**2. Methodology**

Anomaly scores of market movements are measured with Mahalanobis distance (MD), which is a multivariate extension of z-scores, and it is computed by standardizing the deviation from mean with the covariance matrix:

$$\text{MD}(r) = \sqrt{(r - \mu)^T \Sigma^{-1} (r - \mu)}$$

where *<sup>μ</sup>* <sup>∈</sup> <sup>R</sup>*<sup>n</sup>* is the mean vector and <sup>Σ</sup> <sup>∈</sup> <sup>R</sup>*n*×*<sup>n</sup>* is the covariance matrix of a random vector *<sup>r</sup>* <sup>∈</sup> <sup>R</sup>*n*. While it assumes an elliptical distribution, MD has been shown to be effective in analyzing risks of financial markets [24]. Based on MD, the anomaly score is defined as:

$$\mathbf{A}(r) = \text{MD}(r) / \sqrt{n}$$

to correct for an increase in MD caused by a larger number of variables *n* for measuring distance [25].

Due to frequent spikes in cryptocurrency movements, MD becomes sensitive to the choice of investment period; mean and covariance used in the calculation of MD are highly sensitive to outliers in price movements. Therefore, in this study, robust MDs were proposed for examining cryptocurrencies. The first proposed robust approach is taken from portfolio optimization where shrinkage estimators are used for computing MD. Mean vector was estimated with the Bayes–Stein estimator [26], and covariance matrix was shrunk using Ledoit and Wolf's [27] approach with a diagonal target. The second robust approach employed in this study is minimum covariance determinant for computing first and second moments without outliers in returns [28]. Even though cryptocurrency returns are not normally distributed [29], the robust MD methods provide a framework for comparing robust anomaly scores. In Section 4, the empirical results compare MD when mean and covariance are estimated from either the entire period (i.e., finding distance relative to the overall movement) or the most recent 104 weeks (i.e., finding distance relative to the market condition during the most recent two years, since March 2000).

More importantly, anomaly scores were initially measured with the price movements of the top cryptocurrencies, and the analysis was repeated with the risk factors of cryptocurrencies. Risk factors are especially important for managing investment portfolios because risk exposure of a portfolio can be effectively measured with underlying factors, whereas financial assets often display high cross-correlations [30,31]. Recently, Liu and Tsyvinski [20] performed a comprehensive empirical asset pricing analysis on cryptocurrencies and found that cryptocurrency returns are exposed to network factors such as number of transactions or number of wallet users, but not production factors such as electricity and computing costs. Thus, network factors were chosen in our analysis to measure anomaly scores of the cryptocurrency market. Principal component analysis is not included in our experiment because principal components that explain much of the variance in cryptocurrencies are highly correlated with the more volatile currencies since 2018, such as Dogecoin. In particular, we found that the top three principal components explained over 70% of variance, where the first principal component is highly correlated with the equally weighted return of the cryptocurrencies and the second principal component is highly correlated with Dogecoin.
