Pump and dump in crypto: warning signs and how to verify claims

Short answer: A pump-and-dump scheme is coordinated promotion that manufactures demand for an asset so the promoters can sell into it, leaving later buyers holding something worth less. The warning signs — a sudden price rise, a thinly traded token, a group urging you to buy now — do not prove coordination on their own, and a token can show all three with nobody having organised anything. What you can do is check the specific claims outside the material you were sent: reach the exchange, issuer or organisation yourself, confirm you are looking at the same market and the same token, check when the statement was made, and write down what each source did and did not establish.

What is a pump-and-dump scheme?

The US Commodity Futures Trading Commission described the pattern in a customer protection advisory on virtual-currency pump-and-dump schemes, published on 15 February 2018. It defines the scheme as a coordinated effort to create phony demand for a token and then sell quickly, profiting from traders who are unaware of what is happening. Organisers spread rumours and urge immediate buying.

Buyers may react to the rising price without verifying the rumours, and can be left holding assets worth less after the organisers sell. The advisory’s advice is not to buy based on a social-media tip or a sudden price spike, and it warns that these schemes can occur in thinly traded or newly issued tokens (CFTC, Release 7697-18).

Two terms used below. Liquidity is how easily you can buy or sell an asset without moving its price; a thin market has few orders available, so a small trade can shift the price a long way. A ticker symbol is the short name a market uses for an asset, and the same ticker can belong to unrelated tokens.

The mechanism harms late buyers in a specific order. The promoters hold the asset before they start talking about it. Promotion brings in buyers, and their buying lifts the price. The promoters sell into that buying. When the promotion stops, so does the new demand, and the price falls back. Whoever bought on the way up is holding at a lower value.

That is the described mechanism. It is not a finding about any particular token, group or price chart, and nothing in this article alleges that a named project did this.

Two boundaries on the source. The 2018 advisory describes the market as it stood then, including language about a largely unregulated market; that is a historical description, not a statement of the legal or regulatory position in any country today. And it is US guidance: registration, reporting routes and enforcement differ by jurisdiction, so nothing here is legal advice or a universal claim about where a scheme is illegal.

Why does a spike alone not prove coordination?

Because a price rise has many possible causes and the chart records only one thing: where price traded and closed.

New information, a genuine listing, a product release, a large buyer, or ordinary speculation in a small market can all move a thin token sharply. Low liquidity means small flows produce large moves, which is a property of the market rather than evidence about anyone’s intentions. Concentrated holdings can reflect an exchange or custodian wallet, a market maker, a founder under a published vesting schedule, or an early holder who has no intention of selling.

So treat these as things to investigate, not conclusions:

A sudden price rise is a reason to ask what happened. It is not an answer.
Low liquidity explains why a move can be large. It does not explain who caused it.
Concentrated holdings describe a distribution at one moment. They do not describe control or intent.

The same discipline applies to a sharp move through an obvious price level, which traders often call a liquidity sweep. That label describes a chart pattern; it cannot identify who placed the orders or why. Liquidity sweeps in crypto separates the order-flow idea from a manipulation allegation. Neither a sweep nor a spike is proof, and not every volatile token is a scam.

What counts as evidence: weak, checked, or unresolved?

Sorting what you were shown into three categories does most of the work.

Weak evidence is material that cannot be checked without going back to the person who sent it. Screenshots of profits, dashboards, wallet balances, testimonials in the group, countdowns, listing rumours. None of these is a statement by the organisation it claims to be about.

An independently checked primary statement is one you found yourself, on the organisation’s own site, reached without using their link, where you can say what it states, when it was published, and that it refers to the same token or market you are being pitched.

An unresolved fact is one you could not confirm either way. Record it as unresolved. Unresolved is not the same as false, and it is not the same as confirmed — and treating it as either is how a rumour becomes a reason to buy.

What you were shown	What it can support	What it cannot establish
A screenshot of profits, a dashboard or a wallet balance	That an image exists	That the account belongs to the sender, that the figures are real, or that a withdrawal was ever possible
Testimonials posted in the group	That messages were posted	That the writers exist, bought anything, or were paid anything
A countdown, or “entry closes at 20:00”	That a deadline was asserted	Anything about the token; a deadline is not a claim about the world
A listing rumour	That the rumour is circulating	That the exchange said it
A sharp price rise	That the price rose	Why it rose, or who sold into it
A few wallets holding most of the supply	A distribution figure at one moment	Who controls those wallets, or what they intend to do

How do you verify a promoted claim without the promoter’s links?

This is a research recommendation, not a fraud-detection method. It will not prove manipulation and it will not prove a token is legitimate. What it does is separate the claims that survive checking from the ones that do not.

