The RIVER token used to defraud investors: evidence and bitget’s involvement
On-chain analysis points to a coordinated price manipulation scheme involving the RIVER token, carried out with the use of Bitget’s exchange infrastructure.
30.01.2026
242
4 min
0
In late 2025, a series of transactions revealed a large-scale manipulation scheme involving the RIVER token. A significant share of the token supply was accumulated through centralized exchanges, after which the price surged more than 15x. On-chain data shows this was not organic growth, but a coordinated operation involving hundreds of wallets, multi-step transaction obfuscation, and active use of exchange infrastructure. GetBlock AML Research presents a detailed breakdown of the manipulation surrounding RIVER.
Initial Capital Distribution and a Network of Thousands of Addresses
A core element of the scheme was the mass distribution of BNB to 362 recipients. Each recipient then initiated a chain of nine sequential transaction “hops.” This process ultimately produced a network of 2,418 addresses linked by a single, consistent fund flow pattern.
| The starting point of the chain was the address: |
| 0x365b689f33f6Fe3E4aEf5057061A006A09099A54 |
This structure is commonly used to:
- Blur on-chain relationships
- Complicate attribution
- Conceal centralized control over assets
In effect, instead of one large on-chain player, thousands of seemingly “independent” addresses appeared.
Large-Scale RIVER Withdrawals From Bitget
At the same time the address network was being built, large volumes of RIVER were withdrawn from the Bitget exchange. The analysis identified two key withdrawal periods involving just seven wallets, all of which were later linked to the final addresses in the BNB chains.
First period: December 5
- RIVER price: ~$4
- Withdrawn: ~2 million tokens
- Wallets used: 5
Second period: December 29
- Wallets used: 2 (previously funded via the same BNB chains)
- Withdrawn: ~1 million tokens
- About 80% of these tokens have not moved since
In total:
- Total withdrawn value: approximately $22 million
- Average withdrawal price: $4.12 per RIVER
At the token’s all-time high, these holdings were worth roughly $350 million, implying a realized multiple of about 15.3x. Estimates suggest that nearly half of RIVER’s total supply ended up concentrated within this connected group of addresses.
Artificial Price Growth and Short Liquidations
RIVER’s price rally began after the second withdrawal phase, when available market supply dropped sharply. From that point on, the asset consistently traded with a negative funding rate, indicating a dominance of short positions.
This created ideal conditions for:
- Repeated short squeezes
- Forced liquidations
- Liquidity inflows from traders betting on price declines
In practice, RIVER’s rise was fueled by hundreds of millions of dollars in short liquidations rather than genuine market demand.
Tokens Flowing Back to the Exchange
Notably, many tokens previously withdrawn from Bitget eventually flowed back to the same exchange. This suggests a closed-loop structure:
Withdrawal of tokens → reduced supply Price increase → pressure on shorts Liquidations → liquidity inflow Tokens returned to the exchange → profit realization
Such a pattern is typical of centrally managed operations, not organic investor behavior.
The Role of Exchange Infrastructure
The analysis shows Bitget appearing systematically throughout the scheme:
- As the source of large token volumes
- As the final destination for returning assets
- As the venue where supply concentration went unchecked
Similar patterns have been observed with other tokens on Bitget and several major exchanges. This raises the question of whether the exchange was:
- Simply negligent in its risk controls,
- Actively facilitating manipulation, or
- Willfully ignoring what was happening.
To enable independent verification, the full network of 2,418 addresses was grouped into a single entity and published on the Arkham analytics platform.
Conclusion
The collected evidence points to a classic but unusually large-scale example of supply cornering—artificially constraining token supply to extract profits through derivatives market mechanics.
Key indicators include:
- Centralized control via thousands of addresses
- Multi-layered transaction obfuscation
- Mass withdrawals from an exchange
- Artificially created scarcity
- Price growth driven by liquidations
- Assets returning to the same exchange
The RIVER case is a clear illustration of how, when on-chain tools intersect with weak exchange oversight, the market can be transformed into a mechanism for redistributing hundreds of millions of dollars.
Useful material?
Research
A financial system is already up and running on public blockchains, with loans, analogues of U.S. Treasuries, and automated capital markets. More than $551 billion has flowed through DeFi protocols — but most of that activity has nothing to do with the real economy and everything to do with the speculative build-up of risk.
May 29, 2026
Research
Around 97% of Chinese suppliers of chemicals used to make fentanyl accept payment in cryptocurrency. The volume of such transactions continues to grow alongside the global market for synthetic drugs
May 22, 2026
Research
For the first time, the new law makes blockchain analytics an officially mandatory tool of financial oversight in the United States. Authorities will also gain the power to restrict transactions with foreign crypto services tied to money-laundering risks.
May 20, 2026
Research
Working with cryptocurrencies requires more than just new technology — it demands a complete overhaul of internal processes. We explain how the financial sector is learning to control digital assets and detect threats
May 8, 2026
Research
The scammers attempted to conceal over $90 million through complex cryptocurrency transactions. However, part of the funds was successfully traced and frozen.
May 6, 2026
Research
Just two attacks accounted for 76% of all crypto losses in 2026 and generated hundreds of millions in profit for hackers. Here’s how North Korea executes some of the most sophisticated and precise attacks in the industry.
May 1, 2026
Telegram
Twitter