In the latest report from WizSec, a Tokyo-based security firm, conclusive evidence has been found of insider trading and price manipulation at the defunct Mt. Gox exchange.

The report states this price manipulation started in February 2013 when the price was around US$25 and continued all the way until February 2014 when the price crashed from its all time high above US$1,000. The report concludes that 570,000 BTC were bought in the period between February and November and that this definitely had a meaningful impact on price.

Willy Report Overview

WizSec corroborates the findings of the original Willy report, which showed that automated trading began on September 27, 2013 and continued at least until the end of November. It then claims that the automated trading went on through February 2014.

However, prior to this, there was suspicious trading activity from February until September of 2013 that seemed to buy a lot of bitcoin and conveniently stopped just a few hours before the Willybot appeared. Willy bought 250,000 BTC between September 27 and November 30.

The report concludes there was a high probability this had a large effect on the BTC price, which climbed to over US$1,000 during this time. The chart below shows the trading activity of the Willybot and the run-up in price. Notice the few suspicious incidents where Willy isn’t trading and the price corrects itself.

The WizSec report states:

“Our first observation is that Willy clearly operated within strict parameters for how much bitcoin to buy with each order, and that this range was altered several times, sometimes even during the run of an account. Early on it used large ranges like 0 – 150 BTC or 0 – 50 BTC, but later decreased to 10 – 30 BTC or 10 – 20 BTC towards the end of the leaked logs. Our interpretation is that as the price of bitcoin kept going higher, Willy was reconfigured to buy lower amounts in order not to drain each account's ‘deposit’ of USD funds too quickly.”

Other Interesting Findings

Willy also made a lot of trades that were outside of the range listed above,  meaning higher amounts of bitcoin that they wanted to make appear random.

At first there were even numbers like 2,000 BTC, but the report concludes later that these were changed to look more “random” so uneven numbered trades were put in, like for example 1,845 bitcoin, so that these large buy orders wouldn’t draw attention from savvy market participants. Therefore, the insiders wanted to make it look like spontaneous market rushes rather than single orderly trades.

Apparently these trades were done manually as they were outside of the parameters of the Willybot. The chart below shows that these trades were not random at all.

Who Was Behind Willybot

The report also studied the time of user activity in order to find a pattern in the sleep cycle so as to get a clue where the user was based. Conclusive evidence was found that there was no user activity between the hours of 17:00 and 20:00 UTC. These time zones fall within the normal sleeping hours of Australasia.

These short periods brought up more questions and made WizSec think there was more than 1 user between the Willybot and that these users worked together to cover most of the day. All activity also appears to happen during weekdays with no activity whatsoever on weekends. The conclusion that can be drawn here is that this person worked a normal day job and was off on weekends.

Trading activity was spread out through most of the day, which includes any possible working hours during weekdays. This leads to a conclusion that the Willybot could be controlled by its user from a work environment and from their home.

Below is a chart plotting all suspected Willybot trades against time of day:

Willy Did Not Stop in November, 2013

WizSec states that while leaked data suggests Willy ended November 30, 2013, they have different conclusions. They found that the Willybot kept operating throughout December and January though with longer gaps between trading. This could have been holiday related.

Even more important, on January 28, 2014, the pattern reverses and starts driving price down by issuing massive sell orders instead of buys. WizSec believes this was the Willybot and bases it on the available data as well as customer eye witnesses who reported the Willybot operating into February, implicating that Willy had a large hand in the Mt. Gox price crash in February.

Did you enjoy this article? You may also be interested in reading these ones: