blur), creating a direct economic incentive to maximise Blur-denominated trading activity.

A predictable consequence — documented extensively by on-chain analysts and NFT data platforms — was the emergence of wash-trading rings: clusters of related wallets that executed circular trades among themselves to inflate their collective volume and points. The ring structure exploited the gap between marketplace-level self-trade detection (which can block a single wallet trading with itself via the same marketplace contract) and cluster-level wash detection (which requires counterparty-graph analysis across the ring). A typical ring operated as follows: Wallet A lists an NFT at price X, Wallet B (funded by the same upstream source) buys it, Wallet B lists at price X+Δ, Wallet C (same funding cluster) buys it, and so on, with the NFT circulating among the ring members at escalating nominal prices. Each trade generated Blur volume and points for both sides; the gas and marketplace-fee cost was intentionally kept below the expected BLUR token reward.

The ring structure was the operational innovation relative to the earlier marketplace-incentive-wash patterns on LooksRare (2022-01) and X2Y2 (2022-02). Those earlier episodes were characterised by individual traders washing against themselves or a single counterparty — a pattern that is straightforward to detect via same-trader or same-counterparty heuristics. The Blur rings introduced multi-hop circular routing across 5–20+ wallets per ring, with wallet-level funding that obscured the cluster structure from naive detection. On-chain analysts (Hildobby's Dune Analytics dashboards, Nansen's NFT wash-trading flags, bitsCrunch's wash-adjusted volume metrics) identified these rings by reconstructing the counterparty graph at the collection level and flagging connected components with high internal trade volume relative to external (non-ring) counterparties.

Timeline (UTC)

When Event OAK ref
2022-10-19 Blur marketplace launches T12.001 (platform launch)
2023-02-14 Blur Season 1 airdrop; wash-trading ring activity surges in weeks preceding the snapshot as traders maximise pre-airdrop volume T12.001 (Season 1 wash surge)
2023-02 to 2023-11 Inter-season wash-trading rings continue operating; ring sophistication increases (larger clusters, more complex routing) as naive detection improves T12.001 (ring maturation)
2023-11-20 Blur Season 2 airdrop; second major wash-trading surge in the preceding window T12.001 (Season 2 wash surge)
2024-Q1/Q2 Blur Season 3; wash-trading ring activity moderates as BLUR token price declines and the expected reward-per-wash-trade falls below gas cost for all but the most efficient rings T12.001 (economic self-correction)
2024 onward Marketplace-level wash-trade detection improves (Blur introduces volume-leaderboard adjustments); ring activity persists at lower intensity on NFT AMM venues (Sudoswap) and aggregators T12.001 (ongoing, attenuated)

What defenders observed

  • Wash-trading rings are detectable at the counterparty-graph level, not at the per-trade level. Individual ring trades are indistinguishable from legitimate trades — the wallet addresses differ, the prices are within collection norms, the timing is not unusually patterned. The signal emerges only when the full counterparty graph is reconstructed: a connected component with high internal trade density, low external counterparty diversity, and a common upstream funding source. Defenders who monitored only per-trade or per-wallet heuristics missed the ring activity; defenders who ran per-collection counterparty-graph analysis surfaced it.
  • The ring structure is a rational response to marketplace incentive design. The ring's multi-wallet architecture was not gratuitous complexity — it was a specific adaptation to the marketplace's self-trade detection. Blur's contract-level checks flagged same-address buyer==seller patterns; the ring dispersed the wash across enough distinct addresses to stay below the detection threshold while preserving the volume-inflation effect. The operational lesson is that marketplace incentive designs that reward raw volume without cluster-level wash-trade exclusion WILL produce rings, and the ring complexity will scale with the detection sophistication.
  • Token-incentive wash self-corrects when token price falls sufficiently. The decline in ring activity between Season 2 and Season 3 was driven by BLUR token price depreciation: as the expected dollar value of the token reward per unit of wash volume fell, ring operators who could not achieve wash-cost efficiencies (low-gas chains, near-zero marketplace fees) became uneconomical. The self-correction was a market phenomenon, not a detection-and-enforcement success — the rings did not stop because they were caught; they stopped because the economics flipped.

What this example tells contributors writing future Technique pages

  • The Blur ring is the canonical T12.001 incentive-farming sub-motivation anchor. It extends the LooksRare (2022-01) and X2Y2 (2022-02) marketplace-incentive-wash examples by adding the multi-hop ring architecture, which is the operational state of the art for marketplace-incentive-driven wash trading. Contributors writing future T12.001 examples should preserve the distinction between single-counterparty-wash (LooksRare / X2Y2 era) and multi-hop-ring-wash (Blur era) as a maturity signal: the ring architecture reflects a more sophisticated detection-evasion posture.
  • Counterparty-graph analysis is the load-bearing T12.001 detection signal. Per-trade and per-wallet heuristics are necessary but insufficient — the ring structure defeats them by design. The load-bearing detection signal is at the collection-level counterparty graph, and the ring is surfaced by connected-component analysis weighted by internal trade density.

Public references

  • [hildobbyblur2023] (proposed) — Hildobby's Dune Analytics dashboard on Blur wash-trading and points-farming activity; the primary community-analyst source for per-ring volume attribution.
  • [nansenblur2023] (proposed) — Nansen's NFT wash-trading research including Blur ring-activity cohort metrics.
  • [bitscrunchblur2024] (proposed) — bitsCrunch's wash-adjusted Blur volume metrics; per-collection wash-trade-rate reporting.
  • [blurpoints2023] (proposed) — Blur's published points and airdrop programme design; the incentive formula that the ring exploited.
  • [chainalysis2022nft] — cohort-scale NFT wash-trade characterisation (2021 data); the marketplace-incentive wash sub-class framing that the Blur ring extends.

Discussion

The Blur wash-trading ring cohort is the canonical T12.001 incentive-farming sub-motivation example at the ring-architecture maturity level. It extends the LooksRare and X2Y2 marketplace-incentive-wash examples by documenting the multi-hop ring structure that emerged as the dominant operational pattern once marketplace-level self-trade detection made single-counterparty wash uneconomical. The structural lesson — marketplace token-incentive programmes that reward raw volume without cluster-level wash-trade exclusion deterministically produce rings, and the ring complexity scales with detection sophistication — applies to any marketplace that designs a volume-weighted loyalty programme.

The Blur ring case also anchors the argument for wash-adjusted volume metrics at the marketplace and analytics-platform layer. The ring's trades were included in Blur's published volume and leaderboard rankings; a wash-adjusted volume metric that excluded cluster-internal trades would have presented a materially lower (and more accurate) picture of organic marketplace activity. NFT analytics platforms (Nansen, bitsCrunch, DappRadar) increasingly publish wash-adjusted volume metrics, and the Blur ring case is the operational motivation.

For OAK's year-coverage and T12.001 coverage strengthening, the Blur ring example provides a fourth T12.001 worked example and extends the T12.001 year coverage from 2022–2023 into 2024, filling a chronological gap in the T12.001 example record.

Techniques demonstrated (1)