Order-Book Spoofing: What It Looks Like in Live Data

Spoofing, as regulators define it, is bidding or offering with the intent to cancel the order before execution. The offence lives in the trader's intent. That is a critical point for anyone building or buying a detection tool, because intent is precisely the thing that market data cannot contain.

Enforcement history makes the standard concrete. The CFTC's order against JPMorgan Chase covered conduct spanning at least eight years and hundreds of thousands of orders, and carried $920.2 million in monetary relief — the largest the agency has imposed. Its order against Tower Research Capital found orders placed with intent to cancel before execution and required $67.4 million in restitution, disgorgement and penalties. In both cases the finding of intent rested on internal records, communications and trader testimony, not on the order book alone.

Every screen that runs on public market data is therefore a proxy. It identifies order-book behaviour that is consistent with spoofing. Whether it was spoofing is a question that requires evidence a market-data feed does not carry.

What a feed can see is the shape of the behaviour. Practitioner and academic accounts converge on roughly the same four components, and a pattern is only interesting when several appear together.

• Disproportionate size — a resting order far larger than the venue's normal depth at that level, which by itself would move the price if it filled
• Distance from the touch — placed close enough to be visible and to influence perception, far enough that it is unlikely to be hit
• Cancellation before execution — pulled as price approaches, rather than filled; a high place-to-cancel ratio with near-zero fill rate is the core statistical signature
• Price reaction and reversal — the book reacts to the order while it rests, and reverts once it is pulled

A large resting order that gets cancelled is, on its own, almost meaningless. Market makers cancel and re-place constantly; that is the job. Cancellation rates above 90% are normal for automated liquidity provision on most venues, and an inventory-managing market maker will pull size the instant its hedge moves.

There are also entirely legitimate reasons a large order appears and disappears. A desk working a parent order will place and pull child orders as its schedule and the prevailing spread change. A risk system will flatten quotes when volatility crosses a threshold. An iceberg's visible tip refreshes and vanishes by design.

This is why the useful unit of analysis is not the order but the episode: a cluster of placements on one side, with a measurable price response, followed by cancellation and reversion, repeated. One event is noise. A repeated pattern on the same pair, on the same side, at similar distances from the touch, is a signal worth attention — and still not a finding.

Layering is the multi-level variant: rather than one conspicuous wall, several orders are placed across adjacent price levels on one side of the book. The aggregate effect on perceived imbalance is the same, but no individual order looks unusual.

This is where a size-threshold screen fails and a shape-based one is needed. The observable is the ratio of one side's depth to the other across a band of levels, tracked over time, together with how quickly that imbalance decays when it is removed. Layered orders tend to leave together, because they were placed together.

Genuine imbalance builds and decays gradually as independent participants arrive and leave. Imbalance that appears and disappears as a block is behaving like one actor rather than many.

Recent academic work has applied sequence models to limit-order-book data to classify spoofing episodes, and to characterise which book states are most spoofable in the first place. The results are meaningful: models trained on order-book sequences outperform fixed-threshold rules, particularly on layering, where no single order crosses a threshold.

What none of this work claims is that the models observe intent. They learn the statistical shape of episodes that were labelled as spoofing, and they inherit the limitations of that labelling. A model trained on regulatory-enforcement cases has learned what caught spoofing looks like, which is not necessarily what spoofing looks like.

The practical consequence is that model output should be treated as a prior, not a verdict — a reason to weight a signal down, not a basis for any claim about a market participant.

The actionable use of spoofing screens is defensive and almost entirely about position sizing and order placement, not about identifying wrongdoing.

If elevated one-sided book imbalance is present on a pair, the depth you can see is less reliable than it looks. A stop placed just beyond a large visible wall is a stop placed at a level that may not exist when it is tested. A market order sized against displayed depth may fill far worse than the book implied. Both are ordinary execution mistakes made worse by treating displayed liquidity as firm.

The correction is unglamorous: size against depth you have seen persist rather than depth you can see right now; prefer limit orders when book imbalance is elevated; re-check depth after any large visible order disappears, because the level that mattered may have gone with it; and treat a sudden, one-sided depth change as a reason to wait rather than a reason to trade.

On 2 October 2026, from 21:19 to 21:49 UTC, Vultax read the Bitcoin order books of Binance, Coinbase and Kraken every three to four seconds and followed every price level that held $500,000 or more within 0.5% of the price. Call such a level a wall. A wall was counted from the reading in which it appeared until its size fell below half its peak.

860 walls came and went in those 30 minutes. 672 of them, 78%, lost their size while they were still more than 5 basis points behind the best price on their side of the book. An order that far from the best price cannot trade, so that size was cancelled, not filled. Another 147 ended inside 5 basis points of the best price, where a fill and a cancellation cannot be told apart from readings alone, and 41 ended at the best price.

The venues differ. On Coinbase all 241 walls were pulled away from the price, and the typical one stood for 30 seconds: the endings bunch at half-minute marks, the pattern of a quote being moved on a clock. On Kraken 407 of 554 were pulled, after a typical 18 seconds. On Binance, where the same money is spread over finer price steps, only 65 walls of that size appeared, and most of them ended at the best price.

This is what the second and third components above look like in data: size placed away from the touch and removed before the price arrives. It is not a count of spoofs. Market makers reprice their quotes all day, and a quote that follows the price at a fixed distance produces exactly this record. Thirty minutes on one Friday evening is also one sample; the figure will move with the hour and the market.

Download table figures:CSVJSON with sources

Vultax surfaces order-book imbalance and cancellation-pressure context inside the market-quality domain of Vi IQ. The reading is elevated or suppressed risk on a market, never an inference of intent, because the underlying data cannot support one. How the domain is computed is documented in the methodology.

The measurement is also bounded by feed fidelity. A screen can only assess order-book behaviour it actually received, and snapshot cadence and feed reliability differ substantially between venues.

The strip at the top of this page is not a screenshot of the day this was written. Every ten minutes Vultax re-reads the trade tapes of five venues for prints of $100,000 or more in the last thirty minutes, the buy share of those prints, CoinGecko's depth within 2% of mid, and Deribit's implied-volatility index and rewrites the figures; the Vi IQ beneath them scores the same six domains the terminal scores for a pair, computed for BTC on the major spot venues, with any domain that cannot be computed shown as unavailable rather than filled in. Read the numbers as a live check on the argument above, and the revision notes at the end for what has changed since publication.

Prints are the opposite of spoofs: they are orders that traded. A burst of large prints with the buy share far from 50% is genuine one-sided flow; a wall in the book that never prints while the tape stays quiet is the pattern this article describes. Depth is the denominator both are measured against, and DVOL says whether the market is in a state where a wall would matter.

The enforcement record keeps confirming the definition above: intent to cancel, not size. The Department of Justice's September 2025 resolution with two traders at a large institution covered more than a thousand spoof orders in Treasuries and related futures placed between 2014 and 2020, years after the CFTC's record $920 million order against JPMorgan for the same conduct in metals and Treasuries. The CFTC first applied the statute to bitcoin futures in 2021, and its February 2026 prediction-markets advisory lists disruptive trading among the conduct it polices on any designated contract market.

For offshore spot venues, which are where most of the walls in this article appear, no comparable enforcement exists, so the observable components below are the only test available. Whether a venue's own surveillance catches layering depends on the venue, and none of the large spot venues publishes its cancellation statistics.