Key findings
In this case, we explore how Ava Labs, the for profit corporation behind the Avalanche blockchain, uses an army of thousands of fake "astroturf" social media accounts to create a misleading impression of public opinion that they can configure at will, helping them sell their AVAX tokens, slander rivals, and fool its community on key issues.
Example applications of the astroturf accounts include:
In this case study, we explore Ava Labs' use of fake Twitter handles, through which they post tens of thousands of fake messages and replies that parrot nefarious themes and wording defined by Ava Labs leaders such as Emin Gün Sirer, while they remain hidden in the background.
Before the empirical analysis, we start with some new spy video!
We recently talked to Evan Richards, who held a senior engineering role at Ava Labs from November 2020 to May 2022, gaining an excellent vantage point into their activities and modus operandi. He says that the kinds of crooked behavior we reported on in our seminal Case #3 are likely to continue, and reveals that Ava Labs' use of fake astroturf accounts was routine.
Those caught on spy video in earlier cases have often been involved in serious wrongdoing, but we have no reason to believe that Evan has done anything wrong, other than perhaps staying around when the nature of the Ava Labs operations became clear. We wish him well and hope he enjoys his cameo on Crypto Leaks.
Before performing an empirical analysis of Ava Labs astroturf system, lets dive into another fascinating and insightful conversation...
A lot can be understood about a project by how it defines competitors.
Ava Labs does not define competitors of its Avalanche blockchain in terms of their
functionality, or differing visions for the future of crypto.
Instead, using the logic of a vampire, it defines them as chains with a higher market
capitalization, since it believes that by attacking them they can cause
the other chain's liquidity to flow into the Avalanche blockchain's AVAX token
— which they hold in vast numbers.
| “ | Avalanche sets its sights on any chain with a higher market cap... taking a vampires attitude. |
For anyone that believes in the great cypherpunk project that is crypto, this attitude is anathema. It reflects the beliefs of those who see blockchain as a giant zero-sum casino where tokens collect investor money, rather than a domain where meaningful and impactful technology can flourish.
Ava Labs constructed a bridge to transport tokens on other blockchains onto
Avalanche by wrapping them. Ava Labs promoted this as furthering Web3 collaboration and a
multi-chain future, but it seems that it was more about sucking liquidity from those
they saw as "competitors" (i.e. chains that have larger market caps).
| “ | Oh, anyone they're targeting with their bridge. |
Ava Labs' giant boiler room machine, which involves bots, shills and trolls speaking through their astroturf social media accounts, is illegal in nature. Yet, its usage is so routine and pervasive, that its existence and purpose is common knowledge amongst its engineering (some of whom also help maintain the systems involved). Here Evan describes how they own "astroturf" fan accounts in places like Twitter and Telegram.
As we shall see, so pervasive is this system, that the reality is, if you have occasionally
seen ardent tweets promoting AVAX or attacking Avalanche rivals, or proclamations and boosty
dialogs in public chat groups on services like Telegram, then very probably you have seen
their astroturf accounts in action.
| “ | Avalanche, to give you a concrete example, has like astroturfed fan accounts in places as — in places like Twitter, or in Telegram chats ... allegedly, allegedly will pay people to boost their coins in social media |
Ava Labs' astroturf accounts aren't just for promoting their AVAX token directly,
but also for targeting competitors.
| “ | to target competitors? ... Oh, oh yeah |
Emin Gün Sirer's own Ava Labs engineers say that in public he makes provably false arguments in bad faith.
