One Solana bot booked $1.4 billion of Raydium volume with about $12,000, and its fake XMR and XRP pools show liquidity that is not there

A single automated wallet produced about $1.40 billion of trading volume on Raydium’s concentrated-liquidity pools between 21 September and 20 October 2026, about 22.7% of the $6.17 billion traded there, with roughly $12,000 of working capital, according to an on-chain investigation published by Bitquery on 21 October. The data firm describes it as Raydium wash trading: the wallet swapped USDC in and out of hundreds of pools it had filled with copycat tokens named after XMR, XRP, LTC and other well-known assets.

Nothing was hacked. The wallet paid ordinary fees, traded with itself and let the dashboards do the rest. On DEXScreener, one of the most watched charting sites for decentralised exchanges, ten of these pools together showed $5.93 billion of liquidity. Bitquery counted about $10,238 of real USDC inside them.

All of these figures come from Bitquery, a company that sells the blockchain data and trading API it used for the study. Its grouping of wallets into one operation is an inference from on-chain behaviour, which the firm says may be incomplete or wrong. CryptoSlate reported the findings on 22 October and added its own DEXScreener screenshot, but worked from the same data. Coindaro did not rerun the on-chain queries.

How one round trip books $22,200 of volume for about $1

One trade shows the method. At 23:39 UTC on 20 October 2026 the main wallet sent 11,102 USDC into a smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool holding a token that carries the LSK ticker but has nothing to do with the real Lisk project. It received about 19,156 of those tokens. Twenty-two seconds later it sold them back to the same pool for 11,100.87 USDC.

That round trip cost $1.13, plus two Solana network fees of 0.00002 SOL each. Because both legs count, about $22,200 of volume was booked. Close to 20,000 dollars of reported activity for each dollar spent.

Repeat it and the totals grow fast. Bitquery counted 108,871 swaps by the main wallet across 438 pools in 30 days, all against USDC, or 22,685 completed round trips. The median gap between a buy and the matching sell was about 20 seconds. On a typical day the wallet made about 3,000 swaps and pushed some $35 million of USDC in and out. Since the same money keeps cycling, about 12,000 USDC and 1.3 SOL of working capital were enough to reach $1.40 billion.

Raydium’s concentrated-liquidity market maker, known as CLMM, lets each liquidity provider choose the price range where its capital sits. In these pools the bot’s own position takes the other side of its swaps, so the price stays where the bot put it. For the basics, see our glossary entry on liquidity pools and the explainer on what a decentralized exchange is.

438 copycat pools named after XMR, XRP, LTC and even USDT

A typical pool in the cluster held about $19 of USDC on one side and roughly a billion tokens on the other. The fake LSK pool, for instance, held 19.27 USDC against 999,697,630 tokens. The names come from real assets: XMR, LTC, HBAR, TAO, XRP, ZEC, and stablecoin look-alikes named after a deposit network, such as TRC20-USDT or USDC-BSC. Anyone typing a ticker into a DEX search box gets these pools mixed in with genuine ones.

Bitquery found that seven of the top ten DEXScreener search results for XMR were the cluster’s Raydium pools, an observation CryptoSlate repeated. Monero runs on its own blockchain, not on Solana, so a Solana token called XMR is at best a wrapped version issued by someone, and here a token that only borrows the name.

Some prices are set to look plausible. Bitquery compared the fake tokens with Binance spot prices on 21 October. Of 175 tokens with a matching Binance ticker, 8 sat within 1% of the real price and 20 within 5%. Others were far off: the fake XMR was quoted at $547 against $119 for the real coin on Binance.

Behind the trading wallet sits a small factory, as Bitquery describes it. A token-creation wallet has minted 93 tokens since 28 September, the fake XMR and ZEC among them. A gas wallet sends SOL in 0.5 SOL transfers to the trading wallets and to the wallets that control token metadata. Twelve helper wallets made about 1.25 million swaps worth some $8.8 million in the same 30 days, so mostly very small trades. The oldest pools, with ADA, XLM and ETH tickers, were created on 22, 25 and 27 March 2026.

The main bot has changed wallets twice. The first was funded on 10 June 2026, the current one began its round trips on 13 August, and since the end of August the swaps have gone through a private router program, which is harder to follow from a block explorer. In the 24 hours to 21 October the main wallet ranked seventh among all Solana DEX traders by volume, with $34.2 million across 2,952 swaps.

$5.93 billion of displayed liquidity, about $10,238 of real money

Volume is half the picture. The other number traders read before buying is liquidity, the money sitting in a pool to absorb an order. On an ordinary pool that figure is close to the dollar value of both sides of the reserves.

Not here. DEXScreener showed about $579 million of liquidity for the fake LSK pool when Bitquery looked on 21 October, against 19.27 USDC. CryptoSlate’s own snapshot on 22 October showed $579.3 million against 22.6007 USDC. The fake XMR pool, created on 29 September, displayed $1.64 billion with about $10,057 of USDC behind it, almost all of the real money in the ten pools.

