Icebergs, spoofing and hidden liquidity

The book lies for two reasons: because size wants to hide, and because size wants to intimidate. Icebergs are the first — real intent showing a sliver of itself. Spoofing is the second — fake intent showing everything. Learning their fingerprints is what turns the DOM from a scoreboard into a source.

Icebergs: real size, small window

An iceberg displays a small quantity and reloads it automatically as it fills. On the ladder it looks unremarkable — two hundred at the bid — but the prints tell the truth: thousands trade at that price while the displayed size never dies. That mismatch between volume done and size shown is the fingerprint.

Icebergs matter because they are commitment. Someone chose to work real size at one price and to keep standing there while it is hit. Prices where icebergs complete their work often become the session’s durable levels — and when an iceberg finally pulls, the move it was blocking tends to go.

Spoofing: fake size, loud window

A spoof is displayed size with no intention of trading — placed to scare price toward the spoofer’s real order, then cancelled before it can be hit. The fingerprint is the inverse of the iceberg’s: enormous size that appears away from the market, retreats as price approaches, and never absorbs a single aggressive fill.

It is also illegal in regulated markets, which has not made it extinct. Your defence is simple: weight what trades over what rests. Size that has printed cannot be faked; size that is merely displayed can.

A working rule

• Volume done at a price outranks size shown at a price, always.
• Reloading after fills = probably real. Retreating before fills = probably theatre.
• An iceberg defending a level that positioning also flags — a put wall, a flip retest — is one of the strongest confluences intraday trading offers.