This is surprising, as he likes to promote his background as an associate professor, and
this kind of behavior is diametrically opposed to the academic ethos.
| “ | They have sometimes been caught making perhaps bad faith, even provable false arguments |
Evan claims that Emin Gün Sirer (founder and CEO) and Kevin Seqniki (Chief Operating Officer) have
volatile personalities, which could cause damage to the public image of Avalanche.
| “ | 'volatile but interesting personalities' — Yes! |
Evan worries that the excitability of Emin and Kevin will result in them being caught in
a lie, which will undermine the trust people have in Ava Labs and the Avalanche blockchain.
| “ | a lot of actors won't interact with your project if you've ever been caught in a lie ... or anything like that |
Evan relays how those involved with Algorand, who have presumably been on the receiving
end of false statements, and curses by Ava Labs' astroturf accounts, have stated regret
at Ava's behavior. He defines Avalanche as being "back-alley" in nature, and says this
is reflected in the make-up of their team.
| “ | Whereas, Avalanche takes a very, like, Twitter-first approach, back-alley, anonymous forums, things like that. |
Blockchains are created by decentralized network protocols that depend on consensus mathematics and cryptography. Their protocols connect computing nodes run by independent parties, then creating a single virtual platform that is tamperproof and unstoppable that can host things like token ledgers, DeFi, and Web3 services. The network protocols and software code involved must always be shared with the world, so that they are publicly verifiable, and anyone with the requisite skills can validate that they work correctly and are secure.
A blockchain bridge is used to produce a "wrapped" copy of a crypto asset that resides on a source blockchain, on a destination blockchain, where it can be used in DeFi systems that it hosts. Ava Labs built and operates the Avalanche Bridge, which wraps assets on other blockchains, and allows them to be used on the Avalanche blockchain.
Blockchain bridges are not blockchains, and necessarily involve a fair degree of centralization. In most cases, their operators effectively act as custodians of the assets they wrap. However, the security of bridges remains highly important, even though they provide less security than a blockchain can. For this reason, normally their workings are publicly shared, so that the technical security they provide is also publicly verifiable.
If the Avalanche Bridge were to get hacked, then the assets that its users hold on source blockchains could be stolen, making their wrapped assets worthless. Moreover, if it were hacked, it could be used to print new worthless wrapped assets on Avalanche from thin air. In both cases, holders of wrapped assets, and Avalanche DeFi users, could suffer massive losses. The risks are clear since billions of dollars of assets have recently been stolen from blockchain bridges.
It is therefore highly concerning to hear that the Avalanche Bridge is created by
special software run by five Ava Labs "partners," whose code nobody has seen outside
of Ava Labs — which by definition is not publicly verifiable, and therefore
depends entirely for its security on centralized trust in Ava Labs, rather than mathematics
— and that it also relies for security
upon SGX hardware,
which is known to be flawed and easily broken.
| “ | all running code that no one's allowed to see. There are many documented exploits of the hardware they're using ... if three of them were hacked or just decided to collude, they could print an arbitrary amount of money on the Avalanche network |
Emin Gün Sirer wishes to style himself as the "Father of Blockchain," in what is possibly a well-developed "Satoshi complex." Arguably, this has led to him take unusual actions such as asking bought law firm Roche Freedman to attack Craig Wright, as per Case #3, and make weird and baseless claims, including recently that he began working on blockchains in 2002, then inventing Proof-of-Work six years before Satoshi, as per his recent arresting statements on a video interview on decrypt (starts at 4 mins 20 secs)!
In another sign that he has a "Satoshi complex," Avalanche's consensus system
was shared on Twitter by a mysterious "Team Rocket," in the anonymous style of Satoshi,
even though it was very obviously created by Emin himself.
Evan confirms that even his own engineers consider the pantomime absurd.
We will return to this later in the case when examining the pervasive
astroturf messaging that Emin is the "Father of Blockchain."
| “ | But Avalanche really does it hard [deception], by obfuscating who even designed their consensus mechanism ... it seems very clear that it's Gün and Kevin |
Evan believes that Emin is trying to cynically ape Satoshi.
| “ | they're trying to steal and crib from the Satoshi Nakamoto origin story |
Evan chafes against Ava Labs plans to become blockchain "patent trolls" —
albeit, in fairness, a study of the nature of their patents and enforcement actions would have
to be performed before giving them this moniker.
| “ | the way that Avalanche breaks the ethos of cryptocurrency |
It has been well-documented how Ava Labs paid several Ethereum DeFi projects to
copy-paste their frameworks onto the Avalanche network to bootstrap its DeFi
(Avalanche is essentially a fork of Ethereum, which is why that was possible).
