loading...
Cover image for How I Exposed a Cryptocurrency Exchange's Dirty Tricks to Fight Competition

How I Exposed a Cryptocurrency Exchange's Dirty Tricks to Fight Competition

leovarmak profile image Karthik Varma ・1 min read

It's no wonder that post the bullish market run in 2017, cryptocurrencies are known to almost everyone across the world 🌏. That run attracted more players into the market. From people tempted to make easy money to investors who catered to this sudden spike in users from institutional players to rookie users. Many new platforms known as crypto exchanges where people can buy and sell cryptocurrencies began to sprout up.. As of April 2018, Bitcoin.com has reported that there are around more than 500 cryptocurrency exchanges. Since there was a sudden spike in the number of exchanges, these exchanges resorted to using various tactics to gather more users onto their platform from competitions to airdrops and referral programs.


BitBns is one of the popular Indian cryptocurrency exchange. It started operating from December 2017. Even though they were new into that market it didn’t take them much time to gather a good reputation thanks to the founders who were already running a good company and a growing user base thanks to the bearish market 📈

When they started they went on a listing spree. They had more digital assets than Koinex, Coinome and even other popular exchanges. People just loved BitBns because of their quick support and that they were offering more choices of cryptocurrencies.

But post Q1 2018 there were many exchanges in the market and all these were using all kind of possible tricks from trading competitions to referral programs to get that market share.

The factors that matter to users to select their exchanges are:

  • 24 Hours Volume (People don’t want to wait a lot of time for their orders to get executed)
  • Good Support (People don’t like waiting and since cryptocurrencies are highly volatile they expect quick support)
  • More Listings (People love to buy all kinds of different cryptocurrencies)

  • 24 Hours Volume plays a very crucial part in regards to any cryptocurrency exchange because CoinMarketCap won’t list exchanges that don’t have volumes above a particular threshold. The CoinMarketCap ranking is very important for all exchanges as its like the search index of all crypto assets or exchanges. Essentially CMC is like Google for crypto-assets and exchanges.

In fact traders like me check the volumes on CMC first and then go to various exchanges. Now coming back to BitBns, it already has all other things except volumes. Maybe due to this they decided to manipulate it just to gain market share.


Decoding:

I have traded on most of the Indian exchanges in the past and BitBns didn’t have that great volumes. Then when BitBns suddenly had better volumes compared to WazirX, Koinex and Coindelta, I thought it was a system bug.
In the past, BitBns was accused of having faked their volumes and they explained that there was a bug in the system. This was even reported by Coincrunch in March, 2018.

Now when it comes to July, 2018 when most of the Indian exchanges volumes are decreasing drastically, BitBns volumes are still good. I had my doubts about it and wanted to check if it was true. To my realisation ,indeed the volumes shown are wrong.

Firstly, I looked at how the Trade History is updated on the website. Essentially, trade history contains the history of last ten executed trades. It shows a timestamp, the volume and the PPU(Price Per Unit).

trade history

Later I found out from the XHR requests that the trade history data is sent using Polling APIs.

There were two APIs. One for generating a Session ID and then the other which uses this Session ID to fetches the Trade History data.

Due to this I decided to check the volumes of BTC and XRP markets as they are in the top five markets by volume on BitBns. Now I knew how to fetch the data and had to decide my stack.

I was quite familiar with Node.js and decided to use it to put all the data I fetch into a database.

After that, I decided on using MySQL because it seemed like the most logical to me. I used MySQL like 3 years back before this and whenever I tell my friends that I use MySQL even now they just laugh 😹

I used axios to fetch data from the APIs. However, the response I received was so shitty I had to clean up the response and turn it into parseable JSON.

I sorted out everything to fetch the data and then had to store everything in MySQL. I programmed it in such a way so that when the program starts it puts the data as it is in the database on the first run. Then from later on it compares the latest record in the database with the newly fetched data from the trade history. If new records are detected based on the timestamp from the API-fetched data, then it is inserted into the database.
I created a table for XRP and BTC each with the SNo, TimeStamp, Volume, PPU columns.

