At 19:30 GMT on 14 November 2018, a Telegram channel called Official McAfee Pump Signals, with 12,333 members, posted a picture with the name of a coin in it. What followed is one of the best-documented cases of a pump and dump in crypto. The coin was BVB, a dormant token tied to fans of the Borussia Dortmund football club, traded against bitcoin on the Cryptopia exchange. At 19:30:05 it changed hands at 35 satoshis. Twenty seconds later it traded at 115. Within minutes the price was sliding back, and the people who bought at the top were holding a coin almost nobody wanted. Researchers Jiahua Xu and Benjamin Livshits rebuilt that sequence tick by tick in a study presented at USENIX Security 2019. The channel’s name borrowed John McAfee’s; nothing in the paper says he took part.
Reduced to its bones, every scheme works the same way. A few people buy a small coin first and quietly. They then get many others to buy it loudly, through a group, a post or a launch. And they sell into that buying, so the latecomers pay for the organisers’ profit.
Today the trick comes in three shapes: the Telegram or Discord group, the memecoin launchpad where insiders and snipers buy first, and the paid influencer. Each can break different laws in the United States, the United Kingdom, France and Italy, and the European MiCA rules on market manipulation reach some cases more clearly than others. None of this means every memecoin is a scam, and nothing here is a tip on what to buy.
What a pump and dump is, and how it differs from a rug pull
A pump and dump is market manipulation: the price of an asset is pushed up by coordinated buying and promotion, and the people behind the push sell their holdings while it lasts. The trick is far older than crypto. The French AMF and Italy’s Consob both warned in the autumn of 2025 about the same scheme run on shares through WhatsApp and Telegram groups, so the method is not tied to blockchains. Crypto simply removed the brokers and listing rules that slowed it down, and added tens of thousands of tokens worth a few million dollars or less.
The “dump” is the second half, and it is the whole point. A rising chart attracts buyers. Each new buyer is what traders call exit liquidity: someone the organisers can sell to. When their selling outweighs the new buying, the price falls back, often to where it started, and the losses land on whoever bought last.
The previous lesson in this path explained how a rug pull works: the creator of a token drains the blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">liquidity pool or uses hidden powers in the contract, so the token becomes unsellable or worthless. A pump and dump needs no trick in the code. It works through people, using promotion and timing, and the promoters leave by selling tokens they already held. The two often meet on launchpads. When Chainalysis looked at tokens launched in 2024 that it suspected of being pump and dumps, about 94% of the affected pools had been drained by the address that created them, which is a rug pull at the end of the same story.
For the full map of scam types and how to report each one, our hub on how to avoid crypto scams is the starting point. This page stays on the pump and dump.
Pump and dump crypto groups on Telegram and Discord
The best-documented form is the organised group. Xu and Livshits traced more than 300 Telegram channels and counted “412 pump-and-dump activities organized in Telegram channels from June 17, 2018 to February 26, 2019”, in the words of their abstract. A second team, Massimo La Morgia, Alessandro Mei, Francesco Sassi and Julinda Stefa at Sapienza University of Rome, followed more than 100 groups on Telegram and Discord for over three years for a paper published in ACM Transactions on Internet Technology in February 2023. Their descriptions of how the groups work match closely.
Step by step: from countdown to coin reveal
A group starts as a public channel that recruits on forums and social media until it has enough members, usually more than a thousand. Days before a pump, the admins announce the date, the time, the exchange and the coin you will need to pay with, such as bitcoin. They do not announce the target.
Then comes the countdown, with rules repeated in every message: buy fast, post about the coin everywhere, hold for a few minutes, sell in small pieces, only sell at a profit. At the set minute the coin’s name appears, usually inside a picture designed so that bots cannot read it automatically. In the first minute the price “surges, sometimes increasing several fold”, Xu and Livshits write. The peak comes after a few minutes, sometimes after tens of seconds. Panic selling follows, and the price usually returns to its starting level within about half an hour.
After the pump the channel posts a “review” with two numbers: the low before the pump and the peak. It never shows the price at which most members actually bought.
Who wins: admins, VIPs and everyone else
The groups are hierarchies. La Morgia and his colleagues found that higher-ranked members receive the coin’s name before the others, usually between 0.5 and 1 second earlier per level and up to 10 seconds for the top rank. Members climb by bringing in new recruits, and some groups sold VIP status for 0.01 to 0.1 bitcoin, about $310 to $3,100 at the prices of 10 January 2021. In a market where the price can triple in twenty seconds, a ten-second head start decides who sells and who is sold to.
