Market Anomaly: Iceberg Orders (Legal)

• Binance (Spot, API): LIMIT / LIMIT_MAKER can be configured with icebergQty to create an iceberg; Time-in-Force = GTC required.
• OKX (Algo order "Iceberg"): Built-in iceberg strategies (slicing modes such as "fast", "price/speed", "passive"); documented limits for outstanding algos.
• Bitfinex (Hidden / "Visible on Hit"): Hidden orders where the remainder is shown only after partial fills - functionally related to iceberg peaking.
• Third-party orderflow analyses: L3 / order-event data used to detect icebergs via queue replenishment and recurring peak quantities.

Icebergs are legitimate (impact reduction). Abuse only starts when combined with deceptive tactics (e.g. iceberg + artificial opposing pressure).

Short & understandable

1. Motivation: Large orders seek to avoid price impact and disclosure of total size.
2. Mechanic: Instead of 1×10,000 lots: e.g. 50×200 visible peaks. Each fill triggers the next peak while reserve remains.
3. Effect on the tape: Continuously "regenerating" residual quantities at the same price look like persistent depth.
4. Outcome: Absorption/damping with reduced slippage for the placer.
5. Boundary to anomaly: Misreading as "real support" or combining with misleading counter-signals distorts the market picture.

• Replenishment at the same price: Immediately (ms range) after each fill a similar peak size reappears.
• Constant peak size: Many fills with nearly identical quantity (±2–5%) at the same level.
• VWAP drift ≈ 0: Despite many fills, little net price progression (absorbing side).
• Queue signature (L3): Repeated add/replace events on the same level → "reserve is being reloaded".

• Native iceberg support & high API rates → fine-grained slicing is trivial.
• Limited transparency: public feeds do not show counterparty IDs; without L3 reserve replenishment is only indirectly visible.
• Interpretation risk: "endless" bids/offers look like genuine depth → mistrades when relying solely on L1/L2.

Icebergs are permitted (e.g. Nasdaq "Reserve/Iceberg"), but surveillance targets misleading combinations. Regulators have full order lifecycles, UTC timing quality (MiFID II / RTS 25) and cross-market visibility - abusive patterns are evidenced earlier.

• Market effect: Regenerating peaks distort trend/liquidity signals, delay breakouts and increase squeeze risk.
• MiCA context: Largely applicable since 30.12.2024; transitional arrangements until 01.07.2026 possible (member-state specifics). Effective controls against misleading order signals are expected.

Adaptive, quantile-based, per symbol/venue against a 30-day baseline for the same time of day. Required: at minimum L2. Best: L3 events (order add/replace/fill sequences).

E3 (high) – "Classic iceberg signature"

• ≥ 10 fills at the same price level within ≤ 3 min,
• Peak consistency: median peak size in the cluster ± ≤ 5%,
• Immediate replenishment: median time fill → new add/replace ≤ 150 ms,
• VWAP drift: < 5 bp.

E2 (medium)

• ≥ 6 fills within ≤ 3 min, peak consistency ± ≤ 10%, drift < 10 bp.

E1 (low)

• Series of identical fills (≥ 3) within ≤ 2 min with stable spread → watchlist.

Without L3, replenishment is inferred from timing/size patterns; with L3 (order IDs / queue position) evidentiary strength increases.

• Distinguish market making: similar series may occur - require consistency + immediate reload + low price drift together.
• Check multiple venues: real flows often mirror cross-venue; local replenishment on a single venue is more typical for icebergs.
• Check event context: news/listing/funding can create legitimate absorption.
• "Visible on Hit" ≠ iceberg: related but distinct; can show similar reload patterns.

• For traders: Assess visible depth more realistically, time breakouts/exits better, reduce slippage.
• For operators/compliance: Replenishment evidence (time/size/queue) is central to modern surveillance; MiCA expects recognition of misleading signals.

• Binance – Spot API / Support ("Trading endpoints", "What Is an Iceberg Order?") – icebergQty, GTC requirement.
• OKX – Iceberg Strategy (Help & FAQs) + API Guide (modes/limits).
• Bitfinex – Hidden / Visible-on-Hit (support/docs).
• Nasdaq – Reserve (Iceberg) factsheet & disruptive trading practices FAQ (allowed order type; deceptive combos prohibited).
• CoinAPI / Kaiko – L3 / order-book analysis pieces (queue reconstruction, iceberg detection).
• ESMA / AMF – MiCA transitional framework (since 30.12.2024; transition until 01.07.2026 possible).