Source-linked AI summary
Don't You Know, Pump it Up! Investigating Cryptocurrency Manipulation in Telegram-Driven Activity
Filipe Moura, Giordano Paoletti, Carlos H. G Ferreira, Jussara Almeida
TL;DR
The paper addresses the limited ecosystem-level evidence on Telegram-driven Pump-and-dump activity beyond known chats and selected cryptocurrencies. It applies a scalable framework combining semantic filtering, adaptive mention-burst detection, and RDD–DiD validation to large public Telegram and market datasets. The main result is a distinct temporal signature: manipulative activity precedes price peaks, although its language resembles organic discussion.
Problem
Existing studies usually examine known manipulation chats or limited cryptocurrencies, leaving Telegram’s broader role in coordinated Pump-and-dump activity insufficiently characterized.
Method
The framework classifies crypto-related messages, detects adaptive anomalies in cryptocurrency mentions, and validates social–market timing with RDD and DiD across public Telegram and market data.
Results
47 candidate Pump-and-dump events and 73 Sustained Market Reactions were identified, with manipulative social activity preceding price peaks by a median of 4.3 minutes while remaining linguistically indistinguishable from organic discourse.
Takeaways & Limitations
Temporal asymmetry, rather than message language alone, provides content-independent evidence consistent with Telegram-driven market manipulation.
Takeaways & Limitations
The analysis relies primarily on public Telegram channels, while initial orchestration likely occurs in closed private groups or channels.
Abstract
from arXiv · showhide
Telegram plays a pivotal role in cryptocurrency communication and has been repeatedly associated with coordinated schemes, such as pump-and-dump manipulation. However, existing studies typically focus on known manipulation chats or a limited set of cryptocurrencies, leaving open the question of how Telegram is leveraged for mass promotional activity (shilling) at scale. Moving beyond these limitations, this work analyzes the interplay between information flows and market activity across public Telegram channels. To this end, we propose a scalable framework that (i) classifies crypto-related messages using a fine-tuned encoder model to filter semantic noise, (ii) detects anomalous spikes in cryptocurrency mentions via adaptive thresholding, and (iii) validates temporal associations between social bursts and market movements using quasi-experimental econometric methods (RDD and DiD). We apply this framework to one year of public Telegram data (14,499 channels and over 20 million messages) aligned with transaction data for more than 17,000 cryptocurrencies. Our analysis identifies 47 events consistent with potential pump-and-dump activity and 73 sustained market reactions, showing that manipulative signals are characterized by extreme temporal synchronization and precede price movements by seconds. Notably, psycholinguistic analysis reveals that pump-and-dump messages are linguistically indistinguishable from organic discussions, highlighting the limits of text-based detection alone. Finally, we estimate the cumulative financial volume of detected pump-and-dump events to exceed $200 million and release a public cryptocurrency dictionary and a fine-tuned classifier to support future research.
Introduction
The paper addresses the lack of an ecosystem-level understanding of Pump-and-dump coordination across public Telegram channels and proposes a scalable framework to detect activity without predefined coins or chats.
- Research gap: Public Telegram channels remain insufficiently understood as an ecosystem for coordinating Pump-and-dump activity beyond known chats and visible assets.Prior studies commonly examine predefined cryptocurrencies or already-known manipulation chats.
- Research approach: The framework links Telegram information flows with cryptocurrency market data across channels and assets without prior assumptions about the coins or channels involved.The analysis also includes channels spanning diverse topical domains because crypto discussions occur outside explicitly crypto-focused chats.
- Research approach: The pipeline classifies crypto-related messages, detects anomalous daily mention increases using CA-CFAR, and validates candidate events with econometric analysis.The classifier addresses polysemous coin names that can produce false positives in keyword searches.
- Contributions: The study contributes a public dictionary covering over 18,704 cryptocurrency-related terms and 17,012 coins, alongside a classifier and labeled dataset of 2,923 Telegram messages.These resources are released to support future research.
Background and Related Work
Prior work documents Pump-and-dump manipulation across social and transaction data but generally restricts analysis to selected assets or known orchestrating chats. This paper broadens the ecosystem view to diverse Telegram channels and contrasts manipulation with organic market reactions.
- Pump-and-dump mechanisms: Pump-and-dump schemes select a target asset, coordinate high-volume purchases to inflate its price, and then sell, causing losses for later investors.Targets are typically low-capitalization and highly volatile cryptocurrencies.