Admins decide alone. Members may vote on the time or the exchange, never on the coin. And the data suggest the admins buy before anyone else: Xu and Livshits found that trading volume and price movements in the hours before an announcement helped predict which coin would be picked, which is consistent with organisers accumulating in advance.
The largest public community the Sapienza team found, Big Pump Signal, peaked in January 2018 with more than 200,000 members on Telegram and 250,000 on Discord. Across 41 pumps, 36 of them on Binance, it moved about $129.7 million of trading volume within an average of five minutes of each start. Its best-known operation, on 10 May 2018, targeted the SingularDTV coin and generated about 5,176 bitcoin of volume, around $36.75 million at the time.
What the studies and trackers measured
The academic studies cover coins listed on centralised exchanges between 2017 and early 2021. Since then the activity has moved towards new tokens on decentralised exchanges, which blockchain analytics firms try to measure from on-chain data. Their figures describe suspected patterns, not proven cases, and each firm uses its own definition.
| Figure | Value | Source and date |
|---|---|---|
| Pumps found in Telegram channels, 17 June 2018 to 26 February 2019 | 412, from more than 300 channels | Xu and Livshits, USENIX Security 2019 |
| Share of those pumps on Cryptopia, Yobit, Binance, Bittrex | 51%, 27%, 17%, 5% | same |
| Artificial trading volume during the pumps | 8,793 BTC (about $50 million), nine times the pre-pump volume | same |
| Organisers’ estimated profit | 199.52 BTC (about $1.1 million) over 348 pumps, average return 18% | same |
| Coins already pumped before on the same exchange | 35% (146 of 412) | same |
| Pumped coins with a market value under $20 million | 140 of the 264 coins with known market value | La Morgia et al., February 2023 |
| Time needed to detect a pump, and accuracy | 25 seconds, F1 score of 94.5% | same |
| Suspected pump-and-dump tokens among 2024 launches | 74,037 of 2,063,519 (3.59%) | Chainalysis, 29 January 2025, corrected 13 February 2025 |
| Median time from launch to abandonment, same tokens | 0 days (average 6.23 days) | same |
| Pump.fun tokens that fell below $1,000 of liquidity, January 2024 to March 2025 | about 98% of more than 7 million | Solidus Labs, May 2025 |
The targets are small. In the Sapienza sample, 83.5% of the coins had traded less than $1 million across all exchanges in the 24 hours before the pump, and more than half under $10,000, which is why a few thousand buyers can move them. The same coins also come back: more than a third of the pumps Xu and Livshits counted hit a coin that had already been pumped on that exchange. What nobody has is a total for the losses. Xu and Livshits point out that trading is zero-sum, so members’ losses are on the scale of the organisers’ gains, and Chainalysis says its own method “tracks patterns of behavior and not intent” and gives no estimate of victims’ losses.
The Chainalysis rule is mechanical: a token is flagged when an address added liquidity to a pool and later removed at least 65% of it, worth $1,000 or more, and the pool then went quiet after more than 100 transactions. The firm loosened its threshold from 70% the year before, so its 2024 share cannot be compared with earlier editions. As of October 2026 it is the latest edition we could confirm.
Memecoin launchpads: when the pump is built into the launch
On a launchpad such as Pump.fun, anyone can create a token in a minute, and its price follows a formula that rises as people buy. There is no group to join and no countdown to wait for: the first minutes of every launch are a small pump by design, and whoever bought first can sell to whoever bought next.
That is why the numbers from launchpads look so different from the group era. Solidus Labs, a company that sells market-surveillance tools to exchanges, studied Pump.fun tokens deployed between January 2024 and March 2025 in a report published in May 2025. Of more than 7 million tokens with at least five trades, only about 97,000 kept more than $1,000 of liquidity. Solidus treated a token below that level as effectively worthless and flagged about 98% of the total. The measure shows collapse, not proven crime: many of those tokens were jokes or experiments that nobody bought.
The alleged misconduct is in the details of who buys first. A proposed class action filed in New York in January 2025 against Baton Corporation, the company behind Pump.fun, claims that insiders and bots get priority over ordinary buyers, and the amended complaint of July 2025 called the platform a “front-facing slot machine cabinet”, Decrypt reported. These are the plaintiffs’ allegations. In orders reported on 31 August 2026, Judge Colleen McMahon of the Southern District of New York dismissed the claims against Solana Labs, the Solana Foundation and their executives, rejected the claim that the FRED and GRIFFAIN memecoins were securities, and let racketeering claims by two plaintiffs proceed against Baton Corporation and three of its executives, Protos reported. The judge also gave the plaintiffs’ lawyers until 10 September to explain why claims against 25 unnamed influencers, accused of promoting tokens while concealing their pay and their positions, should not be dismissed because those influencers had never been identified or served. We found no report of what followed that deadline, and as of October 2026 nothing in the case had been proven at trial.
