Alimul Ghani Founder
Research & regulatory framework
LLB (Hons) · LLM in Global Business & Finance · Bristol, UK
For compliance teams at crypto trading firms
Spot market abusein on-chain trading.
Aurora reads public Ethereum blocks for trades that look like manipulation, flags them, and helps your analyst turn a flag into a report draft. A person reviews every flag; Aurora does not decide and files nothing.
- Built for MiCA Article 92 and UK MARC
- Based on research published on SSRN
- Working prototype on Ethereum
Illustration · invented data
An example
A sandwich attack,step by step.
A decentralised exchange has no order book to watch. Abuse shows up in the order trades land inside a public block. Here is one pattern, and what Aurora does with it.
- 01
A trader places an order.They buy ETH on a decentralised exchange. The order waits a moment before it lands in a block.
- 02
Another wallet surrounds it.It buys just before the order and sells just after, pushing the price up and back down. The trader pays more than quoted; the other wallet keeps the difference.
- 03
Aurora flags the pattern.The same wallet used the same exchange contract just before and just after someone else's trade, and the flag says so. It is a lead for an analyst, not a finding.
- 04
An analyst reviews it.They check the trades behind the flag, open a case if it needs follow-up and can generate a report draft to review.
The same example, as it sits in the block
| Block · position | Wallet | Action | Market | Size |
|---|---|---|---|---|
| 4,813 · 11 | 0xc2…55 | Add liquidity | ETH/USDC | +38 ETH |
| 4,813 · 12 | 0x3f…a1 | Buy ETH | ETH/USDC | 40 ETH |
| 4,813 · 13 | 0x9b…7e | Buy ETH (the trader) | ETH/USDC | 10 ETH |
| 4,813 · 14 | 0x3f…a1 | Sell ETH | ETH/USDC | 40 ETH |
| 4,813 · 15 | 0x77…d0 | Repay loan | wETH market | 12.5 ETH |
Invented data. Highlighted rows are the two trades from wallet 0x3f…a1 either side of the trader's order.
Not an AML tool. Anti-money-laundering tools ask whose money it is. Aurora asks whether the trading itself looks manipulative.
How it works
From a new block to a reportan analyst can sign off.
Four steps, from a new block to a report draft that a person signs off.
Monitor
Follow Ethereum exchanges and lending markets, block by block, while the scanner is running.
What is happening, and where?
Flag
Raise trades that look like known manipulation patterns, and say why.
What deserves a closer look?
Investigate
See the transactions behind a flag: the block, the wallets and the order of trades.
Who was involved, and in what order?
Document
Open a case, add notes and generate a report draft for a person to review.
How should the findings be recorded?
Why now
The rules alreadyask for this.
Since 30 December 2024, EU firms that professionally arrange or execute crypto trades must detect suspected market abuse and report it to their regulator (MiCA Article 92). UK firms must do the same from 25 October 2027 (MARC).
MiCA market-abuse rules apply across the EU, including the Article 92 duty to detect and report.
Technical standards (RTS (EU) 2025/885) in force, setting out detection and reporting arrangements.
UK FCA publishes final rules for cryptoasset market abuse (PS26/9).
UK authorisation window opens for cryptoasset firms.
UK market abuse regime for cryptoassets (MARC) applies.
What the rules ask for, and where Aurora fits
Systems that raise alerts. While the scanner is running, Aurora reads each new Ethereum block and raises an alert when a pattern matches.
A person makes the call. Each flag says why it was raised. Flags do not prove intent, and Aurora does not decide.
A standard report. An analyst can turn a flag into a draft shaped like a suspicious transaction and order report (STOR). Aurora files nothing with a regulator.
Coverage
Every pattern Aurora checks,and how ready it is.
Running works on real blocks today. Prototype works on real data but is rough or not yet connected to alerts. Planned is not built yet.
Detectors
| Pattern | What it looks for | Status |
|---|---|---|
| Sandwich patternsEthereum | One wallet uses the same exchange contract just before and just after someone else's trade. | Running |
| Network activitySolana | Overall trading activity and fees on Solana's main exchanges. It does not see individual trades or who made them. | Running |
| Large-swap price impactEthereum | Estimates how far a large swap moved the price, from Uniswap V3 pool data. Approximate. | Prototype |
| Liquidation patternsEthereum | Aave loan liquidations where the liquidator also traded on an exchange in the same block. | Prototype |
| Trading and lending togetherEthereum | A wallet that trades on an exchange and uses a lending market in the same block. Price impact is not measured. | Prototype |
| Repeated tradesEthereum | One wallet, or a pair of wallets, calling the same exchange router again and again across blocks. | Prototype |
| Just-in-time liquidityEthereum | Liquidity added just before a swap and removed just after, in the same block. Only direct calls on Uniswap V3 are caught for now. | Prototype |
| Solana trade checksSolana | Sandwich and manipulation checks on individual Solana trades. | Planned |
Where Aurora is today: a prototype built for Ethereum. The platform is offline at the moment, and walkthroughs are by request. Detection has not yet been benchmarked.
Who builds it
Built from legal researchinto DeFi market abuse.
“If financial markets are becoming programmable and decentralized, shouldn't regulatory surveillance become programmable and decentralized as well?”
Alimul Ghani · SSRN working paper · February 2026
Aurora started in Alimul Ghani's LLM thesis, which asked whether market-abuse rules written for markets with identifiable intermediaries could work in decentralised markets built on smart contracts, automated market makers and pseudonymous actors. The research proposed a surveillance framework. Aurora is that framework being built into software.
Ishmam Ahmed Co-founder
Product engineering, design & growth
Backend development · interface and user journeys
More about the research framework
The framework connects five kinds of analysis that are usually handled separately:
- 01Market-state reconstruction. Rebuild what a market looked like around an event.
- 02Behavioural analysis. Look at how wallets act over time and in relation to each other.
- 03Causal simulation. Ask what the market would have done without the suspect activity.
- 04Systemic-risk analysis. Consider whether an event could spread across protocols.
- 05Regulatory mapping. Relate observed behaviour to existing market-abuse frameworks.
The paper's evaluation was carried out in simulation. It shapes the design but is not evidence of how the software performs in production.
For investors
What we are building,and where it stands.
Crypto firms in the EU already have a legal duty to detect and report market abuse, and UK firms join them in October 2027. Aurora is building surveillance for the on-chain part of that duty.
Stage
Working prototype on Ethereum, built by two founders. Detection has not yet been benchmarked.
Built so far
A block scanner, a running sandwich detector, alerts, case notes and STOR-style report drafts.
Next
Connect the prototype detectors to alerts, add trade-level checks on Solana and benchmark detection.
Origin
Alimul Ghani's LLM research into DeFi market abuse, published as an SSRN working paper in February 2026.
Next step
See how it works in a walkthrough.
We will walk your team through the workflow, from a flagged block to a report draft, and hear how you handle cases today.