Initial coin offerings, information disclosure, and fraud

Since the advent of Bitcoin in 2008, which until today remains the most widely used digital currency worldwide, digital currencies have gained in popularity. More recently, tokens based on different blockchains have been created to raise funds from a large crowd of people for the development of a project or firm (Adhami et al. 2018; Fisch 2019). At the same time, concerns about fraud have arisen, claiming that many of these initial coin offerings (ICOs) are scams (Liebau and Schueffel 2019). We investigate whether information provided prior to the ICO gives hints on the risk of fraud, and document the severity of the phenomenon. Understanding the extent of fraud in ICOs and its determinants is crucial if it is to become a new source of entrepreneurial finance (Ackermann et al. 2020; Block et al. 2018; Howell et al. 2020; Liebau and Schueffel 2019; Momtaz 2020a, b).

Similar to an initial public offering of corporate securities where a prospectus is published before the securities issuance, firms planning an ICO draft a white paper, which in the past was not formally approved by financial markets authorities. In this study, we collect detailed information from the white papers for a sample of 1393 ICOs that took place worldwide from September 2016 to July 2018. We have coded the white papers along various dimensions in terms of type and extent of information provided to investors. Regulators and professionals have been arguing that different indicators, so-called red flags, may hint to the fact that an ICO could be a fraud (Kaal and Dell’Erba 2019). These include, for example, whether there is a soft cap during the ICO, whether sufficient information is available on the founders, or how the funds will be spent. We construct measures for a large range of these red flags to study their predictive power. In a next step, we run a rigorous search of fraud cases that were reported in the media. A thorough search is done for every ICO in our sample.

We obtain the following results. First, we were able to classify fraudulent behavior into seven categories. Some fraud cases even fall into more than one category. Fraud can originate from corporate outsiders or the issuers itself. Most often, fraudsters deceive investors of ICOs through phishing attacks, in which case external fraudsters or the issuer itself unduly gets hold of the investments. Frequently, the issuer also simply disappears after receiving the funds, which has often been referred to as exit fraud. In total, we could identify 274 fraud cases within the 1393 ICOs studied; 188 suspected and 175 confirmed fraud cases.¹ Second, we find that whether specific information is disclosed hardly predicts whether an issuer is fraudulent or not. In other words, the information provided during the issuance is hardly useful to predict whether the venture behind the ICOs is a fraud. The information provided by the issuer may simply be wrong and unreliable in the first place, which indicates a need to externally verify the information that is voluntarily provided.

Two important factors relate to fraudulent cases. The first is the amount raised, as ICOs that eventually are found to be fraudulent raise on average almost four times more money. While the causal relation is unclear, one possible reason for this positive relation is that the incentives to engage in fraud are greater the more money is raised (Becker 1968). Corporate outsiders and insiders, such as founders, may be more tempted to engage in fraud if doing so is worthwhile. In economic terms, a one-standard deviation increase in the amount raised is associated with an increase in the fraud probability of 38%. The second factor predicting fraud is whether the code of the venture was disclosed on GitHub, a platform where startups can post their code in order for others to verify the lack of errors. Disclosing the code on GitHub is generally viewed as a sign of trustworthiness and transparency and thus helpful to raise more money (Dabbish et al. 2012; Amsden and Schweizer 2019; Howell et al. 2020). However, we document that such disclosure increases the likelihood of phishing by corporate outsiders by 7%, thereby also generating risks for investors and the startup. This finding is new to the literature and important for the tech community. In particular, it reveals a “dark side” of code disclosure on GitHub, while prior studies have focused mostly on the “bright side” by showing that disclosure helps in raising more money.

These findings contribute to those of other studies (Fisch and Momtaz 2020; Momtaz 2020a), highlighting the important role of institutional investors and other institutions (e.g., investor associations, industry codes of conduct, certifying institutions, funding platforms) in verifying endogenous signals by the issuer. The existence of these institutions could not only reduce moral hazard by the issuer but also mitigate internal fraud. Momtaz (2020a) evidences significant moral hazard problems in ICO-funded firms, whereas Fisch and Momtaz (2020) document that the participation of institutional investors leads to higher post-ICO performance. Although neither study explicitly investigates fraud, moral hazard and performance differentials may be related to deception as well.

