Overview
This article sheds light on a market manipulation strategy known as spoofing – its prevalence, challenges in detection and how it impacts price movements. Spoofing refers to manipulating order books by placing and canceling fake orders. Traders and algorithmic bots that use the structure of order books as a trading indicator to front-run the market are deceived by this activity. They execute genuine trades that drive the market price in the manipulator’s desired direction. The article discusses the complexities and challenges of detecting spoofing in realtime and goes over tools that may be used to flag suspected spoofing activity.
Tactics to Influence the Crypto Price Movement
Trading news in the crypto industry is frequently abuzz with reports of whale activity. Given the transparency of blockchains, these reports are skewed toward large movements of funds to and from exchanges. However, there are strategies to influence price movements that do not necessitate the net buying or selling of any assets. These strategies are known as spoofing or order book manipulation and are well-known in traditional finance. Just last year, in November 2023, the federal grand jury in Newark, New Jersey, charged the former head of U.S. Treasury Trading at Jefferies, Jeyakumar Nadarajah, for engaging in a spoofing scheme to manipulate the secondary cash market for U.S. Treasuries. Although similar activities occur in crypto, they are discussed relatively infrequently by investors and traders.
To understand the phenomenon of order book spoofing, one must comprehend that traders and bots use order book depth to gauge resistance and support levels. A high density of orders at a particular price level constitutes a buy or sell wall that may decelerate, stop or reverse a price trend. If there is a discrepancy between the quantity of buy and sell orders, this indicates that price support and buying pressure are greater than resistance and selling pressure (or vice versa). The problem with this heuristic is that order books can be manipulated by strategically submitting orders that will be canceled before execution.
Such false orders are employed in a family of strategies called spoofing. For example, a spoofer could create a deceptive signal of price support through disingenuous buy orders (unfilled blue triangles in Figure 1), which tend to push the price up. Simultaneously, a sell order (unfilled blue square in Figure 1) for the asset is placed to capitalize on the expected price impact of the spoofed trading signal (filled blue square in Figure 1). In the converse strategy, a spoofer may place sell orders to push down the price (unfilled red triangles in Figure 1) and thus get a lower buy-in price (filled red square in Figure 1). Traders and bots that use order book depth as an indicator are misled and systematically drive the price in the direction favorable for the spoofer (shaded cumulative orders in Figure 1). In other words, spoofers attempt to deceive bots into copying and attempting to front-run their fake orders.
Since trading bots can execute thousands of trades per second, this strategy exacerbates price shifts, increasing the efficiency and spread of price manipulation. This can kick in a positive feedback loop. The influx of bot-generated orders intensifies the illusion of market activity and can lure in more unsuspecting traders and bots. Once the manipulated price hits the spoofer’s target, a single authentic trade is executed for profit (filled squares in Figure 1). The spoofer then cancels the fake orders at no expense, removing the artificial illusion of liquidity.
Identifying Spoof Strategies Used to Manipulate Crypto Markets
Real-time detection of liquidity spoofing is challenging, yet liquidity maps are at least a valuable tool for visualizing imbalances between supply and demand in order books. These maps can indicate when liquidity vanishes due to order cancellations or strategic relocation to different price blocks. This can be used to evaluate whether liquidity influxes were genuine indicators of future price movement or spoofed events. Spoofing might have occurred if liquidity appeared on the map and disappeared after or throughout a price movement. However, given that liquidity maps are often the only data source, there is always the benign alternative explanation that a market participant simply decided to raise their buy-in price or lower their desired sell price.
In Figure 2, a potential instance of spoofing is evident. As the blue trend line starts to fall from $44,000, a surge in liquidity at $41,000 appears. This suggests buying support at $41,000, leading to a reversal and breaking the descending trend. Following the reversal, the liquidity vanishes, potentially due to order cancellation.
In Figure 3, two potential spoof events are identified. The green box highlights a bid ladder worth about $37 million that vanishes from the $39,000 to $40,000. The orders may have been introduced in an attempt to reverse the upward trend. When the reversal is observed, the orders vanish from the map. The blue box highlights the movement of a liquidity wall that starts at $42,000, jumps to $44,000, and then moves back to $42,000 when the uptrend is confirmed to have stopped.
A limitation of liquidity maps is their inability to attribute an influx of orders to a specific account on a centralized exchange. There is no way to prove that a single entity or manipulator moves the liquidity unless the quantities are conspicuous or can be correlated with on-chain withdrawals. Suspected spoofing events often only become apparent when observing the entire trend retrospectively. By the time it is identified, market participants have already been manipulated in their actions. It is impossible to ascribe intention to movements of liquidity within order books with total certainty.
The obscurity and persistence of spoofing activity
Detecting the true prevalence of spoofed liquidity is challenging for the general public, given the anonymous, unregulated, confusing, and transparent nature of order books. Introducing fake orders adds complexity, making it difficult for the untrained eye to distinguish between authentic and manipulative orders.
Furthermore, exposing spoof trading holds little appeal for smaller exchanges, as it lures in genuine traders who use order book depth as an indicator by creating a false illusion of liquidity. This, in turn, generates transaction volume, enhancing the exchange’s rankings on platforms like CoinMarketCap, which is financially lucrative. Without Know Your Customer (KYC) requirements, some exchanges allow users to open multiple anonymous accounts, further reducing the traceability of spoofs. Quantifying the frequency of liquidity spoofing would likely require correlating users across platforms to identify spoofers with better operational security that spread out their orders on multiple exchanges. In-depth statistical analysis of order book behavior requires acquiring the most granular order book data (level 3), which is costly and challenging for the general public.
Spoofing Identified in the LUNA/USD Crash
An analysis of the level 3 order book data for the LUNA/USA pair during the flash crash (11th May 2022) used a method for identifying spoofing by modeling order books using particle momentum. In this model, orders were modeled as particles moving through the order book as in a physical system. In comparing the pressure exerted by authentic orders to fake orders, it was found that fake orders introduce transient pressure to the system’s momentum, which creates artificial supply and demand patterns indicative of spoofing.
During the crash, an order book imbalance emerged, indicating that market buy orders struggled to outweigh the sell limit orders. Within one hour, 124 uniform-sized orders were placed and subsequently canceled (Figure 4). Throughout the crash, 248,796 orders were submitted and canceled, which created a false impression of sell pressure. The heightened volatility during the crash further diminished liquidity, contributing to a price downfall.
The study also provided insight into the dynamics of placing spoof orders by dividing the order book depth into passive and active zones based on price activity. With less liquidity in the passive zones compared to the active zones, a change in momentum is more pronounced, clearly identifying spoof orders (Figure 5). The research revealed that spoof orders are commonly positioned in the passive areas of order the book to create directional pressure while minimizing the risk of accidental order execution (Figure 6).
Conclusion
The obscurity of order book spoofing underscores the pressing need for advanced tools and collaborative efforts from exchanges to address this manipulation to uphold market integrity. To safeguard the crypto market from deceptive practices, exchanges should employ methods that transparently report accurate market liquidity to help prevent spoofing events. Decentralized order book exchanges have the chance to lead the way in combating spoofing within the industry. They could do so by implementing measures such as imposing fees for order cancellations, preventing traders from deleting multiple limit orders simultaneously, enforcing the execution of limit orders until they expire, and disclosing the wallet identity of traders. However, some exchanges seem to be moving in the opposite direction, and the ability to cancel multiple limit orders is promoted as a platform advantage.