How to Spot a Pump and Dump

A pump and dump follows a recognizable pattern: coordinated actors accumulate a position in a low-liquidity token, drive the price higher through buying pressure or promotional activity, then sell into the momentum they created. Late buyers absorb the losses.

The mechanism isn't new. Pump-and-dump schemes predate crypto — they ran on penny stocks and thinly-traded commodities for decades. What changed in crypto is the speed, the scale, and the fact that the evidence is written on-chain.

Why Low-Liquidity Tokens Are the Target

The scheme depends on thin markets. Moving a token's price 10x requires a lot less capital when there are only $50,000 worth of liquidity in a pool versus $50,000,000. This is why the vast majority of pump-and-dumps happen in newly launched tokens, small-cap altcoins, and assets with shallow order books or minimal liquidity pool depth.

A useful proxy: if a $5,000 buy order would move the price significantly, the token is thin enough to be a candidate.

The Four-Stage Pattern

Most pump-and-dumps follow the same general sequence, though the timing and execution vary:

Accumulation. The operator (individual or coordinated group) builds a position quietly, often across multiple wallets to obscure the concentration. Token price stays flat or drifts slightly — there's little visible activity.

Trigger. Something initiates buying momentum. This could be a post in a Telegram pump group announcing a coordinated buy, a social media campaign promoting the token's "potential," paid influencer posts, or fabricated news about a partnership or listing. The key is that promotional activity appears roughly simultaneously with the price action.

Distribution. As new buyers enter and the price rises, the original holders begin selling. This is the critical window: the pump is still attracting buyers who see the price moving, while the orchestrators are exiting. Timing matters — sell too early and the price hasn't peaked; sell too late and the exit pressure triggers the crash before they're finished.

Collapse. Buy pressure disappears. The price reverses sharply. Buyers who entered during the pump are left holding a devalued asset with no exit near their entry price.

What to Actually Check

There are specific on-chain signals worth evaluating before entering any low-cap token:

Wallet concentration. Check the token contract on a block explorer and review the top holder list. If a small number of wallets — particularly wallets that received tokens from the deployer — control 50%, 70%, or more of the supply, you're looking at concentrated risk. Concentration isn't proof of a pump, but it's the necessary precondition.

Token and liquidity age. Newly launched tokens in the last 24-72 hours with very little liquidity history are the highest-risk environment. Established liquidity with a history suggests organic accumulation; brand-new pools with sudden large buys are more suspicious.

Deployer wallet behavior. Pull the deployer wallet address and look at its activity. Did it deploy this contract, immediately supply liquidity, and then receive coordinated promotion from a Telegram group? Is it one of the top holders? Has it made transfers to other wallets before the price moved? These don't prove a scheme, but they're the right questions to ask.

Volume-price relationship. Organic volume growth tends to have some buildup. Sudden vertical price spikes on thin volume followed by very high volume at the top are consistent with coordinated entry followed by distribution.

Promotional timing. If you first heard about the token from a Telegram group, Discord announcement, or a Twitter account specializing in low-cap calls — and that message arrived within hours of the price action — you're often being told about the pump after the orchestrators are already selling.

Bundled Wallets and the Tracing Problem

Sophisticated operators often create dozens of wallets pre-launch to disguise concentration — a technique called bundling. Instead of one wallet holding 50% of the supply, fifty wallets hold 1% each. They all received tokens from the same deployer address in the same block.

This was harder to detect previously. On-chain analytics tools are now surfacing these patterns automatically: wallets receiving tokens from the same origin simultaneously. Not conclusive alone, but worth noting when timing is suspicious.

Where Constraints Live

Pump-and-dump schemes are illegal in traditional securities markets under securities fraud statutes. In crypto, the legal picture is murkier. If the token qualifies as a security, existing fraud provisions apply. If it's a commodity, CFTC jurisdiction may cover it. If it's classified as neither — which describes many memecoins — enforcement is limited.

This ambiguity is part of why the pattern persists. It's not that regulators are ignoring it; it's that jurisdiction and asset classification determine which enforcement tools apply, and the classification question for many tokens remains unresolved.

What's Changing

On-chain tooling is improving. Tools that trace wallet origins, cluster related addresses, and surface bundled deployer patterns are becoming more accessible. What once required manual blockchain detective work now runs automatically on several analytics platforms.

The memecoin category has also created genuine ambiguity. Some tokens that look like pump-and-dumps from the outside are actually just volatile assets with organically irrational buying communities. The pattern can look identical — concentrated wallets, thin liquidity, social media frenzy, price spike — but intent and coordination differ. Distinguishing these from on-chain data alone requires judgment, not just pattern-matching.

What Would Confirm the Pattern

Confirmation signals that a specific token is running a coordinated scheme: deployer or top-holder wallets actively selling during the price spike (visible on-chain), promotional messaging beginning in clear coordination with buying activity, wallets tracing back to a single deployer with concentrated initial distribution, and price action that reverses sharply once the initial promotional wave dissipates.

What Would Invalidate the Concern

Signals that make coordinated manipulation less likely: long liquidity history before the spike, diffuse wallet ownership with no deployer concentration, no traceable promotional coordination, and price action that consolidates rather than immediately reverses.

None of these are guarantees in either direction. They're signals, not proof.

Timing

Now: Wallet concentration, deployer behavior, and token age are the three checks worth doing before entering any low-cap position. They take 5-10 minutes with a block explorer.

Next: Automated bundled wallet detection is appearing in on-chain analytics platforms and will become standard due diligence tooling.

Later: Regulatory clarity in major jurisdictions will determine which pump-and-dump schemes face legal consequences — that outcome affects how openly they're coordinated.

The Boundary

This covers the mechanism and the signals — not every variant. Wash trading, spoofing, and layered order manipulation are related but distinct. The signals described here don't constitute proof of coordination, and their absence doesn't constitute safety. What they provide is a way to ask better questions before entering a position.

The tracked version of these patterns — including active signals and threshold indicators — lives elsewhere in The Macro's research system.