Non-organic trading on low-cap Bybit spot markets: recurring-clip wash, a scheduled bot, and a pump-and-dump

Summary

Low-cap Bybit spot markets carry several distinct kinds of non-organic activity. This article collects four such pairs, analysed from free, key-less Bybit public trade dumps over May to June 2026, each measured against an organic control:

1. Recurring-clip wash trading, WCT/USDT and LMWR/USDT (2026-06-09 to 13). A handful of identical clip sizes carry far more of the tape than any single size would in a healthy market: a 1432-token clip is 8.7% of all WCT trades, WCT starts 59.6% of trades on leading digit 1 (against Benford’s 30.1%), LMWR’s recurring clips split near 50/50 buy and sell, and 13.6% of LMWR trades land on one second of the minute.
2. A scheduled wash bot on a fixed clock, CBK/USDT (May 2026). A self-trading bot fires about every 90 seconds, alternating side, so 74.6% of trades land on just two seconds (:05 all sells, :35 all buys). It churns about $448k with no pump and pays the spread on essentially every round trip, so it loses money rather than earning it.
3. A pump-and-dump, MCRT/USDT (2026-05-26). A flat ~0.000097 USDT market ran 162% to a 0.000255 blow-off and crashed 66% within the same hour, leaving 276 late buyers (about $14.7k) down roughly 53% the next day. Price impact, not volume inflation.

Read each as a flag, not a verdict: these are statistical and microstructure signatures of automated or otherwise non-organic activity. They mark markets whose reported activity deserves scrutiny, not a proof of who placed the orders.

Recurring-clip wash trading: WCT/USDT and LMWR/USDT

Two low-cap Bybit spot markets, WCT/USDT and LMWR/USDT, show automated, non-organic volume over 2026-06-09 to 2026-06-13. On both, a handful of identical clip sizes carry far more of the tape than any single size does in a healthy market.

First-digit distribution (Benford’s law)

The leading digit of organic trade sizes tends to follow Benford’s law: digit 1 about 30% of the time, falling smoothly to digit 9. Benford evidence has long been used to separate naturally occurring numbers from fabricated ones. A market whose sizes are generated by a bot repeating a few fixed clips breaks this pattern.

WCT/USDT puts 59.6% of its trades on a leading digit of 1, almost double the 30.1% expected under Benford. The Kolmogorov-Smirnov distance from Benford is 0.295 for WCT against 0.071 for the liquid control SOL/USDT (a comparative distance, not a goodness-of-fit p-value, which over-powers at this sample size and rejects the control too; see the methodology). The WCT break is driven entirely by repeated fixed-size clips, shown next.

Volume distribution: identical-clip recurrence

In an organic market no single size dominates the tape: small trades are common, large ones rare, and even the most-traded size is a small slice of the whole. SOL/USDT bears this out, with its most common size at just 4.4% of trades and the rest spread thin. WCT/USDT instead stacks a few fixed clips on top of that tail.

The 1432-token clip alone is 8.7% of all trades and appears on every day of the window. Over this window it is buy-heavy (1,692 buys vs 569 sells), while a paired 1000-token clip is sell-heavy (55 buys vs 784 sells) and a 1500-token clip is buy-heavy (891 vs 118); in the preceding week the same 1432 clip ran close to 50/50, so the clip persists while its direction rotates. This is consistent with one operator cycling a small set of fixed sizes on both sides of the book, inflating reported volume.

Buy/sell balance of recurring clips (self-trading)

When the same operator trades a fixed size against itself, that size shows up split roughly evenly between buy and sell. LMWR/USDT shows this cleanly.

The 400, 410 and 420 clips each split within a few percent of 50/50 buy versus sell by trade count (the count-based buysellratio, n/m, not the volume-weighted buysellratioabs). A directional trader would lean one way; a market maker would not repeat the same three sizes for thousands of trades. A balanced, fixed-size, two-sided tape is the textbook footprint of wash trading.

Time-of-trade distribution

Organic order flow arrives at random moments, so trades spread evenly across the 60 seconds of each minute (about 1.7% per second). A scheduled bot fires at the same offset and piles trades onto one second.

LMWR/USDT places 13.6% of its trades on one second of the minute, eight times the uniform rate, while the SOL/USDT control is flat. Combined with the balanced fixed-size clips, this points to a single automated process behind a large, non-organic share of the market’s reported activity.

A scheduled wash bot on a fixed clock: CBK/USDT

CBK/USDT (Cobak Token) is a low-cap Bybit spot market that, through May 2026, drifted inside a narrow 17% band and ended the month near where it started while about $448k changed hands. Volume with no sustained direction is the first hint of a wash: someone is generating turnover without building a position.

In an organic market trades spread fairly evenly across the 60 seconds of each minute. CBK does the opposite: 36.6% of its trades print on second :05 and 38.1% on :35, with almost nothing in between. Together those two seconds carry 74.6% of all trades and 59.6% of all volume, about 22 times what a uniform clock would put there. The clustering is tighter still: within :05 and :35 the trades land inside a roughly 130-millisecond window (the middle 80% of their millisecond offsets, p10 to p90), far sharper than discretionary trading could place them. The concentration is specific to CBK: two unrelated low-cap controls, GAIB/USDT and BOBA/USDT, stay near 3% on these seconds.

The two seconds are opposite sides of the book: second :05 is 98.8% sells and second :35 is 99.4% buys. The bot fires about every 90 seconds, alternating a sell and a buy; since 90 seconds is a minute and a half, each trade lands 30 seconds further around the clock, which is why the sells settle on :05 and the buys on :35. The legs are matched in size, about $129.7k of buys on :35 against $133.1k of sells on :05, and across the whole month buying and selling stay within about 4% of each other ($228.6k versus $219.7k), so the operator finishes flat. It is not a market maker earning the spread either: controlling for the month’s price drift, it buys on :35 about 0.4% above where it sells on :05 in nearly every hour, so every round trip loses money.