The gap is arithmetic. A dashboard values the token side of a pool at its last traded price. When the pool holds a billion tokens and the only active trader sets the price, the token side is worth whatever the bot decides, on screen. Bitquery measured liquidity from the quote side instead, the USDC that a seller could actually take out.

Bitquery valued each swap at its USDC side, so the price the bot gives its own tokens does not inflate the volume figure. It linked wallets that share pools, share gas funding or send each other tokens directly.

Why fake volume and fake liquidity on DEXScreener matter

Volume and liquidity are the two numbers a DEX trader sees first. Charting sites rank pools and tokens by them, and trending lists lean on them. A pool showing hundreds of millions of liquidity and steady volume looks like a market.

The risk sits at the exit. A buyer who swaps $1,000 of USDC into one of the $19 pools receives tokens priced by the bot. To get dollars back, that buyer has to sell into a pool holding about $19 of USDC. The slippage on that sale would take nearly the whole position, and a fake XMR token is not Monero and cannot be redeemed for it.

So far that has barely happened. Four wallets outside the cluster traded its pools in the last week, for about $27 in total, and Bitquery found no outsider purchase at size, so no losses are documented. Why anyone would spend months running this machine is not known. Climbing rankings or drawing attention to tokens are possible motives; the data shows neither, and the operators have not spoken.

Everyone who uses volume as a signal carries part of the cost. Totals for Raydium, for Solana DEX activity and for each venue’s market share include these swaps unless someone filters them out. When one wallet supplies a fifth of a venue’s monthly volume, that venue’s share of the market means less than it seems.

What separates a real Solana pool from a fake one

Bitquery’s findings point to a handful of public data points that tell such pools apart. They are visible on any block explorer or DEX interface and apply to any token on Solana.

1. The mint address, not the ticker. A genuine token is identified by its address, published by the issuer on its own website or in its documentation. A ticker such as XMR or LSK can be given to any new token in seconds; an address cannot be copied.
2. The quote-side reserves. A block explorer shows how much USDC, USDT or SOL a pool actually holds. That amount, not the displayed liquidity, is roughly the most that sellers could take out of it.
3. Volume set against reserves and traders. Millions of dollars a day moving through a pool that holds a few hundred dollars of USDC, traded by one or two wallets, describes a loop rather than demand.
4. The price impact of a sale. DEX interfaces quote the impact of a swap in either direction. When selling a modest amount would cost most of its value, the pool has no depth on the exit side.
5. The pool’s age and the token’s holders. A pool a few days old in which one wallet holds nearly the whole supply matches the pattern Bitquery describes, whatever its chart looks like.

On Solana, a wrapped version of a coin from another chain is issued by a named bridge or custodian and listed in its documentation; a token with the right ticker and no such issuer is not that coin. Our guide to avoiding crypto scams covers the wider family of look-alike tokens, and the DeFi explainer goes through how swaps, pools and fees fit together.

Bitquery’s earlier Solana volume studies, in April and September

Bitquery has questioned headline Solana DEX volume before. In a blog post based on twelve hours of data from 27 and 28 April 2026, it traced wash trading back to three wallets and gave the example of a token called OpenLie, which logged $532,461 of volume across 233 wallets and 40,523 trades. One funding wallet had seeded at least 200 bots with 0.5 SOL each within 52 seconds on 21 April. The firm put its code and queries in a public GitHub repository.

In September it went much wider. Over 24 August to 22 September, Bitquery flagged $117.7 billion of a $201.4 billion sample of Solana DEX trades, or 58.4%, as circular or bot-like, and called that share a floor, as SolanaCompass reported. About 95% of the flagged amount, $111.6 billion, came from the same token being bought and sold through the same pool inside a single transaction. For comparison, a 24 September snapshot of DefiLlama showed $75.9 billion of rolling 30-day Solana DEX volume, according to CryptoSlate.

The Raydium cluster follows a different pattern. Its buy and sell are separate transactions about 20 seconds apart, and the pools are fakes built for the purpose. The finding is narrower, one operation, with far more detail on how it runs.

What is still unknown about the Raydium wash trading bot

Bitquery says an earlier pass of its analysis used realtime data that wrongly dated the operation to 20 October, since corrected, and that the DEXScreener and Jupiter figures were read on 21 October and may have moved. Asked who runs the bot, its answer is that it does not know.

Coindaro found no public statement from Raydium or DEXScreener about the pools as of the evening of 22 October. Neither is accused of anything: Bitquery and CryptoSlate both say the findings do not establish any involvement by Raydium or by the platforms that display the pools.

European rules do not obviously reach the pools. MiCA licenses crypto-asset service providers, not pools run by code on a public chain, and neither France’s AMF nor Italy’s Consob has announced action on this case. Both keep public warning lists of unauthorised crypto offers.

The next things to watch are whether DEXScreener or Raydium label or hide the cluster’s pools, whether the bot moves to a fourth wallet, and whether other data firms reproduce Bitquery’s count with their own queries.