- Pump-and-dump mechanisms: Telegram channels can coordinate synchronized message bursts that attract buyers and generate the trading volume needed for manipulation.The proposed hypothesis distinguishes private orchestration from public amplification that creates exit liquidity.
- Prior research: Existing studies use transaction data, social signals, or predictive models, but typically focus on limited cryptocurrencies, known chats, or selected platforms.These approaches include event detection, success prediction, and price-fluctuation forecasting.
- Research gap and distinction: This work identifies potentially targeted cryptocurrencies without preselecting coins, exchanges, or orchestrating channels, including relevant activity across diverse Telegram channel types.It also compares communication patterns during Pump-and-dump events with discussion associated with organic market movements.
Methodology
The methodology progressively filters Telegram messages, detects coin-specific mention anomalies, and evaluates their temporal market discontinuities with RDD and DiD. It combines semantic validation, adaptive detection, and controls for systemic market noise.
- Framework: The framework processes raw Telegram streams into fine-grained social–market patterns through a three-step pipeline tailored to scalable analysis.Its goal is to characterize patterns consistent with Pump-and-dump manipulation and their temporal relationship to market fluctuations.
- Data: The input comprises over 20 million messages from 14,499 public Telegram channels and cryptocurrency price and volume time series aligned across assets.The Telegram sample covers July 2021 to July 2022.
- Semantic filtering: A trained semantic classifier removes false-positive cryptocurrency mentions caused by polysemous names before daily mention time series are constructed.Dictionary matching first collects candidate mentions, which are then filtered using the classifier.
- Causality methods: Sharp RDD estimates an instantaneous price or volume jump and subsequent slope change at the first anomalous mention, using minute-level data around the event.Sensitivity analysis evaluates bandwidths from 10 to 120 minutes.
- Causality methods: DiD compares treated altcoins with stablecoins and Bitcoin to difference out systemic market noise, while the authors interpret discontinuities as correlational rather than absolute causal evidence.The controls address simultaneous external shocks such as Bitcoin price swings at the event threshold.
Results
The results show that scalable Telegram analysis can distinguish crypto-related messages, identify temporally coordinated market events, and reveal behavioral differences between Pump-and-dump and sustained market reactions. Pump-and-dump activity spans diverse channels, resembles organic discussion linguistically, precedes price peaks, and imposes substantial losses on peak buyers.
- Crypto-Related Classifier: RoBERTa fine-tuning matched or outperformed larger language models while providing the computational efficiency required for large-scale Telegram monitoring.It achieved 94.0% recall and a 92.2% F1-score for crypto-related messages, while fine-tuning finished in approximately 89 seconds and was 5.6× faster than Llama-3.1-8B.
- Detection of Anomalous Market Occurrences: 302 immediate price and volume jumps followed detected social signals, while only one placebo case was statistically significant before the defined event time.The placebo result supports the use of the event-time definition for subsequent validation, without itself classifying manipulation.
- The Telegram Information Ecosystem: Pump-and-dump activity spread across 2,391 channels and 43,675 messages, with 2,071 channels appearing in both event types.The distribution included 410 channels exclusive to Pump-and-dump messages and only 10 exclusive to Sustained Market Reaction events.
- The Telegram Information Ecosystem: Pump-and-dump and organic crypto discussions used similar lexical and psycholinguistic language, limiting text-only discrimination.Both cases prominently used terms such as buy, sell, and buying, and none of the examined LIWC dimensions significantly differed between them.
- Detection of Anomalous Market Occurrences: 47 Pump-and-dump events and 73 Sustained Market Reaction events were distinguished by sharply different message timing around price peaks.Pump-and-dump messages were concentrated before the peak, whereas Sustained Market Reaction messages showed a dominant mode near +3,000 seconds and reflected continued discussion after the event.
- Economic Impact Analysis: Pump-and-dump events averaged a 9.98% price increase followed by a −14.84% maximum drawdown, while Sustained Market Reaction events showed an 18.56% gain and −5.36% drawdown.The results also associate Sustained Market Reaction events with $828.8 million aggregate volume versus $234.8 million for Pump-and-dump events, reflecting differences in asset liquidity and event structure.
Conclusion and Future Works
The paper presents a multimodal framework that detects coordinated cryptocurrency anomalies across Telegram and validates their temporal relationship with market movements. It identifies a distinctive precedence pattern while acknowledging important data, methodological, and evolutionary scope boundaries.
