Using Graph Cycle Detection to Reveal Suspicious Ethereum Token Transfer Behaviour

In the unregulated world of Initial Coin Offerings (ICOs), hiding malicious trading is all too easy in a large-scale set of transactions. This paper uses a graph-based representation of the blockchain to identify a topology that reveals suspicious intent to manipulate the perceived value of those offerings. As the computational complexity of identifying this topology could be prohibitive for unfiltered data-sets, this work derives metrics indicative of the topology. Using these explicitly-defined metrics and a past degradation of service on the Ethereum network originating with the iFishYunYu token, we show how this approach can reveal it to have been a deliberate attack, rather than simply an unprecedentedly highly-traded token. The formalization of this approach in the paper will allow detection of other such 'pump-and-dump' attacks in the future.