But what about the leading "native" DeFi projects that have been built on
Avalanche, such as its Pangolin DEX? Rather than being independent ecosystem
projects, it seems likely many are actually Ava Labs in disguise.
| “ | reveals that it was in fact Avalanche, pretending not to be their own product |
Our Case #3 covered how Ava Labs gave bought law firm
Roche Freedman, AVAX tokens worth hundreds of millions of dollars to attack rivals,
create decoy cases in crypto that drew regulators like the SEC away from Ava Labs,
pursue Emin Gün Sirer's personal vendettas, and extract confidential information
from the crypto industry using legal discovery processes.
The question is, will they continue with this kind of behavior?
| “ | That's a great question. I would bet on it continuing in the future, but that's not anything--, you know, I'm really scared of getting sued |
Crypto can be so extreme, it can be hard for outsiders to grok what is going on, even when presented with the facts: That Sam Bankman-Fried could have fooled the world he was a financial genius using funds he stole from FTX customers, wooed Silicon Valley, attacked blockchain ecosystems that threatended his investments, subverted the crypto and mainstream press, and even democracy itself, as per our recent Case #4. That a senior journalist at the New York Times, who was associated with Sam, would amplify one of his attacks, possibly as a favor, as per our Case #2. That Ava Labs could subvert and weaponize the American legal system to attack rivals, create decoys for regulators, pursue Emin's vendettas, and collect confidential information, as per our Case #3... it all seems implausible until you actually see the hard evidence.
Crypto became the wildest of Wild Wests. Things got really, really hairy, and we are still in the process of weeding out the cowboys and bad actors. Sadly, a recurring theme is bad guys masquerading as good guys, while tarnishing honest actors. The road to fixing this will be long, but it starts with sunlight.
The scale of Ava Lab's astroturf operation is another stunning revelation...
Our investigation identified 1293 profiles on Twitter that we believe are fake astroturf accounts controlled by Ava Labs.
Download the full list: c5-avalabs-astroturf.pdf
The astroturf accounts appear to be organized into 5 distinct networks, for reasons as yet unknown.
"Astroturf" account definition: An astroturf account is a fake social media account, whose sole purpose is to promote messaging on behalf of Ava Labs. Sometimes, the accounts are controlled by technical infrastructure, through which Ava Labs actors can push out messages in an automated way. Other times, they are controlled by freelance operators, or direct contractors of Ava Labs, who often control several astroturf accounts each, and push general messaging that is centrally disseminated. The accounts all contain some normal-looking posts to disguise their nature and purpose.
In the databse, we assign a "botometer" score to accounts, which reflects the likelihood that they are astroturf.
Of the overall population we identified, 17% had a botometer score of 0.6-1, which equates to a 56% likelihood of being a bot, 48% had a score of 1-2, which equates to a 75% likelihood , 15% had a score of 2-3, which equates to a 80% likelihood, 12% had a score of 3-4, which equates to a 85% likelihood, and 6% of all bots had a score of 4-5, which equates to a 90% likehlihood.
Large as the database we share is, it not even reflect the full scale of what we initially encountered — because as our research progressed, we found that suspect accounts were disappearing from Twitter in real time. We are not sure whether our investigation was rumbled, and Ava Labs was quickly trying to clean house, or this was Elon Musk's new Twitter closing down bots.
The exact means through which the astroturf accounts are created and controlled isn't known, and likely several pathways exist. However, what is easily seen, is that Ava Labs has long enlisted freelance "marketing" help in the style of Chinese water army workers, who typically reside in poor countries where there is little alternative work. The scheme involves community websites that Ava Labs operates, where they can submit their "work" in exchange for "points" and "reputation," which can later be converted into AVAX tokens.
In the screenshots below, they are recruiting water army workers to act as "Avangers" and create content that "compares" Avalanche with other projects:
We start here, because Ava Labs made forced errors in the usage of their astroturf bot army, laying bare the automation, while under pressure from our seminal Case #3.
