Public Telegram channels show tightly synchronized message bursts that precede short-lived price spikes in many small-cap cryptocurrencies, consistent with coordinated pump-and-dump activity; the authors estimate over $200m of traded volume across detected events and demonstrate that text alone cannot reliably separate manipulative from organic messages.

Moura, F., Paoletti, G., Ferreira, C. H. G., & Almeida, J. M. (2027). Don’t You Know, Pump It Up! Investigating Cryptocurrency Manipulation in Telegram-Driven Activity. Proceedings of the 21st International AAAI Conference on Web and Social Media (ICWSM 2027).

Main Finding

Public Telegram channels carry short, highly synchronized bursts of crypto-related messages that (in many cases) temporally precede rapid, pump‑and‑dump–consistent price moves. Using a scalable pipeline that combines a crypto-related message classifier, adaptive anomaly detection, and quasi‑experimental econometrics, the authors identify 47 candidate pump‑and‑dump events and 73 sustained market reactions across one year of Telegram data; estimated cumulative traded volume associated with detected pump events exceeds $200M. Crucially, the text of manipulative messages is linguistically indistinguishable from organic discussion, implying that detection must rely on temporal, structural, and market signals rather than text features alone.

Key Points

• Scope and scale: analysis on 1 year (July 2021–July 2022) of public Telegram (TGDataset) — ~20M messages from 14,499 channels — aligned with transaction data for >17,000 cryptocurrencies.
• Resources released: crypto dictionary (18,704 terms / ~17,012 coins), labeled message dataset (2,923 messages), and a fine‑tuned crypto-related classifier (publicly available).
• Pipeline (three steps):
• Fine‑grained semantic filtering: train/evaluate models (RoBERTa‑base and several LLMs including Llama 3.1, Gemma, Qwen2.5) to classify whether a Telegram message genuinely refers to cryptocurrency (addressing polysemous coin names).
• Anomaly detection: match messages to the dictionary, filter with classifier, build daily mention time series per coin, detect anomalous spikes with Cell‑Average CFAR (adaptive thresholding).
• Temporal validation: minute‑level Regression Discontinuity Design (RDD) and Difference‑in‑Differences (DiD), using Bitcoin and stablecoins as controls, to test if social bursts temporally associate with price/volume moves consistent with pump‑and‑dump.
• Empirical findings:
  • 47 events consistent with pump‑and‑dump patterns (extreme temporal synchronization across channels; social bursts precede price moves by seconds).
  • 73 events with sustained market reactions not necessarily classic pump‑and‑dump.
  • Psycholinguistic analysis: manipulative messages not distinguishable from organic messages using linguistic features.
  • Estimated cumulative financial volume of detected pump events > $200 million.
• Methodological insight: combining ML filtering (for semantic accuracy) with adaptive anomaly detection plus quasi‑experimental econometric validation yields a scalable, conservative approach to surface and validate candidate manipulation events without preselecting channels or coins.

Data & Methods

• Data:
  • Telegram: TGDataset final year slice (July 2021–July 2022): ~20M messages, 14,499 public channels (including non‑crypto topical channels).
  • Market: transaction price/volume series for >17,000 coins from exchanges (aligned to Telegram timestamps).
  • Dictionary and annotation: 18,704 crypto terms; labeled sample of 2,923 messages (three annotators, inter-rater agreement measured).
• Classification:
  • Task: filter out polysemous false positives (e.g., coins named Trump, Jesus).
  • Models evaluated: decoder LLMs (Llama 3.1 8b‑Instruct, Gemma 7b, Qwen2.5 7b) under zero/few‑shot ICL and fine‑tuning paradigms; RoBERTa‑base as encoder baseline.
  • Final release: fine‑tuned RoBERTa binary crypto‑related classifier and labeled dataset; temporal robustness tested with a stratified 13‑month sample.
• Anomaly detection:
  • Per‑coin daily mention counts constructed across all channels.
  • CA‑CFAR (Cell‑Average Constant False Alarm Rate) applied to adapt thresholds per coin to detect anomalous days.
  • Candidate days selected for minute‑level analysis.
• Temporal / causal validation:
  • Minute‑level Regression Discontinuity Design (RDD) around burst onset to test immediate discontinuities in price/volume.
  • Difference‑in‑Differences (DiD) comparing targeted coin behavior to controls (Bitcoin, stablecoins) to account for market‑wide shocks.
  • Conservative criteria used to mark events as consistent with pump‑and‑dump.
• Additional analyses:
  • Psycholinguistics / LIWC‑style comparisons to test whether manipulative messages differ in tone/content from organic posts.
  • Synchronization metrics across channels to quantify the temporal compression of messaging.

Implications for AI Economics

• Detection strategy: Automated monitoring of crypto markets should combine semantic filtering (to avoid noisy keyword matches), adaptive temporal anomaly detectors, and causal/econometric validation rather than relying on text classifiers alone — because language can be easily mimicked.
• Information economics and market microstructure:
  • Public social amplification can act as the liquidity‑creating phase of manipulative operations; short‑lag social signals can causally influence price in thin markets.
  • Rapid information diffusion platforms (Telegram) can materially change price formation dynamics for low‑cap assets; modeling needs to incorporate platform‑driven demand shocks and synchronization among dispersed actors.
• Policy and regulation:
  • Evidence supports requiring enhanced monitoring and disclosure for coordinated public promotion around low‑cap assets; platform-level mitigations (rate limits, amplification detection) could reduce exit liquidity creation for manipulative schemes.
  • Text‑only moderation will be insufficient; regulators should consider interventions based on temporal coordination metrics and cross‑referencing transaction traces.
• Research directions for AI economists:
  • Use the provided dictionary and classifier to extend analysis to cross‑platform dynamics (Telegram ↔ Twitter ↔ Discord) and measure aggregate social spillovers on asset prices.
  • Incorporate network and actor‑level signals (channel credibility, follower overlap, bot activity) plus transaction‑level microstructure to improve causal identification and early warning systems.
  • Explore adversarial information strategies: since manipulative messages mimic organic discourse, adversaries may adapt to evade content detectors — prompting the need for robust, multi‑signal detection models (temporal, network, behavioral, and market features).
• Practical considerations:
  • Real‑time monitoring must balance accuracy and computational cost; the authors’ efficiency comparisons (LLMs vs. encoder models) highlight tradeoffs — small encoder models like fine‑tuned RoBERTa were effective and computationally feasible for large‑scale filtering.
  • For market impact estimation and policy simulations, quasi‑experimental econometric methods (RDD, DiD) are practical tools to separate coordinated social amplification from coincident organic market moves.

If you plan to cite this work, please use the authors’ recommended reference listed at the top. Links to the released assets (dictionary, dataset, model) are provided in the paper and accompanying repository.