Insiders and snipers: reading the first minutes of a token
Two words come up in every launchpad story. A sniper is a wallet, usually run by a bot, that buys a token in the same block it is created or seconds later, before any announcement reaches the public. A bundle is a group of wallets funded from one source that buy together at launch, so that one person holds a large share of the supply while the holder list shows dozens of independent names.
Neither is illegal in itself. What matters is who controls the wallets and what buyers were told. If the creator or the promoter is behind the snipers and then advertises the token as a fair launch, the buyers who arrive later are paying for a pump that was arranged before they heard of it.
Analytics firms read this from the chain. In February 2025 Bubblemaps said it was “highly confident” that one entity was behind both the MELANIA memecoin and the LIBRA token promoted by Argentina’s president, claiming that a wallet which made more than $2.4 million sniping MELANIA later moved funds that ended up financing LIBRA’s main creator wallet, The Block reported on 17 February 2025. Those are Bubblemaps’ inferences, not findings of a court.
The legal outcome shows the gap between the two. As the rug pull lesson recounts, a federal judge in New York, Jennifer Rochon, dismissed the American investors’ class action over LIBRA with prejudice on 29 September 2026, on grounds of racketeering law and jurisdiction, Protos reported. In Buenos Aires, federal judge Marcelo Martínez de Giorgi closed the criminal case against President Javier Milei, his sister Karina and others, including the launch adviser Hayden Davis, on 23 October 2026, finding that the facts did not constitute a criminal offence, Al Jazeera reported. Investor losses and a price that rose and collapsed were not enough, in the judge’s view, to establish fraud. Our report on the LIBRA ruling has the details. For a buyer, the lesson is practical: an on-chain map can warn you before you buy, but it will rarely get your money back afterwards.
Influencers and celebrities: paid posts and hidden holdings
The third form needs no group and no launchpad, just an audience. Someone with followers posts about a token, the followers buy, and the price rises long enough for the poster, or whoever paid the poster, to sell.
The best-known enforcement case is about disclosure, not a pump and dump. On 3 October 2022 the US Securities and Exchange Commission charged Kim Kardashian for promoting EthereumMax’s EMAX token on Instagram without disclosing that she had been paid $250,000 for the post. She settled without admitting or denying the findings, paid $1.26 million in penalty, disgorgement and interest, and agreed not to promote crypto asset securities for three years. The SEC’s enforcement director, Gurbir Grewal, said promoters “must disclose the nature, source, and amount of compensation they received in exchange for the promotion.” The SEC did not accuse her of running a pump and dump.
A private class action over EMAX went further and alleged that the token’s executives worked with celebrity promoters to lure buyers and lift the price so they could sell. On 7 December 2022 Judge Michael Fitzgerald in Los Angeles dismissed it, finding the allegations insufficient, while allowing the plaintiffs to amend some claims, NBC News reported. The judge found the plaintiffs had not shown a scheme to mislead buyers rather than people acting in their own interest. We could not find a later ruling, so the pump-and-dump theory in that case remains an allegation that never reached a verdict.
European law now names this conduct directly. Article 91(3)(c) of MiCA lists as market manipulation using regular or occasional access to the media to give an opinion on a crypto-asset while holding a position in it, profiting from the effect on the price, without disclosing the conflict of interest properly. In the UK, crypto promotions aimed at consumers have had to follow the FCA’s financial promotion rules since 8 October 2023, which reaches paid influencers. A post marked as an ad and stating the poster’s holdings is not proof of honesty, but a post that hides both is a warning.
Operation Token Mirrors: the FBI’s own token and the market makers it caught
Fake trading volume is the stage set of a pump. A coin that seems to trade millions of dollars a day looks alive, and a rising chart with heavy volume looks like demand. Producing that volume by trading with yourself is called wash trading, and it was the core of the largest US case in this area.
