How to Spot Spoofing Orders in the Order Book
The core method for identifying spoofing orders is to see whether these orders are "placed but never filled". Real orders get filled; spoofing orders vanish the moment price approaches them, or just sit there indefinitely without ever being executed.
Spoofing refers to traders placing large buy or sell orders to create a false impression of supply or demand, then canceling those orders just before they would be filled, aiming to trick other traders into trading in the opposite direction.
1. First, Determine Which Level of the Order Book You're Looking At
The credibility of an order varies greatly depending on its position in the queue.
Case A: Best bid / best ask (the top-of-book quotes) – These are closest to being executed and can also disappear the fastest. Spoofing orders are often placed a few levels away (e.g., levels 3–4) to avoid accidental fills while still being visible to enough traders.
Case B: Levels 2–10 / deeper orders – This is the sweet spot for spoofing. Far enough to avoid being filled easily, but near enough to make traders think "there's a wall". Use Level 2 data to see whether there is hidden opposing liquidity. If a huge buy order sits at the best bid but there is no matching support from levels 2–10 on the buy side, while large sell orders lurk at levels 6–10 on the ask side, it is very likely a bull trap designed to distribute coins.
Completion standard: Before interpreting a large order, glance at the distribution from buy level 1 to level 10 and sell level 1 to level 10. If you spot an abnormally large order that is 3–4 or more levels away from the current price, mark it as "suspicious".
2. Check the Order's "Lifetime"
The most distinctive feature of a spoofing order is how quickly it disappears.
What to do: Watch that large order and see how long it stays. If it vanishes within seconds or tens of seconds, or repeatedly appears and disappears ("flickering" orders), it is very likely spoofing.
Completion standard: If a large order at the same price level appears and disappears more than three times within five minutes – each time: appears → price approaches → disappears – you can pretty much confirm spoofing. Academic research also confirms that spoof orders are cancelled extremely rapidly, with cancellation rates reaching as high as 99% in typical cases.
3. Cross-Verify: Look at "Trade History", Not Just the Order List
This is the most reliable verification method.
What to do: Open the Trade History and check the actual traded volumes. If the order book shows a buy order of 100 ETH at a certain level, but the trade history shows only small trades (0.1–1 ETH each), that big order is "sitting there without being filled".
Completion standard: Compare the "total traded volume near that price level over 5 minutes" with the "order size displayed in the order book". If the displayed order size is far larger than the traded volume (e.g., 50 ETH displayed but less than 2 ETH traded in 5 minutes), the large order is most likely fake.
4. Recognize Four Common Spoofing Patterns
| Pattern | What You See | Real Intention | How to Identify It |
|---|---|---|---|
| Bull Trap | A huge buy wall below the current price | Makes you think there is support; after you buy, the wall is pulled and price dumps | The buy order disappears as price approaches; no matching support from levels 2–10 on the buy side |
| Bear Trap | A huge sell wall above the current price | Makes you think there is resistance; after you short, the wall is pulled and price pumps | The sell order disappears as price approaches; no sustained selling pressure from levels 2–10 on the sell side |
| Iceberg Order | The displayed size at a level is modest but never seems to run out | Conceals a genuinely large order, being executed in small slices (accumulation/distribution) | Orders of the same size keep reappearing at the same level; every time they get filled, they are replenished |
| Wash Volume | The order book looks active but all trades are tiny | Creates a false impression of trading activity | The same coin on one exchange deviates more than 5% in price compared with other platforms |
5. What You Can Do Now – A Four-Step Screening Method
Look at placement: How far is the unusually large order from the current price? If it's far away (3+ levels), it's more likely to be spoofing.
Look at lifetime: How long does it stay? Does it disappear and reappear repeatedly? If yes, mark it as suspicious.
Look at supporting depth: When there is a huge order at the best bid, is there matching depth from levels 2–10 on the buy side? If not, it's just a one-layer "shell".
Look at actual trades: How much has actually been traded near that price level? If the displayed size is large but trading is sparse, the orders are just for show.
6. Risk Reminders
Don't rely solely on the order book. Combine it with volume and Delta (buying vs. selling pressure). If the order book shows strong buying interest but Delta indicates sellers are dominant, it could be a bull trap.
Order books on small exchanges are less trustworthy. Trade on regulated platforms with sufficient liquidity.
Use limit orders instead of market orders. In markets where spoofing may occur, protect your cost with limit orders and avoid being tricked into chasing prices on false signals.
How to confirm you've correctly applied the judgment:
Next time you see an abnormally large order in the book, run through the four steps above. If it meets three or more of these criteria – placed far away, repeatedly disappearing, lacking supporting depth, and with sparse actual trades – you can safely conclude it's spoofing. The best action at that point: Don't follow it – do not add to your position in the direction of that fake order. Wait for it to disappear before making a decision.
