How Crypto Exchanges Spot Fake Trades and Spoofing

The tape tells a story. Sometimes a lie.

Imagine you are watching a market. The “tape” is an old nickname for the stream of prices and trades that shows what a market is doing. Most days it is boring. But every so often, a huge buy order appears, and it feels like a signal. Then, just before it can be filled, the order vanishes. The price moved, some people bought, and whoever placed that order quietly made money on the other side. That is spoofing: placing an order with no intention of letting it execute, simply to make the market look more bullish or bearish than it really is. In the United States, spoofing is a federal crime punishable by up to ten years in prison per violation.

Layering is the more patient cousin. Instead of one giant phantom order, a trader places several smaller fake orders at different price levels. Together they create the illusion of depth, as if a wave of buyers or sellers is building. When the price reaches the intended point, the trader cancels the fake layers and trades for real on the other side. Wash trading is different again: the same person, or a group working together, buys and sells the same asset to make it look as though there is far more activity than there really is. No genuine risk changes hands, but the volume figures look impressive.

These tricks are as old as markets. What is new is how crypto exchanges and regulators have learned to watch for them.

Why crypto is a tempting playground

Crypto markets are global, fast, largely anonymous, and many operate outside strict regulatory oversight. That combination is a gift to anyone who wants to fake activity. A widely cited study of 29 centralized exchanges found that unregulated exchanges showed abnormal patterns: suspicious first-digit distributions in prices, odd rounding of trade sizes, and distorted transaction tails. On those unregulated platforms, researchers estimated that more than 70 percent of reported volume was wash trading, adding up to trillions of dollars a year. Regulated exchanges in the same study looked much more like normal financial markets. The lesson is not that every unregulated exchange is crooked. It is that fake volume can hide in plain sight when no one is required to look.

Pseudonymity makes it harder. On a blockchain, a wallet is just a string of letters and numbers, and one person can create many wallets. From the outside, a trade between two wallets looks like independent activity; from the inside, it is one owner trading with herself. That is why wash trading thrives in crypto and NFT markets. Researchers studying NFT, or non-fungible token, collections found that wash trading accounted for up to 24 percent of trading volume in several top collections. In one outlier collection, Meebits, around 93 percent of volume appeared to be wash trading.

How exchanges watch the order book

An order book is the exchange’s live list of buy and sell orders waiting to be executed. Modern surveillance systems are built to watch it in ways human eyes never could. Vendors such as Nasdaq supply market-monitoring tools used by more than 50 of the world’s largest exchanges. These systems use artificial intelligence and machine learning to flag suspicious behavior, with more than 70 pre-configured alerts, and can reconstruct the entire order book after the fact. Investigators can replay any moment in granular detail, down to individual orders and trades. That turns a confusing burst of activity into a clear, frame-by-frame story.

Exchanges also build their own defenses. Kraken, for example, has described real-time market surveillance, ongoing risk assessments, and regular training for staff who look for suspicious behavior. The telltale signs investigators watch for include large orders that appear and vanish rapidly; repeated placement and cancellation of sizable orders without execution; waves of liquidity disappearing right before a price move; and price swings that have no news or fundamentals behind them. No single clue proves manipulation, but clusters of clues are much harder to explain away.

Newer research goes even deeper. One study trained a neural network on level-three order-book data, the kind of data that shows every submitted order, to predict how prices are likely to move. The model found that where a fake order is placed, not just its size, matters enormously. When researchers ran the algorithm over several days of bitcoin and ethereum order data, they estimated that 31 percent of large orders could have spoofed the market. The authors say their approach can run in real time. That is a useful reminder: detection is not magic, it is pattern recognition at scale.

Statistical fingerprints and links

Numbers have habits. Real markets produce prices and trade sizes that follow certain statistical patterns, such as Benford’s law, which predicts how often numbers begin with each digit. Wash trading tends to leave a fingerprint: values that are rounded too neatly, tails that are too fat, or a first-digit distribution that looks unnatural. Researchers use these quirks to estimate how much reported volume is fabricated.

In NFT markets, another technique borrows from social graphs. If two wallets have sent ordinary Ethereum payments to each other in the past, they are probably linked by trust or shared ownership. By building “linkability” networks from transaction histories, researchers can catch wash trades that look like separate buyers and sellers but are really one hand moving assets between pockets. The blockchain’s transparency, which makes every transaction visible, is exactly what makes this kind of detective work possible.

When regulators join the party

Exchanges do not work alone. The U.S. Commodity Futures Trading Commission, known as the CFTC, has made digital assets and manipulation top priorities. In fiscal year 2023, it filed 96 enforcement actions and collected more than $4.3 billion in penalties, restitution and disgorgement of ill-gotten gains. The next year, the number of new actions fell to 58, but monetary relief reached a record $17.1 billion, thanks largely to big digital-asset cases. These included a $12.7 billion judgment against FTX and Alameda Research, and a case against Binance that produced $1.35 billion in civil penalties and $1.35 billion in disgorgement, with another $150 million paid by its founder.

Spoofing has brought down individual traders too. Two former precious-metals traders were convicted in criminal court and later faced civil penalties and trading bans; one was sentenced to two years in prison. Banks have also paid for weak surveillance. JPMorgan Securities paid $200 million after failing to supervise its business and failing to capture billions of orders in its surveillance systems. The enforcement order required the firm to hire a consultant to review its trade-surveillance controls. In other words, failing to watch for manipulation can itself be treated as a violation.

The CFTC now has a dedicated Surveillance and Enforcement Data Analytics Office to scrutinize markets and build new detection tools. It also runs a whistleblower program. Since the program began, the agency has issued nearly $390 million in awards to people who provided original information about misconduct. In fiscal year 2024, whistleblowers submitted more than 1,700 tips. Some of the best clues about manipulation come from insiders who saw it happen.

What an ordinary person can take from this

The honest answer is that no surveillance system is perfect. Crypto exchanges still operate in regulatory gray zones in some parts of the world, and even well-regulated markets are not immune to manipulation. Spoofing and wash trading are illegal in the United States and many other jurisdictions, but illegality does not mean instant detection.

For most people, the practical lesson is to understand that volume and order books can be dressed up. A wall of buy orders is not proof that a price will rise. A high-volume day is not proof that many people changed their minds. Regulators urge the public to check whether a platform is registered and whether its claims can be verified before sending money anywhere. For many people, choosing a platform with real supervision, rather than the most exciting chart, may be one of the most meaningful decisions they control. And if a market signal looks too perfect, it may have been designed to look that way.

In the end, the battle against spoofing, layering and wash trading is a contest between people who hide in patterns and people who look for patterns. The tape tells a story either way. The question is whether anyone is reading carefully enough to spot the parts that were never true.