Stop acting on the urgency. Urgency is the part of the pitch that removes your ability to check anything. If a claim is only true for the next few minutes, treat the deadline itself as the claim under examination.
Write the claim down exactly. Quote it, do not paraphrase. Then split it: the factual part (“exchange X lists TOKEN”) is checkable; the prediction part (“it will go up”) is not, and no amount of research makes it checkable.
Reach the organisation yourself. Type the address into your browser or use a bookmark you already had. Do not follow the link, QR code, username or phone number in the message. The CFTC’s October 2024 advisory on messaging apps gives the same instruction: when an urgent message claims to be from a company, an account or an agency, go to that entity’s official website yourself and confirm the message through customer-service contacts you found independently, rather than through the phone number or link the message supplied (CFTC, Release 9005-24, published 31 October 2024).
Confirm you are looking at the same thing. Tickers repeat across unrelated tokens. Where a token is identified by a contract address — the unique string that identifies a specific token on a specific network — compare the network name and the full address character by character, not the ticker and not a truncated version of the address. Where the claim is about an exchange market, open the exchange’s own page for that exact trading pair. If the promotion never stated the network or the address, record that you could not establish which token was being discussed.
Check the timestamp and the context. When was the statement published, and does it still stand? Has it been superseded or corrected? Was it about a different product, a different year or a different entity with a similar name? An authentic old statement about something else is not support for today’s pitch.
Look at publicly documented ownership and liquidity, and read the labels as claims. A public block explorer for the relevant network can show holder lists and recorded trades; a project’s own documentation, reached by typing its address yourself, may describe supply, locks or burns. You do not need to connect a wallet to read a public page, and no legitimate check requires your seed phrase or private key. The limits of what this data establishes are in the next section — read them before you interpret a holder table.
Record a status for every claim. Confirmed by a primary source you reached independently, contradicted by one, or unresolved. Three statuses, and unresolved is a complete answer.
Decide separately from the pitch. Whether to buy anything is your decision under your own rules and your own risk limits. The verification tells you which of the promoter’s statements survived checking; it does not tell you what the price does next.

A filled-in verification log: fictional example

The promotion below is constructed for this article, not reported from a real case. “EXMPL” is a placeholder ticker on a placeholder “Network A”, and nothing here describes any real project, community or exchange. The log shows the form the artifact takes, not a case study.

Promotion as received: “EXMPL listing on a major exchange confirmed for Friday. Team wallets locked. 40% of supply burned. Get in before 20:00 — screenshots below.”

Claim as promoted	Where it was checked, reached independently	What the source actually says	Status
Listing confirmed for Friday	The exchange’s own announcements and listings pages, address typed manually	No announcement naming EXMPL; other pairs are listed there	Unresolved — the absence of an announcement is not proof that none is planned, only that no primary statement supports the claim
Team wallets locked	Only the sender’s screenshot	No independent statement from any locking service	Weak evidence, unresolved
40% of supply burned	The project’s documentation, address typed manually	Describes a burn mechanism; states no figure and no date	Unresolved — the mechanism is described, but with no figure and no date the 40% claim is neither confirmed nor contradicted
Get in before 20:00	Nothing to check	—	Not a verifiable claim
Which token is meant	The promotion itself	Ticker given; no network, no contract address	Unresolved — identity of the asset could not be established
Supply is concentrated	Could not be checked: no network and no contract address were given, so there is no holder list to open	—	Unresolved — the check is unobtainable until the token’s identity is established, and even a holder list would show a distribution, not control or intent

Not one row ends as confirmed, and none ends as contradicted. Five are unresolved: the listing claim, the wallet-lock claim that rests only on the sender’s own screenshot, the burn figure, the identity of the token, and the concentration check that could not be run at all. The sixth is not a verifiable claim. Unresolved is the honest status for a claim nobody has confirmed and nobody has disproved; a contradicted claim, where a primary source directly disputes it, would be a different result. Five unresolved rows are a sufficient reason not to act on this promotion, and they are not a finding that a crime occurred.

Copy the four columns — claim, where checked, what the source says, status — and the artifact works for any pitch, including one about a fund, a trading group or a service rather than a token.

What can ownership and liquidity data actually tell you?

Less than it appears to, and the gaps are structural rather than a flaw in your reading.

