Wash Trading
Simulated trading between connected accounts - lots of “volume”, minimal real risk transfer.
Metrics: Round-trip rate, round-size ratio, Benford distance (L1), VWAP drift vs. mid
Read more →CEX TRADER GUIDE
Spot Market Anomalies - Detect, Understand, Act
A comprehensive practical guide for identifying unusual trading activity, analyzing significant trading patterns, and addressing market anomalies on CEX exchanges.
Note: This content is for educational and technical purposes only and does not constitute legal or investment advice.
Contents
Introduction
We define a market anomaly as a structured, repeatable pattern that affects price discovery, liquidity, or execution quality on CEX order books. Such patterns range from overt manipulative quoting to subtle microstructure tactics that distort metrics, data feeds, or user perception. They may manifest as fake depth near the touch (spoofing/layering), wash-like micro-roundtrips, or timed pushes into stop zones and settlement windows.
Classification of Market Anomalies on CEX
- Price-based anomalies → Goal: shift prints/returns
- Volume-based anomalies → Goal: suggest/obscure trading activity
- Order book anomalies → Goal: distort quotes/depth/queue
- Time & benchmark anomalies → Goal: concentrate effects at fix/settlement windows
- Data/feed/reporting anomalies → Goal: influence perception without matching-engine substance
Typical Trading Patterns with Market Impact
Overview of patterns covered in this guide (details in the articles below):
- Wash Trading
- Spoofing
- Layering
- Quote Stuffing
- Pump and Dump
- Stop-Loss Hunting
- Front Running (CEX vs. DEX)
- Insider Trading
- Marking the Close
- Fake Volume via API
- Funding-Rate Skew
- Iceberg Orders
- Cross-Exchange Wash
- Momentum Ignition
- Ramping
- Quote Fade
- News/Disinfo Campaign
- Painting the Tape
- Pinging / Order Anticipation
- Propping/Capping
- Candle-Close / Reference-Rate
- Flickering BBO / Quote-Baiting
- Iceberg-Spoofing
- Bear Raid
- Liquidity-Mirroring
- Cross-Pair Parity
- VIP/Rebate-Gaming
- Tick-Size/Queue-Gaming
- Spot→Index/Oracle Moves
- Spread-Pinning
SpoofScan Alerts on Telegram - How to Set Up
1Join & Language
Follow the hub channel: @SpoofScan. Pick your language in @SpoofScanBot → /start.
2Community Gates
Open the language chat (@SpoofScan_DE_Chat, @SpoofScan_EN_Chat, …). Quick entry quiz in the bot /quiz. On pass → invite (valid 10 min).
3Beta (optional)
/beta in the bot → seed + beta quiz → access to the private beta channel after passing.
4Activate Premium
Choose /plan → /buy starts the purchase. Quote in EUR, pay in SOL to your one-time wallet address/QR. After finality: auto-unlock & invoice.
5Subscribe to Alerts
/alerts subscribe <type> [symbol]. Per CEX or all four. Useful: /alerts list, /alerts unsubscribe, /status, /config set.
6Support & Privacy
/help, /status. Data-minimal: no real names; hash IDs in the bot, invoicing data only in the backend.
Signals & Metrics
SpoofScan delivers multilingual Telegram alerts with evidence snippets. Data ingestion, scoring and delivery are off-platform; the bot itself does not query exchanges.
What we measure: Order book depth & changes, best-quote half-life, add/cancel behavior, trades (notional, VWAP, tape imbalance).
Spoofing detectors (excerpt): LFCNT, LAYER_BURST, FLIP_FADE, CXL_SPIKE_NOPRINTS, SPOOF_COMPOSITE.
Alert quality: Score & confidence (0–1), throttle and de-dup per instrument, evidence excerpt (time/price/action).
Example Alerts for Telegram (SpoofScan)
Message (DM or premium channel) Bot
🚨 Spoofing (LFCNT) | BINANCE · BTC/USDT · 90 s
Ask L0: 12 fast cancels of large orders (≥ $250,000).
Score 0.82 · Confidence 0.76 · Spread 1.8 bp · Mid 30,123.45
Why relevant?
Large orders appear near the best and vanish ~1.2 s later → deception risk (fake liquidity).
🧾 Evidence (excerpt):
12:00:11 | 30,150 | +$300k place
12:00:12 | 30,150 | −$300k cancel (1.18 s)
Explanation:
🚨 = severity alert.
LFCNT = detector “Large-Fast-Cancel Near Top”.
Score/Confidence = strength/reliability of the pattern.
Evidence shows 1–2 concrete ticks (time, price, action).
