Order-Book Spoofing: What It Looks Like in Live Data

Spoofing, as regulators define it, is bidding or offering with the intent to cancel the order before execution. The offence lives in the trader's intent. That is a critical point for anyone building or buying a detection tool, because intent is precisely the thing that market data cannot contain.

Enforcement history makes the standard concrete. The CFTC's order against JPMorgan Chase covered conduct spanning at least eight years and hundreds of thousands of orders, and carried $920.2 million in monetary relief — the largest the agency has imposed. Its order against Tower Research Capital found orders placed with intent to cancel before execution and required $67.4 million in restitution, disgorgement and penalties. In both cases the finding of intent rested on internal records, communications and trader testimony, not on the order book alone.

Every screen that runs on public market data is therefore a proxy. It identifies order-book behaviour that is consistent with spoofing. Whether it was spoofing is a question that requires evidence a market-data feed does not carry.

What a feed can see is the shape of the behaviour. Practitioner and academic accounts converge on roughly the same four components, and a pattern is only interesting when several appear together.

• Disproportionate size — a resting order far larger than the venue's normal depth at that level, which by itself would move the price if it filled
• Distance from the touch — placed close enough to be visible and to influence perception, far enough that it is unlikely to be hit
• Cancellation before execution — pulled as price approaches, rather than filled; a high place-to-cancel ratio with near-zero fill rate is the core statistical signature
• Price reaction and reversal — the book reacts to the order while it rests, and reverts once it is pulled

A large resting order that gets cancelled is, on its own, almost meaningless. Market makers cancel and re-place constantly; that is the job. Cancellation rates above 90% are normal for automated liquidity provision on most venues, and an inventory-managing market maker will pull size the instant its hedge moves.

There are also entirely legitimate reasons a large order appears and disappears. A desk working a parent order will place and pull child orders as its schedule and the prevailing spread change. A risk system will flatten quotes when volatility crosses a threshold. An iceberg's visible tip refreshes and vanishes by design.

This is why the useful unit of analysis is not the order but the episode: a cluster of placements on one side, with a measurable price response, followed by cancellation and reversion, repeated. One event is noise. A repeated pattern on the same pair, on the same side, at similar distances from the touch, is a signal worth attention — and still not a finding.

Layering is the multi-level variant: rather than one conspicuous wall, several orders are placed across adjacent price levels on one side of the book. The aggregate effect on perceived imbalance is the same, but no individual order looks unusual.

This is where a size-threshold screen fails and a shape-based one is needed. The observable is the ratio of one side's depth to the other across a band of levels, tracked over time, together with how quickly that imbalance decays when it is removed. Layered orders tend to leave together, because they were placed together.

Genuine imbalance builds and decays gradually as independent participants arrive and leave. Imbalance that appears and disappears as a block is behaving like one actor rather than many.

Recent academic work has applied sequence models to limit-order-book data to classify spoofing episodes, and to characterise which book states are most spoofable in the first place. The results are meaningful: models trained on order-book sequences outperform fixed-threshold rules, particularly on layering, where no single order crosses a threshold.

What none of this work claims is that the models observe intent. They learn the statistical shape of episodes that were labelled as spoofing, and they inherit the limitations of that labelling. A model trained on regulatory-enforcement cases has learned what caught spoofing looks like, which is not necessarily what spoofing looks like.

The practical consequence is that model output should be treated as a prior, not a verdict — a reason to weight a signal down, not a basis for any claim about a market participant.

The actionable use of spoofing screens is defensive and almost entirely about position sizing and order placement, not about identifying wrongdoing.

If elevated one-sided book imbalance is present on a pair, the depth you can see is less reliable than it looks. A stop placed just beyond a large visible wall is a stop placed at a level that may not exist when it is tested. A market order sized against displayed depth may fill far worse than the book implied. Both are ordinary execution mistakes made worse by treating displayed liquidity as firm.

The correction is unglamorous: size against depth you have seen persist rather than depth you can see right now; prefer limit orders when book imbalance is elevated; re-check depth after any large visible order disappears, because the level that mattered may have gone with it; and treat a sudden, one-sided depth change as a reason to wait rather than a reason to trade.

Vultax surfaces order-book imbalance and cancellation-pressure context inside the market-quality domain of Vi IQ. The reading is elevated or suppressed risk on a market, never an inference of intent, because the underlying data cannot support one. How the domain is computed is documented in the methodology.

The measurement is also bounded by feed fidelity. A screen can only assess order-book behaviour it actually received, and snapshot cadence and feed reliability differ substantially between venues.

The strip at the top of this page is not a screenshot of the day this was written. Every ten minutes Vultax re-reads the trade tapes of five venues for prints of $100,000 or more in the last thirty minutes, the buy share of those prints, CoinGecko's depth within 2% of mid, and Deribit's implied-volatility index and rewrites the figures; the Vi IQ beneath them scores the same six domains the terminal scores for a pair, computed for BTC on the major spot venues, with any domain that cannot be computed shown as unavailable rather than filled in. Read the numbers as a live check on the argument above, and the revision notes at the end for what has changed since publication.

Prints are the opposite of spoofs: they are orders that traded. A burst of large prints with the buy share far from 50% is genuine one-sided flow; a wall in the book that never prints while the tape stays quiet is the pattern this article describes. Depth is the denominator both are measured against, and DVOL says whether the market is in a state where a wall would matter.

The enforcement record keeps confirming the definition above: intent to cancel, not size. The Department of Justice's September 2025 resolution with two traders at a large institution covered more than a thousand spoof orders in Treasuries and related futures placed between 2014 and 2020, years after the CFTC's record $920 million order against JPMorgan for the same conduct in metals and Treasuries. The CFTC first applied the statute to bitcoin futures in 2021, and its February 2026 prediction-markets advisory lists disruptive trading among the conduct it polices on any designated contract market.

For offshore spot venues, which are where most of the walls in this article appear, no comparable enforcement exists, so the observable components below are the only test available. Whether a venue's own surveillance catches layering depends on the venue, and none of the large spot venues publishes its cancellation statistics.