While our analysis contributes mainly to understanding the extent of fraud in ICOs, in a broader context, it also shows how markets evolve if no specific regulation is in place or entrepreneurs at least believe that no regulation exists. Given that traditional stock markets are now regulated all over the world, the phenomenon of ICOs allows for the study of firm behavior that is comparable to the situation before the implementation of regulations such as the Securities Act of 1933 and the Exchange Act of 1934. Other studies have examined specific forms of fraud, such as pump-and-dump schemes (Hamrick et al. 2020; Li et al. 2019) and Ponzi schemes on Ethereum (Bartoletti et al. 2020). Hamrick et al. (2020) construct different measures of fraud signals on two social media channels (Discord and Telegram) and conclude that those initiating these schemes may earn profits. Li et al. (2019) provide evidence that pump-and-dump schemes eventually reduce liquidity and the price of cryptocurrencies. The results of these articles are specific to pump-and-dump schemes, and other forms of fraud are unlikely to work through the same channels. Bartoletti et al. (2020) examine the extent and impact of Ponzi schemes on Ethereum by analyzing smart contracts on Ponzi-typical patterns. They identify 12% of smart contracts as Ponzi schemes, but these affect only a small number of the transactions on Ethereum (0.08%). In this article, we extend the set of fraud analyzed. Moreover, while previous work examines the trading impact of fraud, we explore the determinants of fraud initiated by either the issuing firm or outsiders. Liebau and Schueffel (2019) offer early evidence that fraud (or “scam”) occurs much less often in ICOs than often claimed. However, they neither uncover the drivers of fraud nor differentiate between different types of fraud. Other articles studying fraud in ICOs scrutinize the regulatory framework but are mostly conceptual (e.g., Chohan 2019).

The remainder of the article is structured as follows. First, we provide examples of common types of fraud in the ICO market and outline our hypothesis (Section 2). Second, we present our data and results (Sections 3 and 4). Finally, we discuss our findings and provide policy conclusions (Section 5).

Digitalization has brought new forms of finance for startups (Block et al. 2018). Crowdfunding was probably the first form in this development. The first platforms have emerged in 2008 and the industry has professionalized, with significant growth rates every year since then². However, new technologies have brought the digitalization a step further, including the invention of the blockchain, which enables new forms of contracting and issuance of tokens and securities. Recently, startups have started using the blockchain to raise money in the form of an ICO (Block et al. 2020).

While this business model largely resembles reward-based crowdfunding, there are also many differences. The tokens will be created through an ICO so that the crowd can buy more tokens than what they need for consumption purposes, because the excess tokens can be resold on the secondary market. Moreover, the fact that the tokens are traded later makes them a tradable asset, more in line with a security. Indeed, because trading takes place on exchanges before the platform goes online, investors may also participate in the ICO by buying tokens with the intention of selling them shortly after on an exchange to make profits. In some cases, tokens are not created as means of payments for services provided on the platform, but the sole purpose of the token is to participate in the future profits of the startup. In this case, the tokens created are referred to as securities or investment tokens.

The value of the tokens is thus related to the chances of project success. If the project cannot be developed, the tokens essentially become worthless. By contrast, the value of the token appreciates when the project becomes successful so that early backers financially benefit. Most often, startups use Ethereum as the blockchain of choice as this was one of the first blockchains that support complex and autonomous self-executing contracts.

We now turn to assessing whether the differences between fraudulent and non-fraudulent ICOs identified in the univariate analysis also hold in the multivariate setting. To this end, we run Probit regressions with three different dependent variables: Confirmed Fraud, Suspected Fraud, and Fraud. The latter equals 1 if an ICO is either a suspected or confirmed fraud, and thus combines both subcategories in one variable. We run the analyses on all three variables to assess the robustness of our findings. While we expect many suspected fraud cases to eventually be confirmed,²² examining them separately (the variable Suspected Fraud) and together with other cases (through to combined variable Fraud) is worthwhile. Table 4 presents the results. We include a large set of possible explanatory factors, while ensuring limited multicollinearity among our explanatory variables. Many of the explanatory variables in our analysis are similar to those in other studies examining the determinants of funding success (e.g., Adhami et al. 2018; Fisch 2019; Huang et al. 2020). Models (1)–(3) use the largest possible sample. In models (4)–(6), we further include Amount raised and Token distributed as additional factors. In particular, adding the variable Amount raised is useful given that we found in the univariate setting that fraudulent ICOs raised almost four times more than non-fraudulent ones. These additions, however, reduce our sample to about half.