What is spoofing?: short glossary post.
Mute symbol: sets a filter for BTC/USDT.
Sensitivity: toggle Low/Med/High.
Price move (Free & Premium)
⚠️ Price impulse | BYBIT · ETH/USDT · 5 min
+3.1% (1,845.20 → 1,902.40) · Volume +2.4× vs. 24h median
Context:
Spread 2.3 bp · Tape-imbalance 0.62 (more buyers)
Explanation:
⚠️ = warning (medium urgency).
Tape-imbalance = buy/sell pressure in the window.
Only high-severity reduces noise for this symbol.
Listing (Free & Premium)
ℹ️ Listing detected | MEXC · TICKER/USDT
Initial listing reported · Order book opens shortly.
Note:
Early phases: high spreads & possible slippage.
Explanation:
ℹ️ = info (low urgency).
Watching temporarily subscribes to “High-Severity” events
for the new listing.
🚨 Spoofing (LFCNT) | BINANCE · BTC/USDT · 90 s
Ask L0: 12 fast cancels of large orders (≥ $250,000).
Score 0.82 · Confidence 0.76 · Spread 1.8 bp
Plans & Access
Free: Limited core signals (listings, strong price impulses, high-score spoofing)
Premium: All detectors, evidence blocks, sensitivity, higher frequency
Privacy & Security
Data-minimal: only hash IDs in the bot; invoicing data only in the backend
Signed ingests (HMAC), replay protection, structured audit logs
Market Anomalies - Detailed Articles
Note: In-depth articles on complex market anomalies, trading patterns, and their impact on price discovery and market structure.
Not all of these techniques are directly applicable or provably detectable in CEX spot markets, but they are included here for completeness.
Spoofing
Large fake orders at the touch attract attention - disappear just before getting filled.
Metrics: Cancel rate at touch, lifetime quantile, distance bins (bps), OTR spikes
Read more →Layering
Staggered fake quotes (“ladder”) create pressure - steps vanish in synchronized fashion.
Metrics: Step coherence, synchronized cancel, distance bins, depth imbalance
Read more →Quote Stuffing
Flood of add/cancel messages makes the tape unreadable - fake depth instead of fair execution.
Metrics: OTR (orders/trades), updates/s, best-quote half-life (t½), spread impact
Read more →Pump and Dump
Rapid price surge through buy waves - aggressive sell-off into FOMO demand.
Metrics: Reversal rate, VWAP drift, wick ratio, volume Z-score
Read more →Stop-Loss Hunting
Price is pushed/pulled into stop zones - cascades amplify the move, then reversion.
Metrics: Wick ratio, spread jump (bps), aggressor quote spike, depth (L2)
Read more →Front Running on CEX vs. DEX
Anticipation of large expected orders - via microstructure on CEX, via mempool on DEX.
Metrics: Lead/lag (1s bins), iceberg hit response, pre-trade impact, OTR at touch
Read more →Insider Trading
Trading ahead of news using non-public info - suspicious moves shortly before announcements.
Metrics: Pre-news drift, volume Z-score, cross-venue coherence, reversion
Read more →Marking the Close (Fix/Settlement)
Price shifting during reference/settlement windows - benchmark/settlement gets manipulated.
Metrics: Partition coherence, index drift vs. cross-mid, post-close reversion, notional share per CEX
Read more →Fake Volume via API
Programmatic mini-roundtrips push rankings - high activity, low price impact.
Metrics: Round-trip rate, round-size ratio, Benford distance, low VWAP drift
Read more →Funding-Rate Skew (Distortion)
(Derivatives context) Imbalance in perp funding - incentive to nudge spot/index briefly.
Metrics: Funding spread, basis (perp–spot), lead/lag spot↔perp, partition checks
Read more →Iceberg Orders
Hidden size at the touch - small fills instantly refilled at same size/price.
Metrics: Replenishment latency, refill signature, t½, partial fill cascades
Read more →Cross-Exchange Wash
Mirrored trades across venues - volume show without real risk transfer.
Metrics: Trade mirrors, round-trip rate cross-venue, Benford L1, lead/lag ≈ 0
Read more →Momentum Ignition
Chain reaction from short aggression bursts - goal: ignite momentum, then ride along.
Metrics: Aggressor bursts, OTR spikes, impact vs. drift, down/up-tick runs
Read more →Ramping
Gradual price lift through serial prints - price “climbs” despite thin support.
Metrics: Print cadence, VWAP drift, depth evaporation, reversion check
Read more →Quote Fade
Quotes appear at touch but withdraw under pressure - fake depth.
