Iceberg Orders & Spoofing
Nydar's Level 2 and order flow widgets detect iceberg orders and spoofing patterns in the order book automatically. Studies estimate that 10-30% of visible order book depth on major exchanges is spoofed. Learn to distinguish real supply and demand from manufactured illusions.
What is an Iceberg Order?
An iceberg order is a large limit order split into smaller visible portions. Only a fraction — the tip of the iceberg — appears in the order book at any time. When the visible portion is filled, the next chunk automatically appears at the same price.
Why Institutions Use Icebergs
Nydar's Level 2 and order flow widgets detect iceberg orders and spoofing patterns automatically. A 50,000-contract order visible on the book would move price before it fills
Other traders would trade ahead if they saw the full size
Smaller visible size means less price slippage during execution
Competitors and counterparties cannot see the full position being built
Iceberg in Action
Order book at 29,500 (bid side):
14:00:01 — Bid: 200 contracts at 29,500
14:00:03 — 200 sold at market → bid filled
14:00:03 — Bid: 200 instantly reappears at 29,500
14:00:05 — 200 sold at market → bid filled again
14:00:05 — Bid: 200 instantly reappears at 29,500
... this repeats 25 times over 8 minutes ...
Total bought at 29,500: 5,000+ contracts
Max visible at any time: 200 contracts
Without iceberg detection, a trader watching the order book would see an unremarkable 200-contract bid. With detection, they see a massive hidden buyer accumulating 5,000+ contracts — critical directional information.
How to Detect Iceberg Orders
1. Rapid Refill Pattern
The most obvious tell. A price level gets filled and immediately refills with the same (or similar) size. Genuine retail orders do not replenish — once filled, they are gone. Consistent refilling is an iceberg.
Detection rule: If a level refills 3+ times within 60 seconds with similar size, it is almost certainly an iceberg.
2. Volume vs Visible Depth Mismatch
Compare the total volume traded at a price level (from the tape) to the maximum visible depth in the order book. If 3,000 contracts have traded at 29,500 but the book never showed more than 200 at that price, hidden orders are present.
Detection rule: Cumulative volume at a level exceeding 5x the maximum visible depth signals iceberg activity.
3. Footprint Chart Concentration
On a footprint chart, an iceberg level shows disproportionately high volume at a single price tick compared to surrounding levels. If one level has 800 contracts and adjacent levels have 30-50, that concentration reveals hidden depth.
Detection rule: A single price level with 10x+ the volume of adjacent levels, combined with price not advancing through it, points to an iceberg.
4. Time & Sales Pattern
Watch for repeated fills of identical size at the same price. An iceberg that shows 200 contracts at a time will produce a series of 200-lot fills. Randomised icebergs vary the display size (180, 210, 195) but the fills still cluster around a consistent range.
Detection rule: 5+ fills of similar size (within 20% variance) at the same price within a short window = iceberg.
Trading Around Iceberg Orders
Detecting an iceberg gives you an information edge — you know a large participant is committed to a specific price. The question is how to use that information.
Trading With the Iceberg
If you detect an iceberg buyer at support, the level is strongly defended. Trade in the same direction as the hidden player.
Entry: Near the iceberg level (the hidden player is your backstop)
Stop: Just below the iceberg level (if it breaks, the player has been overwhelmed)
Target: The next significant level above, using value area or volume profile
Trading the Iceberg Failure
If the iceberg is eventually consumed (stops refilling), the level will break violently. All the volume absorbed creates a vacuum.
Watch for: Refill pace slowing, display size shrinking, or complete disappearance
Entry: On the break through the level, in the direction of the aggressive flow
Target: Acceleration move — once a defended level breaks, price often moves fast
Critical distinction: An iceberg is a real order — the participant genuinely wants to buy or sell at that price. This makes it fundamentally different from spoofing, where the order is fake and will be cancelled before execution.
What is Spoofing?
Spoofing is market manipulation where a trader places large orders they never intend to execute. The goal is to create a false impression of supply or demand, trick other participants into reacting, then profit from the resulting price move. Spoofing is illegal in regulated markets and banned on most exchanges.
Anatomy of a Spoof
Place a large visible order. The spoofer places a 10,000-contract sell order at 30,100, making the book look very heavy on the ask side.
Other traders react. Seeing massive selling pressure, other traders sell ahead of the wall. Price drops from 30,050 to 29,980.
Cancel and reverse. The spoofer cancels the 10,000-contract sell order (it was never meant to fill) and aggressively buys at 29,980.
Price recovers. Without the fake selling pressure, price rebounds to 30,050. The spoofer profits from the manufactured dip.
Legal status: Spoofing violates market manipulation laws in most jurisdictions. It is a criminal offence under the Dodd-Frank Act in the US and the Market Abuse Regulation in the EU. Major exchanges actively detect and ban spoofers. Despite this, it still occurs — particularly in less-regulated markets and during volatile conditions.
