Ava Labs (Avalanche) has 1000s of astroturf bots that pump AVAX tokens, slander rivals, and mislead its community
Emin Gün Sirer's boiler room machine uses a secret bot army to push nefarious messages

Key findings

  • Ava Labs operates large-scale astroturf ("bot") armies to promote their Avalanche blockchain.
  • A key engineer from Ava Labs discusses many aspects of their operations on video, revealing their modus operandi, dirty tricks, and usage of astroturf accounts.
  • We analyse pro-Avalanche astroturf accounts on Twitter that slander rivals, and promote the sale of AVAX tokens, by for example by claiming the price will rise.
  • More than a thousand astroturf accounts are identified on Twitter.


Our spy videos: This report shares extensive spy video. All video has been collected in accordance with applicable laws.


Whistleblower appeal: With these disclosures, we aim to show people who are not crypto insiders what goes on behind the scenes. Do you want to be part of this movement? If you have any further information on this case and the different parties involved, become a whistleblower for Crypto Leaks.

CASE #5  April 25, 2023

Rogue Project Disinformation

In this case, we explore how Ava Labs, the for profit corporation behind the Avalanche blockchain, uses an army of thousands of fake "astroturf" social media accounts to create a misleading impression of public opinion that they can configure at will, helping them sell their AVAX tokens, slander rivals, and fool its community on key issues.

Example applications of the astroturf accounts include:

  • Making bullish price predictions about AVAX tokens, to promote their sale to retail investors, without risking regulatory backlash from the SEC.
  • Slandering rivals to harm their reputations, weaken them as competitors, and direct public interest and capital flows towards AVAX.
  • Fooling their own community on key issues, for example regarding their completely false claim that they had little to do with Roche Freedman and their joint weaponization of the American legal system, through which they created decoys for regulators and harmed rivals.
  • To create the impression that they have a much larger community of activist supporters than they have in reality.

In this case study, we explore Ava Labs' use of fake Twitter handles, through which they post tens of thousands of fake messages and replies that parrot nefarious themes and wording defined by Ava Labs leaders such as Emin Gün Sirer, while they remain hidden in the background.

Before the empirical analysis, we start with some new spy video!

Evan Richards - Leading Ava Labs Engineer

We recently talked to Evan Richards, who held a senior engineering role at Ava Labs from November 2020 to May 2022, gaining an excellent vantage point into their activities and modus operandi. He says that the kinds of crooked behavior we reported on in our seminal Case #3 are likely to continue, and reveals that Ava Labs' use of fake astroturf accounts was routine.

Those caught on spy video in earlier cases have often been involved in serious wrongdoing, but we have no reason to believe that Evan has done anything wrong, other than perhaps staying around when the nature of the Ava Labs operations became clear. We wish him well and hope he enjoys his cameo on Crypto Leaks.

Before performing an empirical analysis of Ava Labs astroturf system, lets dive into another fascinating and insightful conversation...

Vampire attitude — it's all about token price

A lot can be understood about a project by how it defines competitors. Ava Labs does not define competitors of its Avalanche blockchain in terms of their functionality, or differing visions for the future of crypto. Instead, using the logic of a vampire, it defines them as chains with a higher market capitalization, since it believes that by attacking them they can cause the other chain's liquidity to flow into the Avalanche blockchain's AVAX token — which they hold in vast numbers.
Avalanche sets its sights on any chain with a higher market cap... taking a vampires attitude.

For anyone that believes in the great cypherpunk project that is crypto, this attitude is anathema. It reflects the beliefs of those who see blockchain as a giant zero-sum casino where tokens collect investor money, rather than a domain where meaningful and impactful technology can flourish.

The Avalanche bridge is really a vampire's pipe

Ava Labs constructed a bridge to transport tokens on other blockchains onto Avalanche by wrapping them. Ava Labs promoted this as furthering Web3 collaboration and a multi-chain future, but it seems that it was more about sucking liquidity from those they saw as "competitors" (i.e. chains that have larger market caps).
Oh, anyone they're targeting with their bridge.

Ava Labs' astroturf fan accounts on Twitter and Telegram

Ava Labs' giant boiler room machine, which involves bots, shills and trolls speaking through their astroturf social media accounts, is illegal in nature. Yet, its usage is so routine and pervasive, that its existence and purpose is common knowledge amongst its engineering (some of whom also help maintain the systems involved). Here Evan describes how they own "astroturf" fan accounts in places like Twitter and Telegram.