Metrics: Fade rate at touch, cancel-to-fill, t½, fill proximity response
Read more →News / Disinfo Campaign
Rumors/posts generate hype - price/volume spikes with delayed pullback.
Metrics: Pre-/post-news drift, volume Z-score, reversal rate, cross-venue check
Read more →Painting the Tape / Pre-Arranged / Matched Orders
Pre-arranged prints create illusion of activity - high volume, minimal price change.
Metrics: Trade pairs/mirrors, time clustering, VWAP drift vs. mid, self/match indicators
Read more →Pinging / Order Anticipation
Micro-orders probe hidden liquidity - insights are monetized immediately.
Metrics: Micro-probe series, OTR (small sizes), refill signature, follow-up trade
Read more →Propping/Capping
Price held or capped at a level - repeated replenishment prevents movement.
Metrics: Replenishment time, level persistence, fail-to-move rate, spread behavior
Read more →Candle-Close/Reference-Rate Painting
Last minutes of candle/reference window manipulated - close/reference gets distorted.
Metrics: Last-minute aggression, close drift vs. mid, post-close reversion, partition score
Read more →Flickering BBO / Quote-Baiting
Best bid/offer flickers at millisecond scale - hard-to-hit fake depth.
Metrics: Best-quote t½, updates/s, cancel-to-fill, spread stability
Read more →Iceberg-Spoofing / Hidden-Depth Bluff
Mix of hidden depth and fake quotes - bait, then withdraw.
Metrics: Refill vs. pull, replenishment latency, distance bins, partial fill patterns
Read more →Bear Raid (spot-based)
Aggressive sell sequence drains bids - spread blows out, rebound often follows.
Metrics: Down-tick run length, spread jump, depth evaporation, reversion
Read more →Liquidity-Mirroring (cross-venue)
Quotes/trades mirror almost 1:1 across venues - unclear price leadership.
Metrics: Lead/lag ≈ 0, mirror error (bps), cross-corr quotes/trades, t½ alignment
Read more →Cross-Pair Parity Manipulation
Parities between trading pairs are distorted - triangle relationships “jam”.
Metrics: Triangular parity error, basis drift, lead/lag across pairs, VWAP deviation
Read more →VIP/Rebate-Gaming
Fee/rebate windows drive quoting and roundtrips - volume distorts pair dynamics.
Metrics: OTR spikes, round-trip rate, volume share shift, best-quote t½
Read more →Tick-Size/Queue-Gaming
1-tick step-ahead and queue preservation - slight improvement to maintain priority.
Metrics: Step-ahead rate, t½, cancel-to-fill, event coherence (tick updates)
Read more →Spot-Driven Index/Oracle Moves
Spot prints inside calculation window skew reference/oracle - reversion follows.
Metrics: Partition coherence, index drift vs. cross-mid, publisher dispersion, post-window reversion
Read more →Spread-Pinning (1-Tick Fixation of the Spread)
Spread is stuck at 1 tick - high churn, low true execution intent.
Metrics: S1O (share-of-1-tick-occupancy), t½, OTR, cancel-to-fill
Read more →Limits of Analysis
Our analyses are provided solely for general risk-awareness purposes and do not constitute investment, legal, or tax advice.
We do not offer any regulated banking, financial, securities, or crypto services - in particular, no investment advice or intermediation, (financial) portfolio management, or crypto custody. We are not a CASP or investment service provider.
From a technical perspective, it is possible to perform statistical detection of anomalies within the scope of contractually permitted, publicly available CEX APIs and market data (e.g., L2 order books, trades, and, where applicable, perpetual contract signals) - such as unusual or clustered orders, distance-weighted depth imbalances, elevated quote/cancel rates, rapid OBI shifts, round-size patterns, short-term spread compressions, latency-synchronized bursts, and cross-exchange price/volume divergences (all without reference to individual persons or accounts).
Not possible - or only probabilistically possible - are: proof of manipulative intent, attribution to specific accounts or persons, reliable detection of hidden or iceberg liquidity, substantiated identification of wash trades without counterparty data, and insight into internal matching-engine or self-trade-prevention events.
Limitations: API/WebSocket rate limits and sampling, exchange outages or schema changes, clock drift or network jitter, data gaps or backfills, and delivery latency (e.g., via Telegram). All indicators and scores represent probabilistic confidence estimates. False positives or negatives may occur; there is no guarantee of accuracy, success, or factual determination.
Use is permitted only in compliance with applicable law, exchange and API terms, and our Terms of Service and Privacy Policy. Misuse — especially for market manipulation - is strictly prohibited. To the extent permitted by law, we accept no liability for indirect or atypical consequential damages or loss of profits.