This is how data is stored inside MySQL:
mysql store

If the timestamp, volume and PPU are same for data, then it is treated as duplicate data and does not get stored in DB. This case is extremely rare but I put it just incase if anything went wrong.

I used mail services to send notifications once the script ran and once to send an aggregated volume after 24 hours directly to the email.
After that, I put everything in a setInterval to keep fetching and storing the data.

An overview of the different functions I used:
Fetching new data using setInterval

Since the time interval is pretty high, you might think that we may miss some trades. However in Indian markets thats actually a great refresh rate. This is because there aren’t many trades as they are on Binance. Nonetheless, I didn’t miss any data.
I was fully ready with my code and deploying it.

I deployed my program on WeDeploy and the MySQL DB on Google Cloud Platform. The deployment and infrastructure was not at all a problem, thanks to the amazing team at WeDeploy.


Results:

I stopped my program exactly 24 Hours after it has begun. Even though we got the aggregated results on the email, I decided to aggregate them myself inside MySQL. The below are the results from the program.

Here are the 24 Hours aggregated volume of XRP and BTC markets based on our program:
volume mysql

There was a drastic difference between the volumes reported by BitBns and CoinMarketCap
On BitBns and CoinMarketCap :

The 24 Hours Volumes on BitBns of XRP Market (Right) and BTC Market(Left):
difference

The volumes shown on CMC after 24 Hours:
difference

The Volumes shown on BitBns and CoinMarketCap are called as Rolling Volumes. It means that when you open their website, the Volume shown on the website is from the past 24 hours.

If you open it at a time T then the volume shown is from T-24 .

On BitBns website, the 24 Volume of XRP is shown as 3,75,410 and the 24 Volume of BTC is shown as 20.266.
Let's compare this with result of our program.

  • The program said that the 24 hour volume of XRP is 62,365 and on BitBns it says 3,75,410 . The volume reported on the website is more than 500% than the actual volume.
  • Again the 24 hour volume of BTC is 2.638 according to our program and on BitBns it says that it is 20.266. The volume reported on the website is more than 668% than the actual volume.

BitBns is reporting a manipulated 24 hour holumes. It reported 501% more incase of XRP and 668% incase of BTC than the original volumes.


We can clearly see that that BitBns is faking its volumes in order to gain a competitive edge over other exchanges. We have no idea many other exchanges are reporting fake volumes.

Special thanks to MCD-50 for helping me out.

In case you want to verify my claims, here is the link to the project on GitHub

Posted on by:

leovarmak profile

Karthik Varma

@leovarmak

CS Student . QA guy with focus on InfoSec and a complete Noob.

Discussion

markdown guide
 

Wow, thanks for sharing. This is really interesting on a few fronts. Will BitBns face any consequences from this?

 

I don't think it will be an issue right now since crypto is not yet regulated here in India. But once its regulations are in place and then if the crypto is dealt like stocks then users can sue the company for showing misleading information.

 

I also think you can double check their addresses and get the numbers directly from the ledgers. It will be harder to aggregate and to get all their wallets though.

Also MariaDB is the new mySQL 😀

 

Directly checking with the public ledger cannot be option for this thing. Lets say a user is using the exchange's wallet service only to store data and not to trade then it will be problem.

Never heard of MariaDB before. Looks nice! Thanks for sharing !

 

I would expect all trading to be done off-chain and to not show up in the ledgers until the user specifically initiates a withdrawal or deposit.

 

Yep, trading transactions will not be found on public ledgers.

 

Great post.

To check all the prices of indian exchanges. try this app IOS and Android

getbyte.app

 

Quite interesting post. I also interested in cryptocurrency and trading. I bought Bitcoins via Switchere exchange service for a good price and I will wait when it will be higher. What other ways how to earn money on this can share?

 

I wish the media would stop using a picture of solid silver or gold coins to represent cryptocurrency. They should use a cloud, fog, or maybe a "peep" - something with no solidity.

essay typer, Mike F. Herrera