On 9 October 2024 federal prosecutors in Boston announced charges against 18 individuals and entities, IRS Criminal Investigation said. To catch them, the FBI created its own token, NexFundAI, and hired market makers to trade it. Three firms, ZM Quant, CLS Global and MyTrade, were charged with wash trading or conspiring to wash trade for that token; a fourth, Gotbit, was charged over a similar scheme. Leaders of four token companies, the largest of them Saitama, were accused of making false statements about their tokens and using sham trades to inflate prices before selling, the classic pump and dump. More than $25 million in crypto was seized and bots behind wash trades in about 60 tokens were switched off. The SEC filed parallel civil cases.
So Token Mirrors was mainly a wash-trading case against market makers, with pump-and-dump allegations against some token companies. The court outcomes so far concern the market makers. CLS Global, which had pleaded guilty in January 2025, was sentenced in federal court in Boston on 2 April 2025 to pay $428,059 and to three years of probation during which it may not offer its services in the US, Cointelegraph reported. Gotbit’s founder, Aleksei Andriunin, pleaded guilty in March 2025 to wire fraud and conspiracy to commit market manipulation. On 12 June 2025 Judge Angel Kelley sentenced him in Boston to eight months in prison, which the court treated as already served after his detention following his arrest in Portugal, plus one year of supervised release; prosecutors had asked for 15 months, Reuters reported. Gotbit itself received five years of probation during which it must cease to operate, and forfeited about $23 million in seized crypto.
A second wave followed. On 30 March 2026 prosecutors in Oakland, California, announced charges of wire fraud and wire fraud conspiracy, each carrying up to 20 years in prison, against ten executives and employees of four firms, Gotbit, Vortex, Antier and Contrarian, according to IRS Criminal Investigation. Vortex’s leaders are accused of inflating a token’s price while planning to sell once it peaked. Two Gotbit employees, Antoine Tsao and Nemanja Popov, had already pleaded guilty and been sentenced; the others are presumed innocent.
Volume on a small token’s page is not proof that anyone wants it. In October 2026 the data firm Bitquery traced about $1.4 billion of the $6.17 billion traded over 30 days on Raydium’s concentrated-liquidity pools to a single bot cycling money through fake pools that held about $19 of real dollars each, as described in our report on the Raydium wash-trading bot.
Is a pump and dump illegal? US, EU, French, Italian and UK rules
There is no offence called “pump and dump” in any of these countries. Prosecutors and regulators use fraud and market-manipulation rules, and which ones apply depends on where the token trades and what it legally is.
United States: wire fraud more than securities law
On 27 February 2025 the SEC’s Division of Corporation Finance said in a staff statement on meme coins that, in its view, typical meme-coin transactions do not involve the offer and sale of securities, while warning that fraud around them may still be pursued by other agencies under other laws. In practice a memecoin pump and dump is now mostly a matter for the Justice Department, through federal wire fraud, which carries up to 20 years in prison. Token Mirrors used exactly that charge. Where a token is a security, the SEC’s anti-fraud and anti-touting rules still apply, as the Kardashian case showed.
European Union: MiCA Title VI and Article 91
The EU’s Markets in Crypto-Assets regulation has a full title on market abuse, Articles 86 to 92, applicable since 30 December 2024 (our guide to MiCA explains the rest of the regulation). Article 91 bans market manipulation and attempted manipulation. It covers trades or orders that give false or misleading signals about supply, demand or price, or that hold the price at an abnormal level; trades using fictitious devices or other deception; and spreading false or misleading information, rumours included, through any media, the internet included. A coordinated group buy followed by a sale fits the first; a paid post hiding the poster’s position is named in the article’s examples.
The catch is the scope. Article 86 applies these rules to crypto-assets admitted to trading on a platform, or for which admission has been requested, wherever the act takes place, inside or outside the EU. A memecoin that only exists in a pool on a decentralised exchange and was never admitted to, or requested on, a trading platform sits in a grey zone. Whether Title VI reaches it is not settled, and as of October 2026 we found no ESMA answer on the point. Saying that MiCA bans every pump and dump everywhere would overstate it.
Where MiCA applies, Article 111 requires each country to give its regulator maximum fines of at least €5 million for individuals and €15 million or 15% of annual turnover for companies, or at least three times the profit made where it can be worked out. Criminal penalties come on top, under national law. ESMA’s guidelines dated 9 July 2025 ask national regulators to consider monitoring social media for market abuse, on a best-effort basis, and name people active on social media among those whose conduct may amount to abuse.
