DE EN RU
SpoofScan – Header
← Back to overview: CEX TRADER GUIDE – Articles & Resources
Article 15

Market Anomaly: Ramping

Short explanation: Deliberate, staged series of real executions that push the price up quickly (or, less commonly, down) to create trend signals, trigger stops/breakouts and attract follow-through flow. It overlaps with Momentum Ignition but does not rely on deceptive quotes - the effect is produced by fills.

Market CEX Spot, CEX Derivatives
Evidence status & as of Spot-evidenced · As of: October 18, 2025, 12:00 UTC

Documented scenarios (CEX-based)

  • Mt. Gox 2013–2014 ("Willy/Markus" bots): Reports and analyses show conspicuous buying sequences by a bot cluster correlated with strong BTC rises - a prototypical ramping profile (concentrated aggressive buys with little opposing flow).
  • FTX/Alameda (FTT "price support", 2021–2022): Complaints and witness statements describe repeated FTT purchases to support price/hold thresholds - functionally ramping (price support through execution series).
  • US enforcement 2024/2025 (Operation "Token Mirrors"): DoJ/SEC pursued networks that raised price and activity through manipulative trading patterns, sometimes across exchanges. (Records focus on fake volume/wash; price elevation objectives are referenced in cases.)

Context: Distinguish between court-backed facts (e.g., deliberate FTT buys) and the technical classification as a ramping profile.

How it works

  1. Initiation: Repeated, staged market/sweep buys (or sells) across multiple price levels.
  2. Signal: The sequence lifts/presses mid/last price; breakout/stop algorithms and trend-followers jump in.
  3. Harvest: Position is reduced/flipped into the follow-through flow (exit liquidity).
  4. Toolset: Pure execution series or combined with front-end tactics (e.g., thin the book via layering/spoofing).
  5. Effect: Many market participants react rule-based to impulse+volume; in thin books even small prints can produce large effects.

Clear detection features (observable live)

  • One-sided aggression: Buy/sell initiation ≥ 80% within a short window, steady tick ladder up/down.
  • "Step-ladder" price profile: consecutive up/down ticks with similar sizes, few opposing prints.
  • Depth erosion: affected side thins while spread stays stable; VWAP follows the series visibly.
  • Follow-through: stop-runs/breakouts with volume continuation immediately after the push.
  • Cross-venue spillover: Lead/lag ≤ 1 s to major CEXs; purely local events show weaker spillover.

Why CEXs are vulnerable

  • Fragmentation & 24/7 trading: uneven depth - coordinated notional has disproportionate impact.
  • Altcoins/Perps: thin books + leverage/stops → small series suffice to ignite cascades.
  • Limited cross-market transparency: no CAT equivalent; intent is harder to prove, so pattern detection matters.

Comparison: regulated exchanges

Definition & surveillance: Supervisors (e.g. ASIC) explicitly characterise ramping as series of trades in short time producing unusual price movement. FCA cases on "share ramping" show enforcement; EU/UK-MAR addresses momentum-ignition/ramping. Market protections like volatility interruptions, LULD and systematic surveillance detect ramping earlier.

Why early detection is critical – and what's changing in the EU

  • Trading costs & risk: Late detection ⇒ entering artificially boosted moves (slippage/whipsaws).
  • Systemic effects: In perps, ramping pulses can trigger liquidation chains & quant mis-signals.
  • MiCA & transition: Applicable since 30.12.2024; transition until 01.07.2026 per member state - supervisors expect effective controls against behaviour-based anomalies like ramping.

Concrete thresholds / alert rules (E3/E2/E1)

Adaptive per symbol/venue vs 30-day baseline (same time of day). Required: trade tape with aggressor flag, L2 depth; ideal: multiple venues.

E3 (high) – "Series push + follow-through"

  • Aggressor share ≥ 85% in a 5-sec window on one side,
  • 1-sec return z-score ≥ 3.0 and depth drop ≥ p99,
  • Volume follow-through in 10-sec window ≥ p95,
  • Cross-venue lead/lag ≤ 1 s to ≥ 1 major reference CEX.

E2 (medium) – "Ladder without news"

  • ≥ 3 sweeps in ≤ 15 s with progressive tick moves,
  • Aggressor share ≥ 75% in 10-sec window,
  • VWAP gap vs mid > p97 while spread remains stable.

E1 (low) – "Pre-alert"

  • Series of small similar sizes (± ≤ 10%) with one-sided up/down ticks and no news context → watchlist.

Practical tips (minimising false positives)

  • Check news/listings first: fundamental moves can look similar.
  • Quote noise ≠ ramping: ramping needs executed trades; OTR spikes without fills are not ramping.
  • Separate arb/real flow: broad market moves are coherent across venues; ramping often starts local.
  • Calibrate altcoins/perps separately: thin depth → lower thresholds, more false positives; cross-venue checks help.
  • Use quantiles, not fixed thresholds: account for intraday seasonality; combine metrics (aggressor share + depth + follow-through).

Why this matters (trader value & compliance)

  • For traders: Early detection reduces FOMO fills, improves stop placement / breakout quality, and lowers slippage.
  • For operators/compliance: Evidence from aggression series, depth erosion, lead/lag & spillover supports reviews and STORs - in line with MiCA/MAR.

Relevant sources

  • ASIC – "Report 215: Australian equity market structure" (2010): ramping definition ("series of trades in short time → unusual price movement").
  • FCA – "Market Watch 67/69" (2021/2022): order-book data for detection of market abuse; surveillance practice.
  • FCA – Final Notices "Simon Eagle" (2010) & "Graham Betton" (2011): share-ramping cases, sanctions.
  • Gandal et al. (2018): "Price manipulation in the Bitcoin ecosystem" – Mt. Gox analysis (linking suspicious trading to BTC rise).
  • The Guardian (29 May 2014): "Bitcoin bots bought millions in the last days of Mt Gox" – Willy/Markus bots.
  • SEC – complaint filings (e.g. Caroline Ellison & Gary Wang material, Dec 2022): passages on FTT price support through purchases on platforms.
  • CFTC/SEC/DoJ – Operation "Token Mirrors" (from Oct 2024): press/filings on manipulative patterns including price-inflating strategies; 2025 pleas/verdicts.
  • ESMA – "Statement on MiCA Transitional Measures" (17 Dec 2024) & AMF timetable: application as of 30.12.2024, transition until 01.07.2026 possible.