The first time, linking accounts by shared funding history produced nine clusters containing no trading accounts at all. The largest had 256 members. It was the platform's own deposit machinery: per-user vault contracts routing collateral, connected to each other because they were all connected to the same plumbing.
The second time, one layer up, the main cluster grew from 8 accounts to 296 as observation deepened, spanning 54 markets at once and absorbing 43 per cent of every account we had seen. That is not what coordination looks like. Four liquidity hubs were sitting on the other side of nearly all retail flow. The largest filled as maker in 1,437 of its 1,438 trades, against 220 distinct counterparties. Two hundred of the 296 members had exactly one connection, to a hub.
On a platform with concentrated market making, the counterparty graph's giant component is not a conspiracy. It is the platform's liquidity structure.
Signature
The fingerprint of the artefact, so a matcher recognises and discards it.
- Component reach
- Absorbs a large share of all active accounts, spans nearly every active market at once
- Topology
- Star: hub degree far above the rest, most members degree 1
- Clustering coefficient
- Near zero at the hub, against 0.5 to 1.0 for a genuine interlocked core
- Role asymmetry
- Near-pure maker, in this case 1,437 maker fills to 1
- Funding variant
- A shared funder whose own inbound transfers come predominantly from platform contracts
- Trading membership
- In the deposit-plumbing case, zero per cent of members ever traded
Both were corrected the day they were found, with guards that exclude hub-shaped accounts from linking and refuse to treat settlement infrastructure as a shared funder. The second correction deleted 232 downstream detections that had cited a participant who did not exist. None had reached a report.
There is a general lesson in it. Detection depth grows with data, and so do the artefacts. A surveillance system that only ever reports what it found, and never what it wrongly found and withdrew, is not describing its own accuracy. Every guard we add is a disclosed line in the methodology, not a silent filter.
What this cannot show
- Clustering coefficients are measured on the counterparty graph of relationships with three or more fills, not on every incidental pairing.
- Excluded hub accounts remain visible to the pairwise self-trading and coordination indicators. They are removed from linking, not from observation.