Icebergs, spoofing and hidden liquidity

A displayed order can be smaller than the trader's true intended size. It can also disappear before anyone trades into it. Those two observations often get labeled iceberg and spoofing, but the labels require care. The order book reveals behavior; it rarely reveals a participant's full instruction or intent.

How an iceberg works

An iceberg order displays only part of its total quantity. As the visible part fills, the system can refresh another portion. On a ladder, the price might repeatedly show a small quantity while much more volume trades there than the displayed amount suggested. That pattern is consistent with reserve liquidity.

It is not a unique fingerprint. Several independent traders can place new orders at the same price, and an aggregated feed can make replenishment look like one order. A trader reading the DOM can say that liquidity kept appearing and trades kept executing. Identifying a specific hidden participant takes information the screen may not provide.

What spoofing means legally

In U.S. futures markets, the CFTC describes spoofing as entering bids or offers with the intent to cancel before execution. Intent at entry matters. A large order that disappears is not automatically a spoof. A trader might cancel because price, risk, or information changed. Regulators investigate patterns and surrounding evidence, not a single blink on a ladder.

From a trading perspective, the practical issue is whether the displayed quantity was dependable when price reached it. If size repeatedly pulls just before a test, stop treating it as a firm barrier. That is a market-reading adjustment, not a legal accusation against an unidentified account.

Compare displayed size with executed size

Suppose 200 contracts appear at a bid and 1,500 contracts trade at that price while the bid keeps refreshing. The visible screen understated the liquidity actually supplied during the test. If price still breaks lower, the replenishment did not prevent the move. If price stabilizes, the repeated executions give the level more substance than the initial 200-contract display did.

Now suppose 1,500 contracts appear at an offer but vanish before a trade reaches it. They did not absorb a single buyer. The observation says less about future price than a completed execution would.

Use the lesson at a level

At a prior high, a value edge, or a modeled gamma wall, note what was displayed, what actually traded, and how price behaved afterward. Keep those three observations separate. Options positioning may identify the area; executed order flow tells you what happened there. Neither proves the identity of the trader supplying liquidity.