As we shall see, so pervasive is this system, that the reality is, if you have occasionally seen ardent tweets promoting AVAX or attacking Avalanche rivals, or proclamations and boosty dialogs in public chat groups on services like Telegram, then very probably you have seen their astroturf accounts in action.
Avalanche, to give you a concrete example, has like astroturfed fan accounts in places as — in places like Twitter, or in Telegram chats ... allegedly, allegedly will pay people to boost their coins in social media

Astroturf accounts also target competitors

Ava Labs' astroturf accounts aren't just for promoting their AVAX token directly, but also for targeting competitors.
to target competitors? ... Oh, oh yeah

Emin makes bad faith and provably false arguments

Emin Gün Sirer's own Ava Labs engineers say that in public he makes provably false arguments in bad faith. This is surprising, as he likes to promote his background as an associate professor, and this kind of behavior is diametrically opposed to the academic ethos.
They have sometimes been caught making perhaps bad faith, even provable false arguments

Emin Gün Sirer and Kevin Seqniki are volatile

Evan claims that Emin Gün Sirer (founder and CEO) and Kevin Seqniki (Chief Operating Officer) have volatile personalities, which could cause damage to the public image of Avalanche.
'volatile but interesting personalities' — Yes!

The risk is that they could be caught in a lie

Evan worries that the excitability of Emin and Kevin will result in them being caught in a lie, which will undermine the trust people have in Ava Labs and the Avalanche blockchain.
a lot of actors won't interact with your project if you've ever been caught in a lie ... or anything like that

Avalanche is a back-alley style of operation

Evan relays how those involved with Algorand, who have presumably been on the receiving end of false statements, and curses by Ava Labs' astroturf accounts, have stated regret at Ava's behavior. He defines Avalanche as being "back-alley" in nature, and says this is reflected in the make-up of their team.
Whereas, Avalanche takes a very, like, Twitter-first approach, back-alley, anonymous forums, things like that.

The Avalanche Bridge: a disaster in waiting

Blockchains are created by decentralized network protocols that depend on consensus mathematics and cryptography. Their protocols connect computing nodes run by independent parties, then creating a single virtual platform that is tamperproof and unstoppable that can host things like token ledgers, DeFi, and Web3 services. The network protocols and software code involved must always be shared with the world, so that they are publicly verifiable, and anyone with the requisite skills can validate that they work correctly and are secure.

A blockchain bridge is used to produce a "wrapped" copy of a crypto asset that resides on a source blockchain, on a destination blockchain, where it can be used in DeFi systems that it hosts. Ava Labs built and operates the Avalanche Bridge, which wraps assets on other blockchains, and allows them to be used on the Avalanche blockchain.

Blockchain bridges are not blockchains, and necessarily involve a fair degree of centralization. In most cases, their operators effectively act as custodians of the assets they wrap. However, the security of bridges remains highly important, even though they provide less security than a blockchain can. For this reason, normally their workings are publicly shared, so that the technical security they provide is also publicly verifiable.

If the Avalanche Bridge were to get hacked, then the assets that its users hold on source blockchains could be stolen, making their wrapped assets worthless. Moreover, if it were hacked, it could be used to print new worthless wrapped assets on Avalanche from thin air. In both cases, holders of wrapped assets, and Avalanche DeFi users, could suffer massive losses. The risks are clear since billions of dollars of assets have recently been stolen from blockchain bridges.

It is therefore highly concerning to hear that the Avalanche Bridge is created by special software run by five Ava Labs "partners," whose code nobody has seen outside of Ava Labs — which by definition is not publicly verifiable, and therefore depends entirely for its security on centralized trust in Ava Labs, rather than mathematics — and that it also relies for security upon SGX hardware, which is known to be flawed and easily broken.
all running code that no one's allowed to see. There are many documented exploits of the hardware they're using ... if three of them were hacked or just decided to collude, they could print an arbitrary amount of money on the Avalanche network

"Team Rocket" and Emin's Satoshi complex

Emin Gün Sirer wishes to style himself as the "Father of Blockchain," in what is possibly a well-developed "Satoshi complex." Arguably, this has led to him take unusual actions such as asking bought law firm Roche Freedman to attack Craig Wright, as per Case #3, and make weird and baseless claims, including recently that he began working on blockchains in 2002, then inventing Proof-of-Work six years before Satoshi, as per his recent arresting statements on a video interview on decrypt (starts at 4 mins 20 secs)!