Most factors are not significant, hinting to the fact that predicting fraud is very difficult.²³ The presence of a soft cap reduces the risk of fraud; however, this significant result disappears when controlling for the amount raised. One reason why a soft cap could reduce fraud is because a larger soft cap requires a large participation by investors, similar to the all-or-nothing effect in crowdfunding (Cumming et al. 2020b). If not enough investors find the issuance sufficiently trustworthy and valuable, it will fail. Therefore, entrepreneurs who plan to engage in fraud are less inclined to define a soft cap, because they bear the risk of not raising any money at all.

One factor that consistently leads to higher fraud is when the startup has disclosed its code on GitHub. This result is at first sight surprising, given that disclosing the code is typically viewed as a sign of trustworthiness and transparency (Dabbish et al. 2012; Amsden and Schweizer 2019; Howell et al. 2020). The difference in the probability of having a fraudulent offer is 6.6–7.4%, depending on the specification considered (model (3) or (6)). Our results therefore stand in contrast to the common view that disclosing information on GitHub is good. A closer examination of what types of fraud are associated with disclosure on GitHub offers a first clue on why fraud might become more prevalent (see Table 5). Phishing and hacker attacks are more common when code is published on GitHub (65.0% vs. 44.0%), which is a main type of fraud in this particular case. Table 5 presents the distribution of fraud cases by disclosure on GitHub. Fraud cases in which the code was disclosed before the ICO on GitHub are more often external than internal fraud, as opposed to fraud cases without prior disclosure. By contrast, exit fraud, security fraud, and Ponzi schemes, all of which are types of internal fraud, are less likely. These observations suggest that GitHub induces more often externally driven phishing and hacker attacks. One likely reason is that phishing and hacker attacks become easier for corporate outsiders when the code of the venture is disclosed. Thus, while recent ICO studies (e.g., Amsden and Schweizer 2019; Howell et al. 2020) have argued that disclosing the code on GitHub is helpful to build trust between the startup and the investors, we find that it encourages external fraudsters to misuse the disclosed information to their own advantage and at the expense of investors. Thus, there is a clear trade-off in deciding to disclose information on GitHub.

Returning to Table 4, another important result is that having raised more funds is associated with a greater likelihood of fraud (models (4)–(6)), confirming our initial univariate finding that size matters. One reason proposed before is that the benefit of fraud is higher because there is more money to steal. In economic terms, a one-standard deviation increase in the amount raised leads to an increase in the fraud probability of 38%, which is a substantial effect. Our results further show that the amount raised primarily affects suspected fraud, though the coefficient for confirmed fraud is also significant at the 10% level. This relationship is primarily driven by internal suspected fraud, which is consistent with the view that corporate insiders have greater incentives to engage in fraud if there is more to steal.

An underlying assumption is that the significant result on GitHub is due to external and not internal fraud. Indeed, issuers’ benefits from fraud are unrelated to whether the code is disclosed on GitHub. However, the fraud is facilitated for corporate outsiders, thus the increased risk of external fraud. To corroborate this assumption, we run again the same analysis as in Table 4 but separately for external and internal fraud cases. Results provided in Table 6 confirm that the effect of GitHub is driven by external fraud (the first six columns regress on external fraud, the last six on internal fraud).

A final question we try to address is whether fraudulent ICOs under- or outperform directly after the ICO. This question is nontrivial, because some fraudulent issuers may ex ante decide not to list because of the cost involved in doing so on an exchange (e.g., internal fraud such as exit fraud), while other types of fraud are impossible to carry out in the absence of a listing (e.g., external fraud such as pump-and-dump schemes). Pump-and-dump schemes only become potentially profitable strategies if one can trade. Similarly, Ponzi schemes require that the ICO lasts long enough so that a pyramid can be maintained over a sufficient period. If it stops, the organizers can no longer pay first investors. Measuring performance is not an easy task, because fraudulent cases are less likely to list in the first place and the remaining sample for which price data are available suffers from a survivorship bias. We therefore measure ICO performance by whether or not the token got listed on an exchange, a measure previously used in the literature to proxy for successful ICOs (Howell et al. 2020).

