Making Crypto Markets Safer: Recognizing Spoofing & Bad Behaviors in Cryptocurrency
We found nearly 100,000 incidents of spoofing analyzing 1 month on 1 crypto exchange
By exposing bad behaviors in cryptocurrency we can improve the overall quality of the digital asset market, protecting consumers.
written by Steve Brucato
Chief Technology Officer & cofounder at bitsian
By exposing bad behaviors, we strive to improve the overall quality of digital asset markets, therefore, making the ecosystem safer and better for all customers. As we started on the path of building trading tools for cryptocurrency one question kept floating in my mind: 'Is there spoofing and wash-trading in crypto markets?'
Building a trading technology, we want our customers to trade on good, clean and quality data. As we could not find good insights on these studies being done, we produced the research ourselves. It is costly, time consuming and a risk but worthwhile to keep consumers safe. We tested a popular crypto exchange, limiting our dataset to one month in 2018. Through it we sought to understand spoof incidents.
This is a natural to ask, given the volatility of the asset class and the infancy of the market. My 30+ year career in financial technologies at Goldman Sachs and firms like it taught me that spoofing was normal practice in traditional electronic equities before regulators came in to stop it and that people would continue to try and spoof, because the rewards were sometimes worth the risk for them.
The results were astounding.
Our research led us to find nearly 100,000 incidents of spoofing in a one month period across only 3 trading pairs.
I presented this research at The Trading Show in Chicago video below and deck here
What is Spoof?
"Spoofing is a practice in which traders attempt to give an artificial impression of market conditions by entering and quickly canceling large buy or sell orders onto an exchange, in an attempt to manipulate prices. The 2010 Dodd-Frank Act specifically forbids spoofing. The goal of a spoofer is to make any product look like there is a lot of potential in the market and to manipulate prices up or down, so that they can trade at a profit--at the loss of others.
Spoof orders have several characteristics that define them as a spoof:
Why is spoof bad & how does spoof impact people?
Spoofing in crypto matters because market prices are being manipulated providing an unfair advantage to the spoofer over other market participants.
Spoof matters because somebody is always the loser.
In traditional markets regulators will take spoofers to jail in order to prevent spoof and protect consumers.
Anyone can be victim to spoof--and when you are spoofed, you can lose a lot of money.
An individual might spoof in order to move the market price so they can profit from this.
An exchange might spoof in order to make it look like there’s a lot of volume. When there is more volume on a platform, traders are likely to participate in that exchange.
Why does bitsian care?
In the absence of regulators, we offer that exchanges and exchange aggregators (like us) should look to protect consumers with protections against these behaviors. As crypto markets mature or become regulated, this behavior will diminish. Until then, we are doing analyses and strengthening our real-time trading tools to highlight bad behaviors in markets.
Fewer spoofs means a safer market for everyone trading.
bitsian’s research in spoof
We developed a spoof filter by analyzing historical market data and trade data. Only quote and trade data from the market was used for the analysis. We identified several possible patterns for to detect a spoof order while excluding normal order cancellations and trades. We implemented these patterns as “filters” through which we ran our historical quote and trade data. We compared several patterns, combined the best filters, and tuned the parameters until we had created a series of filters that successfully identified only spoof orders.
The output data sets of the filters were analyzed statistically to indicate which filters produced the most reliable detection of spoof orders, with the best specificity. More than one pattern was tested and selected, indicating more than one spoofing strategy at work.
Our analysis differentiated spoof orders from “natural” market events such as clients canceling an order, amending an order, or orders simply trading. We analyzed the trigger events for spoof order cancellations, the time from the trigger to the cancellation, and the size of the spoof orders.
It took us 4 months of playing around with the data to find our first instance of spoof. My first thought: maybe it's not spoof.
After 4 months of digging around, finding a potential case of spoof was both thrilling and nerve-wracking, but the first thing I thought was -- maybe we are wrong. Any researcher should immediately think false-positive!?! I can remember that clearly. I was worried that we might have overfit the filter to this data -- which means this filter works for this set of data, but not all sets of data--ie: confirmation bias. The appropriate next step was to try and confirm that it was indeed a false-positive. Which meant, trying to answer either of these questions with a yes:
We found 3 trading pairs totaled 98,698 spoofing events during a one month period, on a single market.
Insights (visualizations here)
The number of spoof events per product correlates very highly with the number of trades - more trade, more spoofs.
LTC-BTC was the pairing with the highest number of spoofs totaling 55,054 as it had a higher number of trades for the month than the other two products.
spoofs had about 3 seconds between trigger event and spoof event, with 50% of the spoof events happened between 2 and 4 seconds from the trigger event
A duration of 3 seconds from trigger might sound like a very, very long time if you’re familiar with high frequency trading, but keep in mind that most electronic crypto markets are relatively slow systems compared with mature electronic markets, and so their response times are much slower. Note also that most clients connect via the Internet and through APIs (typically REST) that are slower than networks and APIs of mature markets.
The spoofer had little concern about being discovered.
Our data found a very tight distributions of the result data sets indicates that a very predictable spoof strategy was being employed, and that is was likely programmatic.
Future spoof research at bitsian
We are expanding our spoof analysis to other markets and other products. We’re adding additional patterns to detect other spoof strategies. We realize that by publishing these results, spoofers merely chose to become more sophisticated and created harder to find spoofing patterns. We’re prepared to test and ongoing series of patterns to find harder to find strategies.
To improve the quality of our input data we have created a data quality layer to monitor gaps, detect errant ticks, and normalize the data across many exchanges to make our analysis repeatable across many markets. We are expanding our analysis to include other negative behaviors, including wash trades and false trade reporting. Again, we’re using quote and trade data for this analysis. We have other order and trade patterns were searching for as well.
Having identified various patterns for spoofs using historical data, we were able to create a predictive filter to work on real-time live market data. This predictive filter identifies bid and offer quantity in live market data that may be spoof, monitors them to see if they are later canceled, and thus computes a real-time confidence factor in how well the filter accurately predicts spoofs.
This tool will be implemented in our trading tool and is meant to assist trades is identifying spoof quantities to make better informed trading decisions. In general, the intent of most of our analysis on historical data is to create a predictive filter that can be applied to live streaming data, wherever we can. We will be releasing additional signals soon.
We will be publishing more results from our analyses on other markets from other filters and are eager to speak more about bad behaviors in these new promising markets. Please subscribe to be included in these updates and for new information.
We just sent you an email. Please click the link in the email to confirm your subscription!