When large orders repeatedly appear and disappear on the order book, but the price moves in the opposite direction instead of following those orders, it is very likely spoofing. The key to identifying it is not the size of the orders, but the pattern of "placement-cancellation" cycles and the actual execution result — real buy orders get filled, while fake buy orders just flash on the order book and vanish.
Step 1: Spot the Anomaly — Orders That Never Get Filled
What to do: Observe the whole life cycle of a large order on the order book.
How to do it: Open the exchange's depth chart or order book (Level-2). Find an order that is significantly larger than those around it. Start timing: how long does it stay? What happens when the price approaches it? Does it eventually get filled, or does it get canceled?
Completion standard: You record the "survival time" and the "disappearance method" of that large order.
Step 2: Validate with Order Flow — Check Delta and Actual Trades
This is the critical distinction. The intent behind spoofing orders is to never get filled.
Case A: The large order is genuine — when price approaches it, volume picks up, and delta (the net difference between aggressive buys and sells) moves in the direction of the large order. For example, if there is a large sell order above, once price reaches it, aggressive selling volume clearly increases, the sell order is gradually consumed, and price is pushed down.
Case B: The large order is spoofing — before the price even touches it, or just as it touches, the order instantly disappears. In this case, trade volume does not spike at that price level, and delta does not follow the direction of the order. Instead, price quickly moves in the opposite direction.
Completion standard: You confirm that the large order disappeared not because it was filled, but because it was actively canceled, and after the cancellation the price reversed.
Common Failure Reason
Seeing a large order and assuming "the big players are about to act here," then jumping in. If it's spoofing, a large sell order above is fake, meant to trick you into selling or shorting below so they can buy back. The real spoofing strategy: place a large fake order on one side to create pressure, while filling small orders on the other side to profit. If you focus on the fake large order, you fall right into the trap. Many traditional stock trading tools identify similar manipulation by monitoring the placement and cancellation behavior of specific large orders in the order book — the logic is exactly the same in crypto markets.
Step 3: Track the Cancelation Rate and Repeat Pattern
A single cancellation might be an accident; repeated placement-cancellation is intentional.
What to do: Count how many times a large order appears and disappears at the same price level or nearby.
How to do it: Watch the order book for 10–15 minutes. If a large order at the same price level appears more than three times, each time staying for 3–5 seconds, getting canceled as soon as the price approaches, and then reappearing at the same level shortly after — that is a classic spoofing pattern. Advanced users can use quantitative tools to monitor the "cancelation rate" in real time.
Completion standard: You have recorded at least three identical "appear-disappear" cycles, confirming it is not a random occurrence.
According to risk warnings from seven associations including the China Internet Finance Association, virtual currency-related business activities are illegal financial activities within China and are not protected by law. The trading techniques and indicators mentioned in this article are for academic analysis only, do not constitute any investment advice, and do not represent endorsement of related trading activities. Please comply with the laws and regulations of your country or region.
Verification Method
In the market where you suspect spoofing, record the price movement within 5 minutes after the large order is canceled. If each time the order is canceled, the price moves in the opposite direction, then your identification logic is valid.
Next Steps
Once you have confirmed a large order is spoofing, do not rush to take a counter-position immediately. Wait until the price has moved a short distance in the opposite direction and aggressive volume (delta spikes) in line with that opposite direction appears before considering entry. Do not be the first to jump in; wait for the signal to be confirmed.