Table 7 shows the distribution of fraudulent cases for the subsample of ICOs that eventually got listed and those that did not. The last two columns show the tests for the difference in means of these two subsamples. The subsample of ICOs with listing includes more fraudulent cases (10.1% vs. 6.7%). This difference is mostly driven by external fraud cases, most of them being phishing and hacker attacks. We confirm these differences in a multivariate setting as well.

In Table 8, we run Probit regressions with the dichotomous dependent variable equal to 1 if the token gets listed on an exchange and 0 otherwise. We test the impact of fraud on that probability, while controlling for all the factors considered in Table 6. We find that fraud is associated with an 11.5% higher probability of listing, though the impact becomes smaller and nonsignificant when we control for the amount raised during the ICO and the number of tokens distributed. However, the last two columns indicate that external fraud is strongly related to a token being listed, and this effect remains significant even after the inclusion of additional controls. The correlation is also economically meaningful. One concern with the interpretation of this result is causality, because in some cases, fraud may only be detected after the listing. Corporate insiders and outsiders might likewise decide to engage in a pump-and-dump scheme only after the token is listed.

In unreported regressions, we also test whether fraud is correlated with post-ICO performance. We find that external fraud in the form of pump and dump is related to positive performance after 180 days of trading (calculated as the token return over that period minus the return of the MSCI World Index), which might result from fraudsters first artificially inflating the price of a token through false information, to sell the token that was initially bought cheaply at a higher price. Thus, ICO returns are not a good proxy for fraud, because different types of fraud affect returns at least initially in opposing directions. A worthwhile avenue of future research would be to investigate whether ICOs have developed a sustainable business model and whether their failure rate is higher than that in other technology sectors.

ICOs combine the financing of a venture through a large crowd with the issuance of a new digital token. Therefore, ICOs share many similarities with equity and reward-based crowdfunding. This implies that the experience gained by national regulators in the crowdfunding domain—especially regarding equity crowdfunding—as well as the knowledge obtained by market participants may be useful for the discussion on whether and how to regulate ICOs. ICOs could be particularly useful when people want to own the platform they are using or would like to use the tokens as means of exchange. For example, the users of LinkedIn or Facebook could own the platform themselves and use tokens to pay for hosting and programming services of the website.

The establishment of professional platforms where ICO issues could take place, similar to equity crowdfunding campaigns that are frequently run on specialized platforms and in some countries are even required by law to use a platform (Hornuf et al. 2018), may facilitate the implementation of both, formal regulation and self-regulation.²⁴ These platforms may even be existing equity crowdfunding platforms integrating ICOs, as they have done similar expansions for other asset classes such as real estate crowdfunding, fixed income products, and secondary markets. In fact, combining crowdfunding and ICOs may be optimal to overcome the current inefficiencies of crowdfunding or the shortcomings of ICOs respectively (Ackermann et al. 2020; Block et al. 2020). Moreover, these platforms could use small business credit scoring, a technology that has been used by financial institutions to evaluate applicants for small loans that involves analyzing data about the owner of the firm and the limited data about the firm itself (Berger and Frame 2007). Using such platforms might not only reduce the likelihood of fraud but also decrease the costs of capital (Li et al. 2020).

In contrast with findings in reward-based crowdfunding (Cumming et al. 2020a), the extent of information disclosure offers little opportunity to identify possible fraud, presumably due to the increasing use of template white papers. A more thorough analysis of the white papers is therefore needed. This could be done by institutional investors (Momtaz 2020a), in line with the notion that it is often optimal to share ownership (Narayanan and Lévesque 2019). Alternatively, specialized platforms might be in a comparatively better position to run background checks and analyze the truthfulness of the information in the white papers, because unlike one-time investors and issuers, they can specialize in conducting such a due diligence (Coffee 2006).

Finally, future research might investigate only the fraud cases that were ultimately classified as fraudulent or illegal by a court or administrative agency such as the SEC. Our approach was based on a method that was developed for reward-based crowdfunding (Cumming et al. 2020a) and which we consequently adapted to the ICO market. Our approach led to a conservative sample of fraud cases. Another method could be based on a comparison between the content of white papers and firm facts verified by Internet sources or third parties (e.g., through reverse image searches or company registers). Moreover, future research could classify the sources of fraud, that is, whether the fraud was planned from the outset or entrepreneurs resorted to fraud during or after the ICO offering. Our method was built on distinguishing fraud conducted by corporate insiders from fraud conducted by outsiders, which had important implications for our analysis of information misuse of disclosed codes on GitHub.