It hides its size, not its clock. Its single most common trade size is only 0.5% of trades, and the buy second alone carries 2,287 distinct sizes, so clip-recurrence and first-digit tests find nothing. Against the recurring-clip case above, the difference is the detection signal:

This is not a one-off burst. Every day of May, between 47% and 91% of that day’s trades (median 79%) land on :05 and :35, across every hour of the day. Nor is it confined to May: the same signature runs in April (about 67% of trades on the same two seconds), so it predates the window.

A pump-and-dump: MCRT/USDT

The first two cases inflate volume while the price barely moves. MCRT/USDT (MagicCraft) is the opposite signature. Through most of May 2026 it traded in a narrow band around 0.000097 to 0.000106 USDT on roughly $57k of volume a day, order flow split close to evenly. On 2026-05-26 the daily high jumped to 0.000255, more than 2.6x the pre-pump days, on a volume bar several times the monthly norm, then fell straight back.

The run-up is gradual then violent. From 2026-05-25 the price grinds up from the 0.000097 base over roughly 38 hours, then on 2026-05-26 accelerates into a near-vertical blow-off, topping at 0.0002551 at 14:03:37 UTC (+162% over base). The crash is immediate: within the same UTC hour the price collapses about 66% off the peak, back toward and then below the pre-pump base. The 14:00 hour alone carried about $59.7k on 1,821 trades, roughly 27 times the $2.2k median of a normal hour. About six hours before the top, at 08:14 UTC, MCRT printed a failed dry run: a one-minute spike to 0.0001474 (about 1.5x base) on roughly 19x a normal five-minute volume, which round-tripped within fifteen minutes. It is the sharpest five-minute up-move of the entire month, and it led nowhere.

A pump and dump transfers money from whoever buys near the top to whoever was already holding. The buy tape shows who paid: 276 buy trades, about $14.7k, executed above 1.5x the base price, almost all within half an hour of the 0.000255 peak, at an average fill of 0.000185 per trade (0.000166 weighted by notional). By the next day the token had settled near 0.000086, leaving those fills down about 53% per trade and about 48% dollar-weighted, below the level MCRT traded at before the pump began.

The move was specific to MCRT, not a market-wide event. Normalised to the start of the window, MCRT spikes to about 2.6x and falls back below where it began, while a liquid control, SOL/USDT, holds within about 3% over the same window. The crash five minutes off the peak was the largest single five-minute drop of the entire month, about 39 times the standard deviation of the month’s five-minute close-to-close log returns; the peak hour was the single busiest of all 744 active hours. Crypto returns are fat-tailed, so treat those multiples as a measure of scale rather than a Gaussian probability.

Unlike the wash cases above, this is price impact, not volume inflation. During the pump the single most common exact trade size was only 0.2% of trades (versus 0.6% on the quiet baseline), so there is no dominant repeated clip. What moved was the price: a thin book, lifted by sustained aggressive buying, ran 162% before the sellers stepped in. That separates a pump and dump (a price-manipulation pattern, paid for by late buyers) from wash trading (a volume-inflation pattern that leaves price roughly where it found it).

How this was measured

All figures use free, key-less data: Bybit’s public spot trade dumps (public.bybit.com/spot/<symbol>/), one row per executed trade (timestamp, price, size, side). The windows are 2026-06-09 to 13 for WCT/USDT and LMWR/USDT, and the full month of May 2026 for CBK/USDT (36,890 trades) and MCRT/USDT (227,644 trades). Each case is read against an organic control: SOL/USDT for the recurring-clip and pump-and-dump cases, GAIB/USDT and BOBA/USDT for CBK, and MCRT’s own pre-event week as the baseline for the pump-and-dump. The metrics map to the DN market-health family, each used with its exact definition. First-digit distribution (firstdigitdist/benfordlawtest) is reported as the Kolmogorov-Smirnov distance from Benford, a comparative effect size, rather than a goodness-of-fit p-value: at these sample sizes the p-value is over-powered and rejects strict Benford for the organic control too, so it cannot discriminate washed from clean. Volume distribution (volumedist) is the distribution of executed trade sizes, summarised here by the share carried by the most-recurring exact sizes rather than as a fixed-bin histogram, because the signal is a few dominant clips standing on an otherwise thin tail. Buy/sell balance is the count-based buysellratio (buy trades divided by total trades, n/m), not the volume-weighted buysellratioabs. Time-of-trade (timeoftrade) is the share of trades falling on each second of the minute against the 1.7% uniform rate. The same non-organic-volume markers are documented in the wiki’s earlier Huobi (2023) and Senso (2021) posts.

A robustness note on WCT: its signature is stable week to week. In the preceding week (2026-06-02 to 06) WCT still puts 61% of trades on leading digit 1 and the 1432 clip is still 9% of the tape. LMWR’s one-second clustering also persists, but its exact clip sizes rotate between weeks, so its footprint is that of an episodic bot rather than a fixed one.

Each case is fully reproducible from its companion repository, run against the dated dumps above: mkzung/bybit-wash-trading-analysis (WCT, LMWR), mkzung/cbk-scheduled-wash-analysis (CBK), and mkzung/mcrt-pump-dump-analysis (MCRT). Each recomputes and asserts its headline numbers; the processed per-figure datasets for the CBK and MCRT cases are committed alongside this post under data/.

Scope

Each reading is a pattern, not an attribution: a single venue, low-cap markets, read against controls rather than a labelled ground truth. The recurring clips, the fixed-clock self-wash, and the one-hour run-and-reverse mark these markets as worth scrutiny and their reported activity as suspect, not a proof of who placed the orders.