- Conclusion: 47 candidate Pump-and-dump events and 73 Sustained Market Reactions were identified across 17,000 assets using NLP filtering, burst detection, and econometric validation.The framework integrates RoBERTa, CA-CFAR, and RDD-DiD.
- Conclusion: Manipulative messages are linguistically indistinguishable from organic discourse but systematically precede price peaks, whereas organic reactions follow them.Median timing was 4.3 minutes before peaks for Pump-and-dump events and 14.5 minutes after peaks for organic reactions.
- Conclusion: The approach extends detection beyond known manipulation groups by analyzing diverse public Telegram channels without preselecting coins, exchanges, or orchestrating channels.Relevant messages may occur outside explicitly cryptocurrency-focused chats.
- Future Works: Future work targets cross-channel network topology, automated amplification, public groups, and multimodal ground-truth data combining social commands with high-frequency order books.These extensions aim to capture evolving coordination strategies and support more resilient detection models.
- Limitations: The study is scoped primarily to public Telegram channels, while initial scheme orchestration may occur in closed private groups.Public execution can nevertheless create a large footprint needed to secure exit liquidity.
- Limitations: RDD-DiD detection is reactive, systemic volatility can bias stablecoin and Bitcoin controls, and evolving manipulators may adjust temporal patterns to evade detection.The analysis mitigates systemic-shock bias by excluding dates with documented market-wide shocks.
Paper Checklist
The checklist records affirmative responses for the paper’s stated assumptions, methodological appropriateness, reproducibility plans, ethical treatment of public data, and discussion of limitations. It also records that compute resources and new supplemental assets were not reported or included.
- Research Design: The checklist states that assumptions, justifications, competing explanations, methodological appropriateness, and limitations were addressed where applicable.Alternative explanations include market-wide shocks and organic information diffusion, with findings interpreted as correlational rather than strictly causal.
- Reproducibility: The authors report plans to release code and reproduction instructions, while compute amount and resource type were not reported.The planned repository also includes the cryptocurrency dictionary.
- Data Ethics: The study uses an existing public Telegram dataset, focuses on aggregated signals, and reports no reasonable expectation of privacy for the openly accessible content.The checklist states that personally identifiable information was not analyzed.
Ethical Considerations
The study uses only publicly accessible Telegram and market data, analyzes activity in aggregate, and avoids identifying individuals. Its findings are descriptive and do not establish legal intent or wrongdoing.
- Public Telegram channels and market data were analyzed observationally, without accessing private groups, bypassing restrictions, or interacting with users.Market prices and transaction volumes came from public sources through official APIs.
- Analyses operate at the aggregate level of messages, channels, and events rather than profiling individual users, administrators, or coordinated actors.The study neither collects nor infers personally identifiable information.
- The detected patterns are consistent with potential pump-and-dump activity but remain descriptive rather than legal evidence of intent or wrongdoing.The stated focus is characterizing market anomalies and highlighting systemic risks to decentralized-market fairness.
Appendix A - Language Models
The appendix documents model-selection procedures, prompt variants, robustness checks, and the configuration selected for scalable cryptocurrency-message classification. RoBERTa-base achieved the reported best validation objective and was assessed for computational practicality.
- Hyperparameters: RoBERTa-base achieved a peak validation Objective Score of 0.9429 with a 3×10-5 learning rate, four epochs, 0.01 weight decay, and 0.1 dropout.These settings were selected to balance cryptocurrency-jargon adaptation with generalization across Telegram channel styles.
- Computational Efficiency: Table 4 reports average inference time in milliseconds per message across strategies, with fine-tuning values presented as mean±95% CI.The efficiency analysis contextualizes the scalability of the selected approach.
- Classification Strategies: The evaluation compares zero-shot, zero-shot in-context, few-shot in-context, and fine-tuning strategies for crypto-related message classification.Few-shot prompts use five exemplars, while zero-shot in-context prompts include annotation guidance.
- Annotation and Prompts: The classifier labels messages as crypto-related when they mention cryptocurrencies or broader crypto concepts, including NFTs, blockchain, Web3, DeFi, exchanges, and trading.Even brief or indirect mentions qualify under the stated annotation criteria.
- Robustness and Generalization: The longitudinal robustness experiment samples 520 messages across 13 months, balanced between predicted positive and negative classes, for blinded annotation.Three independent annotators manually classified the temporally stratified sample.