France and Italy: criminal and administrative routes
In France, MiCA is directly applicable and the AMF supervises it; in September 2025 the AMF said it would apply ESMA’s guidelines, including social-media monitoring. Criminal law was adapted too. Ordinance no. 2024-936 of 15 October 2024 extended the market-manipulation offence of article L. 465-3-1 of the Monetary and Financial Code to crypto-assets from 30 December 2024, with the neighbouring article L. 465-3-2 covering false or misleading information. The offence carries the penalties of insider dealing set by article L. 465-1: up to five years in prison and a €100 million fine, which can rise to ten times the profit made. The AMF’s enforcement committee can also impose administrative fines; the two tracks are coordinated so that one person is not prosecuted twice for the same facts. Lies told to sell a token can also be prosecuted as escroquerie under the Penal Code.
Italy took a different route. Legislative Decree 129 of 5 September 2024, which adapts Italian law to MiCA, makes Consob the authority for market abuse in crypto-assets, and its article 33 punishes breaches of MiCA’s Article 91 with an administrative fine of €5,000 to €5 million, while article 34 sets fines for companies of €30,000 up to €15 million or 15% of annual turnover; either fine can rise to three times the profit made. The criminal offence of market manipulation in article 185 of the Consolidated Law on Finance (TUF), one to six years in prison and a fine of €20,000 to €5 million, is written for financial instruments and does not mention crypto-assets. Fraud (truffa, article 640 of the Penal Code) remains the criminal route for deceiving buyers. On 28 October 2025, Consob warned that pump-and-dump schemes run through WhatsApp and Telegram groups “may also occur in relation to the trading of crypto-assets”.
United Kingdom: a crypto market abuse regime from October 2027
The UK has no crypto market-abuse regime in force yet. The FCA published its final rules for one, the Market Abuse Regime for Cryptoassets, in policy statement PS26/9 on 30 June 2026, and the new crypto regime is expected to come into force on 25 October 2027. It will ban insider dealing and market manipulation for cryptoassets admitted, or applied for, on a UK trading platform, wherever the conduct takes place, as a civil regime. Until then the routes are general fraud law, such as the Fraud Act 2006 in England and Wales, and the financial promotion rules.
Ten warning signs before you buy a small token
None of these signs proves a pump and dump crypto scheme on its own. A coin can rise on real interest, a listing can lift a price, and a creator holding tokens is normal. Two or three together should make you stop.
- The tip reaches you uninvited, through a private group, a direct message or an invitation you did not ask for. The AMF’s warning of 19 September 2025 and Consob’s of 28 October 2025 both start with this.
- Someone sets a deadline: a countdown, a “get in before 8 pm”, a pressure to act now. Countdowns are the signature of the groups described above.
- The market is tiny. Check the token’s market cap, the liquidity in its pool and its volume over the past 24 hours before the hype; more than half of the coins with a known value in the Sapienza study were worth under $20 million when they were pumped.
- A few wallets hold most of the supply, or several wallets were funded from the same address and bought in the first seconds. Free tools such as Bubblemaps and Solscan show holder concentration and large holders.
- Volume looks far too large for the money in the pool. Wash bots can manufacture volume around a liquidity pool that holds very little.
- The promoter will not say what they hold or whether they are paid. Under MiCA that silence can itself be manipulation; under US law it was the basis of the Kardashian case.
- You are asked to send a screenshot of your purchase. Consob notes that the requests help organisers coordinate and check the buying.
- Gains are promised within days, or the token is described as unable to fall.
- The chart goes vertical in minutes, and after the first drop the channel fills with “buy the dip” messages. That is the dump phase in progress.
- After the fall, someone offers to recover your losses for a fee or a new deposit. The AMF lists such offers among the signs of the scheme itself.
What to do if you bought into a pump and dump
Do not buy more to bring down your average price: the organisers’ selling is usually not over, and the price tends to return to where it started. Do not pay anyone who promises to recover the money; recovery offers are a second scam aimed at the same victims.
Keep the evidence: screenshots of the group messages and posts, the token’s contract address, your wallet address, the transaction hashes and the exchange used. Then report. In the US, file with the FBI’s Internet Crime Complaint Center (ic3.gov) and send a tip to the SEC (sec.gov/tcr) or the FTC (reportfraud.ftc.gov). In England, Wales and Northern Ireland, the police service is Report Fraud (0300 123 2040); in Scotland, Police Scotland on 101. In France, the AMF’s Épargne Info Service takes questions and reports, and in Italy Consob accepts complaints through its online form. If you bought on a centralised exchange, tell the exchange too: under MiCA, platforms in the EU must report suspicious orders to their regulator.
The next lesson in this path moves from market manipulation to Ponzi schemes, where the returns paid to early investors come from the money of later ones.
