In 2015, Michael Coscia became the first person criminally convicted under the US anti-spoofing law. His algorithm placed large orders on one side of the futures book, waited for others to react, then cancelled everything within milliseconds — thousands of times per day, across multiple markets. By the time regulators caught up, he had run the scheme for two months and generated over $1.4 million in profit.
Five years later, JPMorgan Chase paid $920 million to resolve allegations that traders on its precious metals desk had been doing variants of the same thing for nearly a decade.
These aren't edge cases. They're the visible tip of a manipulation playbook that runs at scale in futures markets — including crypto futures — and understanding how each technique works is the prerequisite for not getting caught on the wrong side of it.
Spoofing: The Fake Order That Moves Price
Spoofing is the practice of placing a large order on one side of the book with no intention of letting it execute. The order appears, influences how other participants behave, and gets cancelled before price arrives at it.
The mechanics are precise. A spoofer who wants to buy at a lower price places a large ask order well above the current price — creating the appearance of significant selling pressure overhead. Other participants see the supply and either exit longs or hesitate to buy. Price softens. The spoofer buys at the now-lower price, then immediately cancels the large ask that created the impression. Nothing executed against the fake order. The entire sequence took seconds.
The same works in reverse. A spoofer who wants to sell places a large bid below current price. Shorts cover off the apparent support. Price lifts. The spoofer sells at the higher level, cancels the fake bid, and the sequence is complete.
What makes spoofing detectable on the order book — but invisible on a price chart — is the timing. Real limit orders persist as price approaches them. They get absorbed, partially filled, or depleted. A spoofed order disappears while price is still well away from it. The cancellation happens the moment the price move has occurred, not when price threatens to execute against it.
In crypto futures specifically, the CFTC charged its first Bitcoin futures spoofing case in 2021, establishing that spoof order patterns in those markets fall squarely within its jurisdiction. The legal standard under the Commodity Exchange Act requires proving the order was placed "with the intent to cancel before execution." The heatmap makes that intent visible: a wall that vanishes while price is still distant has no honest explanation.
Layering: Building a Staircase of False Depth
Layering is frequently confused with spoofing, but the mechanics are meaningfully different — and the legal treatment reflects that distinction.
Where spoofing uses a single large order to create a directional impression, layering places multiple orders at staggered price levels on one side of the book to create the appearance of genuine, deep market interest. The orders aren't cancelled immediately — they sit in the book long enough to influence how other participants read the depth, then get pulled as price moves in the intended direction.
A practical example: a trader wants to push price lower. They place five sell orders at ascending prices above the market — say $89,000, $89,200, $89,400, $89,600, and $89,800 — each in decreasing size, creating a staircase of apparent resistance. Other traders look at the book and see strong, layered selling pressure above. Longs who were holding become hesitant. New buyers hold back. The lack of buying pressure lets price drift lower. The trader then buys at the lower price, and cancels all five layered orders simultaneously.
The key distinction from spoofing is that the layered orders remain in the book throughout the scheme. They're real orders — just not orders the trader intends to execute. The intent isn't rapid cancellation; it's to create a persistent false impression of depth that influences positioning before a targeted move.
Solidus Labs, which runs trade surveillance across crypto exchanges, has developed detection algorithms with over 200 parameters specifically to distinguish layering from legitimate market-making — which also involves placing multiple orders at different levels. The line between the two is genuinely thin: the difference is intent and cancellation pattern, not order structure.
What Separates Them — and Why It Matters
Both spoofing and layering are illegal under the Dodd-Frank Act and prosecuted under the Commodity Exchange Act. Both involve orders that aren't genuinely intended to execute. But treating them as the same tactic leads to missed signals.
The core differences:
Spoofing uses one large order, cancels it rapidly — often within milliseconds — and works primarily through directional psychology. It targets the impression of a single major participant on one side. The cancellation is the tell.
Layering uses multiple orders at different levels, maintains them for longer to create the impression of genuine depth, and works through structural psychology — making the book look heavy on one side. The simultaneous cancellation of all layers after the targeted move is the tell.
On the heatmap, a spoof looks like a single bright band appearing then vanishing. A layering scheme looks like a staircase of moderate bands on one side, all of which disappear together the moment price has moved in the intended direction.
Both produce a situation where the book looked like it had weight in one direction — and didn't. Both leave retail participants holding positions sized for a market structure that no longer exists.
The Real Consequences — Cases That Shaped the Rules
The regulatory response to spoofing has escalated consistently since 2010. The pattern is worth knowing.
Navinder Sarao (2016 guilty plea): The British trader's spoofing in E-mini S&P 500 futures contributed to the 2010 Flash Crash. His algorithm placed and cancelled large layered orders on the sell side to create downward pressure, a scheme that ran for years before the Flash Crash investigation identified him. He pleaded guilty to spoofing and wire fraud.
Michael Coscia (2015): First criminal conviction under the US anti-spoofing statute. His algorithm placed large futures orders across CME and ICE markets to move prices, then immediately cancelled them once smaller orders on the other side had filled. Convicted and sentenced to three years in prison.
JPMorgan Chase (2020): The bank agreed to pay $920 million — the largest spoofing settlement to date — to resolve allegations that traders on the precious metals and Treasury futures desk had engaged in spoofing and layering for years. The settlement covered criminal, civil, and regulatory charges simultaneously.
CFTC v. Bitcoin futures (2021): The CFTC's first crypto futures spoofing prosecution established that manipulation enforcement applies fully to digital asset derivatives. The legal framework is identical to traditional futures — intent to cancel before execution is sufficient for the charge.
The line between standard market-making activity and market manipulation is thinnest where layering and spoofing occur when orders are placed on both sides of the market. That blurriness is exactly what makes these cases difficult to prosecute and exactly what makes pattern recognition in the live order book so valuable for the trader on the other side of it.
What It Means for Your Trades
You are unlikely to be the target of spoofing or layering — the tactics are designed to move institutional-scale markets, not to specifically trap retail positions. But you are consistently on the wrong side of the market structure they create.
When a large bid wall appears at a key level and your thesis becomes "this level is defended," you're responding to the manipulation — not to genuine market structure. When a staircase of sell orders above price makes you hesitate on a long setup, you may be looking at a layering scheme rather than real resistance.
The protection is the same in both cases: watch what the book does as price approaches the level. Real liquidity persists, absorbs, and depletes slowly. Spoofed orders vanish before contact. Layered orders cancel simultaneously the moment the price move completes. The timing of the cancellation relative to price is the signal that no chart pattern can give you.
QuantFlows visualizes the live order book, CVD, and liquidity behavior across Binance, Bybit, OKX, and Hyperliquid in real time — making spoofing and layering signatures visible before they complete. Free during beta at quantflows.xyz.