Labels may be missing, incomplete or wrong. An explorer’s tag is applied by someone, and an unlabelled address is simply an address nobody has tagged.
Several wallets may belong to one owner, and one wallet may represent many. Splitting holdings across addresses is ordinary practice, so a holder count is not an owner count.
An address labelled as an exchange or custodian wallet can aggregate assets belonging to many unrelated users. A large balance there is not one holder’s stake and not one entity’s bet.
Displayed volume records trades that happened. It is not a promise that you could trade that size at that price. What you can actually execute depends on the orders available when your order arrives, and a thin market can move against you while filling it.
Concentration does not establish intent. A large holder may have published a vesting schedule, may be providing liquidity, or may simply be inactive. Inferring a plan from a distribution is a guess dressed as a finding.
No number certifies safety. There is no ownership percentage, holder count or volume figure above which a token is safe and below which it is fraudulent. Any tool or post that offers such a threshold is selling certainty it cannot have.

Tools differ in coverage, labelling and update cadence, and this article does not recommend a particular scanner or treat any tool’s output as a verdict. Use the underlying public data where you can reach it, and record which source and which timestamp each figure came from.

What if you have been approached, or you have already sent money?

The CFTC’s messaging advisory advises not to reply to suspicious messages from strangers, and to delete, block and report them, including adjusting privacy settings so unknown numbers cannot add you to groups. It notes that fraudsters can add random or targeted numbers to group chats, and gives examples including guaranteed oversized returns, pump schemes or AI-driven programmes, and fake testimonials (CFTC, Release 9005-24). App settings and their defaults differ between apps and change over time; the advisory describes what was available when it was written, not a guarantee about every app today.

Practical steps, in this order:

Do not reply, negotiate or argue. A reply tells the sender the contact is live, which is why the advisory’s instruction is to delete, block and report instead. Anything they say back is part of the pitch, not a statement you can verify.
Do not pay anything further. Not for signals, not for group access, not for a “recovery” service, and not for a fee, tax or deposit said to be required to unlock a withdrawal you have already requested. Sending more money to release money already sent is a repeated feature of these approaches.
Do not connect a wallet through a link someone sent you, and never share a seed phrase or private key. A seed phrase is the master credential for the assets in a wallet; nobody legitimate needs it from you, and no verification step in this article requires it.
Preserve what you already have before you block or delete. The messages, the usernames and handles, dates and times with their timezone, any transaction hashes, and the addresses you sent to. Export or screenshot what is already on your device. Do not re-engage to obtain more evidence, and do not open attachments or download files in order to inspect them.
Report through the platform’s own reporting tools, and to the official regulator or law-enforcement website for where you live, reached by typing the address yourself. Which authority handles this depends on your jurisdiction; a US agency advisory is not a reporting route for everyone, and this article does not list hotlines or URLs it has not verified.
If you shared exchange account credentials, change them through the exchange’s own site reached independently, then review the account’s withdrawal settings and any API keys you had created. This article gives no wallet transaction instructions on purpose: an untested instruction followed on a live account is its own risk, and the exchange’s own documentation is the right place for those steps.

Nobody can promise that funds sent to a fraudster will be recovered. Some services that advertise recovery are themselves fraudulent; that is not true of all of them, and nothing here assesses any particular service. What stays under your control is not sending more.

What this workflow cannot do

It is not a fraud-detection method. It can show that a claim has no primary source behind it. It cannot prove that a scheme was organised, and it cannot clear a token either.
Absence of a statement is not a contradiction. Not finding an announcement means you did not find one. Record it as unresolved and stop there.
Public data is incomplete by construction. Holder labels, volume figures and supply breakdowns describe what a source recorded, at a moment, under its own definitions.
It costs time, and the pitch is built so that you do not have time. That is the point of doing it anyway: a claim that cannot survive being checked was never a claim you could act on.
It does not cover every kind of loss. A token can be honestly described, honestly promoted and still fall to zero. Verification reduces the number of false statements you act on; it does not reduce market risk.

What this means for your money

Warning signs tell you where to look. They do not tell you what you will find, and a thin, spiking, heavily promoted token is not automatically a scheme — while a calm, professional pitch is not automatically honest.

The work is the same in both cases: quote the claim, reach the source yourself, confirm you are looking at the same asset, check the date, and write down whether the claim was confirmed, contradicted or left unresolved. A log with five unresolved rows and nothing confirmed is a useful result. It is the difference between a decision and a reaction.

We publish this as fraud education, not as a comparison. We run Cointrapper, a private, invite-only algorithmic trading pool on Binance: participants invest USDT into the pool’s shared accounts and hold units in the pool, rather than holding individual futures positions of their own or running a bot on their own exchange account.

Being private and invitation-only is not evidence of honesty, and it is not a safety claim. Legitimate pooled investing is not fraud either. The checks above are the ones we would expect anyone to apply to us, including reading the written terms and confirming statements on our own site rather than in a message.

Pooled investing and futures trading are high risk. Your entire investment can be lost, and capital is not insured. Nothing here is individual investment advice, and regulatory positions, platform settings and public data sources change — check the current official source for your jurisdiction before reporting anything or acting on a claim.