How pump-and-dump detection works

Most pump detectors describe themselves as an algorithm and stop there. These are the actual rules ours runs, so when it flags a coin you can tell exactly what happened, and what did not.

The rules, exactly

Every 30 seconds, each market’s latest closed one-minute candle is compared with the candles before it. A coin is flagged when its closing price has moved by:

• 2% in one minute. Compared with the close one candle earlier.
• 5% in five minutes. Compared with the close five candles earlier.
• 7% in ten minutes. Compared with the close ten candles earlier.

Up is a pump and down is a dump, so there are six move events. Two more catch extremes: a new 24-hour high or low fires when the price comes within 0.1% of the highest or lowest point of the last 24 hours, measured over 96 fifteen-minute candles, but only if that 24-hour range is at least 3%. A quiet coin edging to a new high inside a 1% range is not flagged.

Which markets are watched

Five exchanges are scanned: Binance spot, and the perpetual futures on Binance, Bybit, OKX and Gate.io. Within those, three filters keep the board readable:

• Thin markets are skipped. A pair quoted in a dollar stablecoin needs at least $500,000 of trading in the last 24 hours. Below that, a single order can produce a 2% minute.
• Stablecoins are skipped. A dollar-pegged coin moving 2% is a depeg, not a pump.
• New listings wait for history. A coin needs at least twelve one-minute candles before it can be judged at all.

Detection reads closed one-minute candles, so a move is seen once its minute has finished and the next 30-second scan runs. That keeps a spike that reverses within the minute from being reported as if it had held.

Volume is a label, not a filter

Every event carries a relative-volume figure: the trigger minute’s trading volume divided by the average of the 20 minutes before it. At 1.5× or more the event is marked “Volume-confirmed”; below that it is marked “Unconfirmed”.

The point is that both kinds are shown. A 3% minute on thin volume is still a 3% minute, and hiding it would make the board look calmer than the market is. The tag lets you decide. On 15 October, 156 of the 300 most recent events were volume-confirmed, about half.

Why one move is not reported every 30 seconds

A coin that keeps running would otherwise trip the same rule on every scan. So each coin gets one event per exchange and event type every 15 minutes, unless the move grows: if it reaches 1.5 times the size of the last one reported, it is reported again. A 4% minute followed by another 4% minute stays one event; a 4% minute followed by a 6% minute is two.

A fast move is not proof of a scheme

A pump-and-dump scheme is a coordinated effort: buy a thin coin, promote it, sell into the buyers that arrive, and leave them holding it as the price collapses. The detector cannot see intent. It sees speed: price moving abnormally fast, with or without volume behind it.

Plenty of fast moves are not schemes: a listing, an exchange announcement, a liquidation cascade on a perpetual, or a large holder selling. Each event therefore carries context to weigh: the last candle’s shape, the coin’s Smart Setup score, and, on futures, the liquidations in the past hour. If longs are being liquidated, the move feeds on itself, which is covered in liquidation cascades explained.

Getting alerted

A pump/dump alert watches one coin. Choose which events count (pumps, dumps, 24-hour extremes, or any of them), an optional minimum move, and a cooldown. It reads the same feed every minute, looking at the last three minutes of events, so the first check comes about two minutes after you create it. The same repeat rule applies: a move that keeps going is reported once, then again only after 15 minutes or once it has grown 1.5 times.

To hear about any coin rather than one, the scanner in Scan All Coins runs the same rules across the market, with a cooldown of at least an hour per coin so a busy day does not use up your notifications in a morning.