August 26, 2022, Case #3 revealed how Ava Labs worked in secret partnership with bought law firm Roche Freedman, which had been given AVAX tokens worth hundreds of millions of dollars, to weaponize the American legal system against rivals, create decoys for regulators, and steal confidential information using legal discovery processes. Their lead lawyer Kyle Roche worked so closely with Ava Labs that he lived with Kevin Seqniki, their Chief Operating Officer.
Ava Labs was plunged into crisis. They immediately put their astroturf accounts and water army into action to reduce the harm. First, when Emin Gün Sirer tweeted a denial, it added a large number of fake likes and retweets, providing the misleading effect that "the community resoundingly endorsed" his denial, which fake endorsement was then widely reported in the crypto press:
How could anyone believe something so ridiculous as the conspiracy theory nonsense on Cryptoleaks? We would never engage in the unlawful, unethical and just plain wrong behavior claimed in these self-serving videos and inflammatory article. Our tech & team speak for themselves.
— Emin Gün Sirer🔺 (@el33th4xor) August 28, 2022
Next, Ava Labs put its astroturf army into overdrive, amplifying the message that Emin Gün Sirer could not have been responsible. However, while hundreds of tweets appeared in his support, if you looked closely, very clear patterns could be seen, as in the following:
I really believe @avalancheavax team and @el33th4xor as the Father of Blockchain would never do such a things
— Mahabir Gope 🛸🔺 (@MahabirGope15) August 29, 2022
Their only goal is to prevent the emergence of #AVAX , but they are not and will not succeed https://t.co/YuBzsie2vF
Hi mate, I really believe the @avalancheavax's team and@el33th4xor would never do such things
— H E N N Y🔺 (@Stevaniar06) August 29, 2022
Do you know?
Their sole purpose is to prevent the emergence of #AVAX, but they are not and will not succeed#Avalanche #Blockchain #Cryptonewshttps://t.co/oDOvl4rYTq
This is their intention to just make FUD
— Crypto_Ria🔺 (@Crypto_Ria_) August 29, 2022
I really believe @avalancheavax team and @el33th4xor as the Father of Blockchain would never do such a thing
Their only goal is to prevent the emergence of #AVAX, but they are not and will not succeed#Avalanchehttps://t.co/iYg5Oc2x7I
This occurred because Ava Labs felt compelled to activate large parts of its astroturf army simultaneously to save the day. The problem was that its infrastructure was only capable of creating minor variations on the input themes they wanted to inject into their community and Crypto Twitter. As a result, it is very obvious that these tweets from different astroturf accounts derive from a single system.
What's particularly intriguing, is that the tweets refer to Emin Gün Sirer as the "Father of Blockchain," when the primary purpose of the tweets was to support Ava Labs' mendacious denials of collaboration with Roche Freedman. As covered earlier in this case, this messaging reflects Emin's personal obsessions, and possible "Satoshi complex," indicating that he himself may have been directly involved with crafting the themes fed into the astroturf infrastructure.
Our astroturf database correctly identified the astroturf Twitter accounts: MahabirGope15 has a botometer score of 1.2 (75% likelihood of being a bot), Stevaniar06 a score of 1.8 (75% likelihood of being a bot), and Crypto_Ria_ a score of 3.2 (85% likelihood of being a bot). Permanent web.archive.org copies of the above tweets be found here, here and here.
A primary purpose of Ava Labs' astroturf bot network is to promote the Avalanche blockchain, and thus the sale of its AVAX tokens, which directly profits them by increasing the value of their holdings. The network achieves this by creating a misleading impression that Avalanche has a vast online army of activist supporters, exerting powerful bandwagon effects, and by allowing them to push messaging that it would be inappropriate — or downright illegal — for them to share themselves, including that the price of AVAX will rise.
It's never too late to be early. pic.twitter.com/Hxwf3TjnkG
— Emin Gün Sirer🔺 (@el33th4xor) December 14, 2021
Ava Labs directly advertised to American consumers that "It's never too late to be early" on the New York subway and other places, helping to drive the price to ten times what it is today. The wording of the advertising could arguably be interpreted as suggesting that it is possible to buy AVAX tokens in time to benefit from future price rises, and at the least is a scheme designed to sell AVAX tokens under the guise of imploring the general public to “explore" the blockchain. Given these actions, it's hardly surprising that selling AVAX would be a key purpose of their astroturf accounts.