How to Detect Spoofing
1. Orders That Pull Away
The defining characteristic. A large order appears on the book but disappears as price approaches it. A genuine order stays and gets filled; a spoof retreats. If a 5,000-contract ask at 30,100 vanishes when price action reaches 30,095, it was almost certainly a spoof.
2. High Order-to-Fill Ratio
Spoofers place many orders but fill very few. Track how often large orders at a level result in actual trades versus cancellations. A participant whose large orders are cancelled 90%+ of the time is likely spoofing.
3. Rapid Place-Cancel Cycles
Spoofing algorithms place and cancel orders in milliseconds. Watch for large orders that appear, disappear, and reappear at different levels in quick succession. The order is not waiting to be filled — it is chasing the impression of depth.
4. One-Sided Book Loading
Spoofers load one side of the book to create directional pressure. If the ask side suddenly shows 10x the depth of the bid but no trades are occurring at those ask levels, the depth is likely spoofed. Real selling pressure would result in trades.
5. Correlation With Opposing Trades
The most telling pattern. A large sell order appears → price drops → the sell order disappears → aggressive buying at the lower price. The spoof and the opposing trade are from the same participant. Watch for this place-scare-cancel-trade cycle.
Iceberg vs Spoof: The Key Differences
| Characteristic | Iceberg (Real) | Spoof (Fake) |
|---|---|---|
| Intent | Wants to be filled | Wants to scare, not fill |
| Fills | Gets filled repeatedly | Rarely or never fills |
| When price approaches | Stays and absorbs | Pulls away or disappears |
| Visible size | Small (hides the real size) | Large (exaggerates the impression) |
| Duration | Persists for minutes to hours | Appears and vanishes in seconds |
| Trading implication | Trade with the iceberg | Trade opposite the spoof |
The key test: Does the order get filled and refill, or does it disappear when challenged? Icebergs absorb flow and replenish. Spoofs evaporate when price threatens to execute them.
Trading When You Detect Spoofing
If you detect spoofing, the contrarian trade is often correct. Nydar's order flow tools flag rapid place-cancel cycles so you can spot these patterns as they develop. The spoofer wants you to trade in one direction while they trade in the opposite direction.
Spoofed Selling Pressure → Buy
Signal: Large ask orders appear but keep pulling away. Price dips on fear but no real selling occurs in the tape.
Confirmation: CVD stays flat or rises despite the visible selling wall. Tape shows no large sell prints.
Entry: Buy the dip when you see the spoof cancel and aggressive buying begin.
Stop: Below the level where genuine selling would need to appear for the move to be real.
Spoofed Buying Pressure → Sell
Signal: Large bid orders appear but vanish when price drops toward them. False support.
Confirmation: CVD is falling despite the visible bid wall. Tape shows aggressive selling.
Entry: Short when the spoofed bid disappears and price breaks the level.
Stop: Above the spoofed level — if genuine buying actually appears, exit.
Caution: Spoofing detection requires confidence. A large order that moves is not always a spoof — it could be a legitimate participant adjusting their price. Only trade the contrarian setup when you see the full cycle: place → scare → cancel → trade in opposite direction.
Common Mistakes
Assuming Every Large Order is an Iceberg or Spoof
Most large orders are exactly what they appear to be — a participant who wants to buy or sell. Icebergs and spoofs are the minority. Use the detection criteria rather than assuming manipulation.
Confusing Legitimate Order Adjustments With Spoofing
Traders legitimately move their orders as market conditions change. An order that moves from 30,100 to 30,105 is not necessarily a spoof — they may have adjusted their view. Spoofing involves placing orders with no intention of execution.
Trading Icebergs Against Their Direction
If you detect an iceberg buyer, do not short against them. You are fighting a participant with deep pockets who is committed to that price. Trade with the iceberg, not against it.
Relying on Order Book Alone
The order book is a snapshot that changes constantly. Always cross-reference with the tape (actual executed trades) and CVD. The book shows intentions; the tape shows reality.
Key Takeaways
- Icebergs are real orders — large positions hidden behind small display sizes. They absorb flow and refill. Trade with them.
- Spoofs are fake orders — placed to deceive, never meant to execute. They pull away when challenged. Trade against them.
- Detect icebergs by watching for refilling levels, volume/depth mismatches, and repeated similar-size fills.
- Detect spoofing by watching for orders that pull away, high cancellation rates, and the place-scare-cancel-trade cycle.
- Always confirm with the tape. The order book shows what people say they want to do. The tape shows what they actually did.
Related Guides
Detect Hidden Orders
Nydar's Order Flow widget includes iceberg detection and spoofing alerts to help you see what the order book is hiding.
Get Started FreeFurther Reading
- Investopedia: Iceberg Orders — How hidden orders work in financial markets
- Investopedia: Spoofing — Market manipulation through fake orders
Written by Ryan Clinton
Founder of Nydar. Software engineer with experience at Cowen Inc (Wall Street) and on large-scale infrastructure projects. Built Nydar to make professional trading tools accessible to everyone.
Last reviewed: March 2026