A large order wall looks like support or resistance. The problem is that orders in the book can be pulled at any time before price touches them. What separates genuine liquidity from spoofing is what happens as price approaches, not the size of the wall.
What is spoofing
Spoofing means placing large orders with no intent to execute them. The aim is to make the market believe buying or selling interest is larger than it really is. Other traders then react to a wall that was never meant to fill.
Two patterns, two behaviors
| What to observe | Genuine liquidity | Spoofing pattern |
|---|---|---|
| As price approaches | Orders stay and fill | Orders are pulled before being touched |
| Wall history | Holds, with few cancellations | Appears and disappears repeatedly |
| Execution | Volume actually trades | Much displayed, little executed |
| Effect on price | Absorbs pressure at that level | Price breaks through after the wall disappears |
Four checks in Antick
Open Liquidity Behavior Intelligence, then Fake & Trap Detection. Choose the asset and timeframe you follow.
- Spoofing Pressure. This card summarizes how many orders appear and disappear without ever trading. A low value is what you want to see.
- Wall Stability. This card shows how often large walls disappear. A low ratio means walls tend to hold.
- Wall history. Find the price level in the Fake Wall & Trap Map. A wall repeatedly marked fake deserves suspicion.
- What actually happened. Compare in Displayed vs Executed Liquidity. Genuine liquidity fills when price arrives, while spoofing leaves first.
Use at least two checks before treating a wall as fake. A single read can simply be noise.
Limits you should know
Antick measures order behavior, not the intent behind it. A cancelled order is not necessarily spoofing, because market makers routinely update their prices. So high Spoofing Pressure is a caution flag, not proof of manipulation.
Reads can also differ across timeframes. On BTC, Spoofing Pressure showed MPI −1.87 on 1H, −3.46 on 4H and −0.21 on 1D, although all three were labeled Low.
The picture worth watching is a combination of three things: high Spoofing Pressure, unstable walls and a strong Trap Bias. One card alone rarely tells the whole story.
Case study: orders that almost never filled
One spoofing case with a detailed official record comes from stock index futures, not crypto. Navinder Sarao pleaded guilty in November 2016 to spoofing and wire fraud in E-mini S&P 500 futures. The pattern is still useful because the CFTC detailed how it worked.
His program placed 4–6 exceptionally large sell orders, at least 3–4 price levels away from the best ask. As price moved, all the orders shifted so they stayed out of reach, and were eventually cancelled.
Here is the CFTC record for May 6, 2010:
| What was observed | CFTC record |
|---|---|
| Time the program ran | 4 hours 25 minutes |
| Order modifications | More than 81,000 |
| Actually executed | 81 lots |
| Share of the sell side of the order book | 20–29% |
| Displayed downward pressure | About US$170 million to over US$200 million |
These numbers match the four checks above. The share of the book was large, yet execution was tiny. The orders also never waited to be touched by price. This is why Displayed vs Executed Liquidity matters more than wall size alone.
Two things to keep in mind. That day's market drop cannot be explained by these orders alone, since a CFTC commissioner named large selling by another institution as the trigger. The legal conclusion also came from an investigation and a guilty plea, which an Antick card cannot provide. A card only shows order behavior.
This example is not an Antick read, because Antick reads crypto markets and this event happened in another market.
Case study: BTC 1H in Antick
On the candle that closed at 19:00 UTC on October 30, 2026, the BTC summary cards looked calm. Spoofing Pressure was labeled Low (MPI −1.87), Wall Stability None (WDR 0.17), and Trap Bias None (TI −0.56).
The Fake Wall & Trap Map gave a more detailed picture. It recorded 260 walls, with 121 marked fake and 127 cancelled. Execution Skew was also labeled Displayed (LIR 70.65).
So the summary cards are not enough on their own, and the map does not prove spoofing either. The map runs LIVE, while the cards come from a closed candle, so their data windows differ. LBI confidence at that moment was also only 22%, so the sensible conclusion was to keep monitoring.
Related guides: Spoofing versus genuine liquidity: how to tell them apart, Fake & Trap Detection: the six state cards, Displayed vs executed liquidity: how much of the book was real