#Avalanche grows like an unstoppable avalanche#AVAX's end-of-year expectation was $100, but if it continues like this, it will push $100 in 2 weeks.https://t.co/KfqLizZ7oc
— murat🔺 (@MUBAVAX) August 21, 2021
🚀 Imagine 10 years from now...#Avalanche $AVAX @avalancheavax pic.twitter.com/7BXgiC9ePh
— Eduardo 🔺 Avalanche (@emcs1974) May 22, 2022
It’s definitely time to keep buying AVAX because it will go up at any time
— Lily Kudo 🔺 (@LilyKuudoo) September 27, 2022
They will say they are holding from $15 when we reach $150 in October
— Amatullah.avax🔺 🐝🍯 (@Amatullah840) July 24, 2022
MUBAVAX has a botometer score of 4.2 (90% chance of being a bot), emcs1974 a score of 4 (90% chance of being a bot), LilyKuudoo a score of 3.8 (85% chance of being a bot) and Amatullah840 a score of 2.8 (80% chance of being a bot).
As Evan reported in the spy video of this case, a key purpose of the astroturf accounts is to target rivals.
When polygon Engineers try to copy Avalanche subnets.
— Yusuf Emre 🔺 (@real_morpheus) April 22, 2022
Be original not a copy🔺 pic.twitter.com/Whm4L4KhUp
how tf solana nfts get so much attention when the network constantly goes down and the marketplace is absolute SHIT??
— soap🔺 (e m b r a c e) (@s04p_) May 31, 2022
eNgInEeRiNg TeAm WoRkInG tO rEsOlVe LaTeNcY iSsUeS
absolute garbage chain
Aptos is just a scam. The blockchain doesn't even work. Just an FTX's hype coin. It will go down badly. Very badly.
— Crypto-T 🔺 (@gentleman_tf) January 21, 2023
Solana needs to be sued one way or another. Fake number of coins, fake TVL, fake TPS etc.
— Crypto-T 🔺 (@gentleman_tf) August 28, 2022
Cardano = shit shitttttttttttttt coin
— ronoble(💙,🧡) (@TrungTtp) March 30, 2021
literally me when my friend ask me to hold #ETH instead of #AVAX 😡😡 pic.twitter.com/uNxgJoB2Bz
— Jun 🔺 (@Junieteru) April 7, 2021
@kevinsekniqi can we start shitposting about #Solana? pic.twitter.com/1kqc2DgZuk
— Jun 🔺 (@Junieteru) May 2, 2022
this will be your end pic.twitter.com/QcPuWnQZqW
— laoyu (@laoyu61661221) July 1, 2022
fuck you liar ，you will go to jail sooner or later
— lanren (@laohoubulan) December 17, 2022
Most people have an unconscious bias towards believing what others believe, especially if they belong to the same social group or community. The biological purpose is to allow us to efficiently reach decisions and form opinions, essentially by making a reasonable assumption that others have already done the necessary research for us. The "social proof" provided by the beliefs and opinions of others can thus create a powerful "bandwagon effect," where a group stampedes towards consensus on a subject.
People also have a tendency to believe what they see repeated over and over. That is why Joseph Goebbels, the Nazi propaganda minister, said “repeat a lie often enough and it becomes the truth.”
The purpose of Ava Labs' social media astroturf accounts is to create a false impression that people in the crypto community widely hold the opinions and beliefs contained in their fake social media messages, and to repeat the themes involved over and over so that people come to believe that they are true, whether they are that the AVAX price will go up in the future, or slanderous claims that the leaders of competitive projects are criminals that should go to jail.
If the practices of Ava Labs became normal, eventually civilized society would be greatly harmed. Their astroturf operations reflect an effort to perform mass brainwashing at scale using electronic means, something that is more often attempted by rogue states.
Read more case investigations...