Market Anomaly: Iceberg-Spoofing / Hidden-Depth-Bluff

• 11 May 2023 – Binance (spot): Official docs on iceberg orders: large limits are split into visible tranches and automatically reloaded after each fill. (Binance)
• Ongoing – Kraken (spot): Iceberg + Spot Atomic Amends (fast in-place changes with possible queue priority) - enables sub-second refill/cancel maneuvers. (Kraken Support)
• Feb 2025 – Bitfinex (spot): Hidden orders + “Visible on Hit” option (rest becomes visible after the first partial fill) - a relevant variant for touch-depth signals. (Bitfinex Support)

Context: Iceberg/hidden orders are not automatically abusive; intent, sequence and market effect matter. (ESMA / MAR debate)

1. Touch set-up: An iceberg limit placed near best bid/ask with only the tip size visible. After a partial fill the visible tip is immediately replenished at the same level (same quantity/price).
2. Bluff phase: Prior to stronger opposing flow the parent or subsequent tranches are cancelled or ticked away (e.g. via atomic amends), so the previously “persistent” depth vanishes at the decisive moment. (docs.kraken.com)
3. Information effect: Repeated child fills ≈ tip size plus sub-second re-quotes signal “hidden size.” In a bluff, that signature breaks off abruptly.
4. Distinction: Legitimate use cases include impact reduction / TWAP / POV. Abuse is when depth is only simulated to provoke misreactions. (ESMA)

• Replenishment signature: Multiple reloads of the same level within ≤ 300–600 ms after a partial fill; sustained over minutes.
• Best-quote t½ ↓ (P1–P5 vs 30-day baseline) accompanied by moderate spread jumps (tight spreads despite “standing” depth).
• Child-fill clusters: Clustering of prints ≈ tip size (± a few ticks), executed in stair-step fashion.
• Abrupt depth withdrawal: Re-quotes vanish right before an aggressor burst; OTR falls back and VWAP drift reverses.
• Round-size / Benford: Noticeably round sizing; elevated Benford L1 distance during refill chains.

• Order toolkit: Native iceberg/hidden order types (Binance, Kraken; Bitfinex Hidden / Visible-on-Hit) + API flags (icebergQty) lower the barrier for serial replenishments. (Binance Dev Center)
• Fast amend/cancel paths: In-place amends enable last-moment moves at very low friction. (Kraken)
• L2 transparency limits: No pre-trade view of hidden depth - detection relies on timing / refill rhythm / child clusters.
• 24/7 + fragmentation: Asynchronous lead/lag effects favour venue-selective bluffs; no CAT-equivalent exists.

Regulatory anchors & surveillance: FINRA Rule 5210 targets misleading quotations/reports; with SEC Rule 613 (CAT) order life-cycles (order→amend→cancel→trade) can be reconstructed for forensics. Result: iceberg bluffs are riskier and shorter-lived in regulated venues; CEX spot lacks a market-wide audit standard.

• MiCA timeline: In force 29 Jun 2023; applicable elements from 30 Jun 2024 (e.g. ART/EMT) and 30 Dec 2024 (CASP duties). Transitional regimes to 01 Jul 2026 may apply per member state - resulting in staggered supervision in 2025/26. (ESMA)
• Consequence for CEX spot: Uneven surveillance maturity → intent-agnostic models (sequence + effect) gain importance.
• Practical benefit: Early detection reduces slippage ("don't chase fake depth"), strengthens best-execution evidence and produces MiCA/MAR-capable dossiers.

Baseline: 30-day history, hourly bins (UTC), ±15 min comparison window per symbol×venue; percentile-based thresholds.

Metrics (selection): Replenishment latency (ms), best-quote half-life (ms), child-fill cluster rate (share of prints ≈ tip size), OTR (orders/trades), round-size ratio, Benford distance (L1), VWAP drift vs mid (bps), spread jump (bps), lead/lag (1-s bins, ≥3 venues).

E3 – High ("persistent refill machine + abort before impact")

• Replenishment latency ≤ P1 and best-quote t½ ≤ P1 across ≥ 4 cycles within ≤ 3 min,
• Child-fill cluster rate ≥ P99 (≥ k fills ≈ tip size within ≤ 60 s*),
• OTR ≥ P99.5 with spread jump ≤ P50 (tight spreads despite constant withdrawing),
• Abrupt parent withdrawal (cancel/amend) ≤ 300 ms before aggressor burst and lead/lag coherence (≥ 3 venues within ≤ 3 s).

E2 – Medium

• Replenishment latency ≤ P5 across ≥ 2 consecutive levels or best-quote t½ ≤ P5,
• Child-fill cluster rate ≥ P95 or Benford-L1 ≥ P95 or round-size ratio ≥ 1.5× baseline,
• VWAP drift vs mid ≥ P98 without proportional spread jump.

E1 – Low (early warning)

• Single refill sequence (≥ 2 replenishments within ≤ 2 min) or OTR ≥ P97,
• BBO t½ ≤ P10 with child-cluster hint but without clear cancel-before-impact.

• Legitimate alternatives: Institutional icebergs (impact protection), TWAP/POV, block resting can look similar; absence of "cancel-before-impact" signals often indicates legitimacy.
• Event filters (UTC): Listings/relistings, maintenance, market-maker withdrawal, large on-chain transfers; treat macro slots (CPI/FOMC) separately.
• Cross-venue check: E3 only when ≥ 3 core venues consistently trigger; exclude single-venue artifacts (feed gaps, L2 errors).
• API nuances: E.g. Binance iceberg usage requires GTC + icebergQty; venue policies affect observable traces.
• Data quality: Discard windows with L2 errors/gaps > 1%; measure in bps/ms and strictly UTC-stamp.

• Trader / Execution: Avoid paying for apparent depth; better limit placement & "don't chase the wall" lowers slippage.
• Risk / Alpha: Use reversion after bluff resolution; avoid unnecessary crossings.
• Governance / Best Execution: E-level dossiers (replenishment, t½, child-cluster, cancel-before-impact, lead/lag) are audit-ready and MiCA/MAR-capable.
• Regulatory fit: ESMA stresses that order types are not inherently manipulative; sequence and effect matter - which the rules above measure.

• ESMA – Discussion Paper on MAR (14 Nov 2013).
• ESMA – Statement on MiCA Transitional Measures (17 Dec 2024).
• IOSCO – Principles for Dark Liquidity (31 Jan 2011).
• FINRA – Rule 5210: Publication of Transactions and Quotations.
• SEC – Rule 613: Consolidated Audit Trail (CAT).
• Binance – What Is an Iceberg Order (11 May 2023) / Spot API trading endpoints (icebergQty).
• Kraken – Iceberg Orders / Spot Atomic Amends.
• Bitfinex – Hidden Order Option (Feb 2025) / Visible on Hit (Feb 2025).