In another sign that he has a "Satoshi complex," Avalanche's consensus system was shared on Twitter by a mysterious "Team Rocket," in the anonymous style of Satoshi, even though it was very obviously created by Emin himself. Evan confirms that even his own engineers consider the pantomime absurd. We will return to this later in the case when examining the pervasive astroturf messaging that Emin is the "Father of Blockchain."
But Avalanche really does it hard [deception], by obfuscating who even designed their consensus mechanism ... it seems very clear that it's Gün and Kevin

Evan believes that Emin is trying to cynically ape Satoshi.
they're trying to steal and crib from the Satoshi Nakamoto origin story

Patent trolls

Evan chafes against Ava Labs plans to become blockchain "patent trolls" — albeit, in fairness, a study of the nature of their patents and enforcement actions would have to be performed before giving them this moniker.
the way that Avalanche breaks the ethos of cryptocurrency

The Avalanche DeFi ecosystem Ava Labs in disguise?

It has been well-documented how Ava Labs paid several Ethereum DeFi projects to copy-paste their frameworks onto the Avalanche network to bootstrap its DeFi (Avalanche is essentially a fork of Ethereum, which is why that was possible). But what about the leading "native" DeFi projects that have been built on Avalanche, such as its Pangolin DEX? Rather than being independent ecosystem projects, it seems likely many are actually Ava Labs in disguise.
reveals that it was in fact Avalanche, pretending not to be their own product

Roche Freedman — more coming?

Our Case #3 covered how Ava Labs gave bought law firm Roche Freedman, AVAX tokens worth hundreds of millions of dollars to attack rivals, create decoy cases in crypto that drew regulators like the SEC away from Ava Labs, pursue Emin Gün Sirer's personal vendettas, and extract confidential information from the crypto industry using legal discovery processes. The question is, will they continue with this kind of behavior?
That's a great question. I would bet on it continuing in the future, but that's not anything--, you know, I'm really scared of getting sued

The Ava Labs Astroturf Army

Crypto can be so extreme, it can be hard for outsiders to grok what is going on, even when presented with the facts: That Sam Bankman-Fried could have fooled the world he was a financial genius using funds he stole from FTX customers, wooed Silicon Valley, attacked blockchain ecosystems that threatended his investments, subverted the crypto and mainstream press, and even democracy itself, as per our recent Case #4. That a senior journalist at the New York Times, who was associated with Sam, would amplify one of his attacks, possibly as a favor, as per our Case #2. That Ava Labs could subvert and weaponize the American legal system to attack rivals, create decoys for regulators, pursue Emin's vendettas, and collect confidential information, as per our Case #3... it all seems implausible until you actually see the hard evidence.

Crypto became the wildest of Wild Wests. Things got really, really hairy, and we are still in the process of weeding out the cowboys and bad actors. Sadly, a recurring theme is bad guys masquerading as good guys, while tarnishing honest actors. The road to fixing this will be long, but it starts with sunlight.

The scale of Ava Lab's astroturf operation is another stunning revelation...

Twitter astroturf account total: 1293

Our investigation identified 1293 profiles on Twitter that we believe are fake astroturf accounts controlled by Ava Labs.

Download the full list: c5-avalabs-astroturf.pdf

Unable to display PDF file. Download instead.

The astroturf accounts appear to be organized into 5 distinct networks, for reasons as yet unknown.

"Astroturf" account definition: An astroturf account is a fake social media account, whose sole purpose is to promote messaging on behalf of Ava Labs. Sometimes, the accounts are controlled by technical infrastructure, through which Ava Labs actors can push out messages in an automated way. Other times, they are controlled by freelance operators, or direct contractors of Ava Labs, who often control several astroturf accounts each, and push general messaging that is centrally disseminated. The accounts all contain some normal-looking posts to disguise their nature and purpose.

In the databse, we assign a "botometer" score to accounts, which reflects the likelihood that they are astroturf.

Of the overall population we identified, 17% had a botometer score of 0.6-1, which equates to a 56% likelihood of being a bot, 48% had a score of 1-2, which equates to a 75% likelihood , 15% had a score of 2-3, which equates to a 80% likelihood, 12% had a score of 3-4, which equates to a 85% likelihood, and 6% of all bots had a score of 4-5, which equates to a 90% likehlihood.

Large as the database we share is, it not even reflect the full scale of what we initially encountered — because as our research progressed, we found that suspect accounts were disappearing from Twitter in real time. We are not sure whether our investigation was rumbled, and Ava Labs was quickly trying to clean house, or this was Elon Musk's new Twitter closing down bots.

Ava Labs "water army" recruitment

The exact means through which the astroturf accounts are created and controlled isn't known, and likely several pathways exist. However, what is easily seen, is that Ava Labs has long enlisted freelance "marketing" help in the style of Chinese water army workers, who typically reside in poor countries where there is little alternative work. The scheme involves community websites that Ava Labs operates, where they can submit their "work" in exchange for "points" and "reputation," which can later be converted into AVAX tokens.