Appendix B - CA-CFar Sensibility Analysis
The CA-CFAR sensitivity analysis tunes Guard Cells and Training Cells against cross-referenced ground-truth pump-and-dump events. A short exclusion window and five-day historical window produced the highest reported sensitivity.
- Sensitivity Analysis: The analysis tested Guard Cell and Training Cell windows of 1, 2, 3, 5, 7, 15, and 30 days.The tuning reference used verified events from La Morgia et al., cross-referenced through two major channels.
- Parameter Selection: 15 of 16 ground-truth events were detected with 1 Guard Cell and 5 Training Cells, the highest sensitivity among tested configurations.Guard Cells exclude the immediate surrounding period, while Training Cells define the historical noise-estimation window.
- Interpretation: Longer Guard Cell windows reduced detection because short-lived social bursts can be absorbed or smoothed by excessive exclusion zones.The five-day Training Cell window provided the reported balance for estimating the noise floor.
Appendix C - Causality Methods Evaluation
The appendix compares alternative causal-analysis methods for high-frequency market manipulation and explains the preference for RDD and DiD. ITS offers persistence analysis but depends on stable trends, while CCM faces stability and scalability problems.
- Interrupted Time Series - ITS: Interrupted Time Series estimates slope changes and long-term trends after an event, making it useful for assessing persistent shocks and volume decay.Its main limitation here is reliance on a stable pre-intervention trend in volatile cryptocurrency markets.
- RDD and DiD: RDD emphasizes the instantaneous jump at a threshold, providing more local precision than ITS within noisy, high-frequency cryptocurrency time series.The appendix states that RDD and DiD remain the preferred methods for detecting high-frequency manipulation.
- Convergent Cross Mapping - CCM: CCM reconstructs coupled state-space manifolds to examine whether information from one variable is embedded in another, including possible pre-event leakage.In this study, the method encountered fitting instability in non-stationary, noisy financial series.
- Convergent Cross Mapping - CCM: CCM is computationally prohibitive for a generalized framework because it requires asset-specific reconstruction and tuning for each coin.The appendix contrasts this per-coin burden with the RDD + DiD strategy across thousands of anomalous events and hundreds of altcoins.
Thresold Sensitiviy Analysis
The event classification remained stable across most threshold configurations, while 18 borderline cases were identified and some abrupt reactions were sensitive to the Volume Decay threshold.
- Nine configurations varied Reversal Ratio from 0.6 to 0.8 and Volume Decay from 0.2 to 0.4.The analysis tested all combinations of the three values for each parameter.
- Event categorization remained highly stable across most parameter combinations.The authors interpret this stability as evidence that minor parameter adjustments do not strongly affect the pipeline.
- 18 borderline events were identified across threshold configurations.Table 5 reports the boundary-event sample size as n = 18.
- Some abrupt market reactions were sensitive to the Volume Decay threshold.These cases involved abrupt pre-burst buy orders followed by different pump stages.
Pump & Dump Validated Samples
The validated pump-and-dump samples illustrate several promotional patterns, including coordination, historical-return claims, urgency, and staged dumping across exchanges.
- Pump-and-dump examples included coordination and claims about historical returns.One example reports a detected 15-minute RVN burst alongside earlier large returns.
- Four XBT signals were advertised with 100% accuracy and reported returns up to 214%.The same message also promoted profits for BAT and CHZ on Binance.
- Influencer-led urgency promoted DOGE through Elon Musk references and calls to invest quickly.The message encouraged readers to move bitcoin to DOGE and use a linked buying and selling service.
- SUSHI examples displayed staged pump-and-dump patterns across two exchanges.The dump phase appeared as discrete bursts rather than one continuous decline.
Sustained Market Reaction Samples
The sustained market reaction samples cover infrastructure rebranding, large wallet transfers, and speculative community discussion as distinct information contexts.
- BNB discussion framed successive Binance chain names as infrastructure rebranding.The message moved from Binance chain to Binance smart chain and then BNB Build & Build, including an official support link.
- 12,499,999 XLM worth 2,722,654 USD was reported transferred from an unknown wallet to Coinbase.The message attributed the information to Whale Alert details.
- Organic community speculation imagined Elon Musk sending Dogecoin holders to another universe.The example presents the speculation humorously rather than as a concrete transaction report.