In the screenshots below, they are recruiting water army workers to act as "Avangers" and create content that "compares" Avalanche with other projects:

Example No. 1: emergency whitewashing

We start here, because Ava Labs made forced errors in the usage of their astroturf bot army, laying bare the automation, while under pressure from our seminal Case #3.

August 26, 2022, Case #3 revealed how Ava Labs worked in secret partnership with bought law firm Roche Freedman, which had been given AVAX tokens worth hundreds of millions of dollars, to weaponize the American legal system against rivals, create decoys for regulators, and steal confidential information using legal discovery processes. Their lead lawyer Kyle Roche worked so closely with Ava Labs that he lived with Kevin Seqniki, their Chief Operating Officer.

Ava Labs was plunged into crisis. They immediately put their astroturf accounts and water army into action to reduce the harm. First, when Emin Gün Sirer tweeted a denial, it added a large number of fake likes and retweets, providing the misleading effect that "the community resoundingly endorsed" his denial, which fake endorsement was then widely reported in the crypto press:

Next, Ava Labs put its astroturf army into overdrive, amplifying the message that Emin Gün Sirer could not have been responsible. However, while hundreds of tweets appeared in his support, if you looked closely, very clear patterns could be seen, as in the following:

This occurred because Ava Labs felt compelled to activate large parts of its astroturf army simultaneously to save the day. The problem was that its infrastructure was only capable of creating minor variations on the input themes they wanted to inject into their community and Crypto Twitter. As a result, it is very obvious that these tweets from different astroturf accounts derive from a single system.

What's particularly intriguing, is that the tweets refer to Emin Gün Sirer as the "Father of Blockchain," when the primary purpose of the tweets was to support Ava Labs' mendacious denials of collaboration with Roche Freedman. As covered earlier in this case, this messaging reflects Emin's personal obsessions, and possible "Satoshi complex," indicating that he himself may have been directly involved with crafting the themes fed into the astroturf infrastructure.

Our astroturf database correctly identified the astroturf Twitter accounts: MahabirGope15 has a botometer score of 1.2 (75% likelihood of being a bot), Stevaniar06 a score of 1.8 (75% likelihood of being a bot), and Crypto_Ria_ a score of 3.2 (85% likelihood of being a bot). Permanent web.archive.org copies of the above tweets be found here, here and here.

Example No. 2: pumping the price of AVAX

A primary purpose of Ava Labs' astroturf bot network is to promote the Avalanche blockchain, and thus the sale of its AVAX tokens, which directly profits them by increasing the value of their holdings. The network achieves this by creating a misleading impression that Avalanche has a vast online army of activist supporters, exerting powerful bandwagon effects, and by allowing them to push messaging that it would be inappropriate — or downright illegal — for them to share themselves, including that the price of AVAX will rise.

Ava Labs directly advertised to American consumers that "It's never too late to be early" on the New York subway and other places, helping to drive the price to ten times what it is today. The wording of the advertising could arguably be interpreted as suggesting that it is possible to buy AVAX tokens in time to benefit from future price rises, and at the least is a scheme designed to sell AVAX tokens under the guise of imploring the general public to “explore" the blockchain. Given these actions, it's hardly surprising that selling AVAX would be a key purpose of their astroturf accounts.

MUBAVAX has a botometer score of 4.2 (90% chance of being a bot), emcs1974 a score of 4 (90% chance of being a bot), LilyKuudoo a score of 3.8 (85% chance of being a bot) and Amatullah840 a score of 2.8 (80% chance of being a bot).

Example No. 3: targeting rivals

As Evan reported in the spy video of this case, a key purpose of the astroturf accounts is to target rivals.

Why Ava Labs' nefarious social media bots are so powerful

Most people have an unconscious bias towards believing what others believe, especially if they belong to the same social group or community. The biological purpose is to allow us to efficiently reach decisions and form opinions, essentially by making a reasonable assumption that others have already done the necessary research for us. The "social proof" provided by the beliefs and opinions of others can thus create a powerful "bandwagon effect," where a group stampedes towards consensus on a subject.

People also have a tendency to believe what they see repeated over and over. That is why Joseph Goebbels, the Nazi propaganda minister, said “repeat a lie often enough and it becomes the truth.”

The purpose of Ava Labs' social media astroturf accounts is to create a false impression that people in the crypto community widely hold the opinions and beliefs contained in their fake social media messages, and to repeat the themes involved over and over so that people come to believe that they are true, whether they are that the AVAX price will go up in the future, or slanderous claims that the leaders of competitive projects are criminals that should go to jail.

If the practices of Ava Labs became normal, eventually civilized society would be greatly harmed. Their astroturf operations reflect an effort to perform mass brainwashing at scale using electronic means, something that is more often attempted by rogue states.

Read other case investigations...