On September 28 2026 Willy Woo posted a heatmap of Bitcoin's order book on Binance. It shows the prices at which large buy and sell orders sit; the brighter the line, the more size. Above the price, which stood just under $83,000, Woo put arrows on bright lines and wrote next to them: "Fake scare walls". Below the price he drew a bracket: "Organic bids".
His text: the only sells on the order books are fake scare walls that get pulled at the last minute, while the bids are organic. "Interpretation: Bullish".
The accusation has a name: spoofing. Putting large orders into the book that are never meant to execute, so that others believe supply or demand is waiting there. It exists, and it is a crime. If the labels were backed by evidence, they would be valuable information.
Can a picture like this tell you which wall is fake?
A cancelled order is the normal case
In the United States, spoofing has been explicitly prohibited since 16 July 2011. The Dodd-Frank Act of 2010 added it to the Commodity Exchange Act. The statute defines spoofing in a parenthesis: bidding or offering "with the intent to cancel the bid or offer before execution".
Large orders are not prohibited. Cancelling orders is not prohibited. On US stock exchanges in 2012 and 2013, according to the SEC, only 3 to 4 percent of the order volume placed actually traded. The rest was modified or cancelled. Nobody has to prove an effect on the price either.
In the first criminal case, the Court of Appeals in Chicago drew the line like this: legitimate orders are designed to execute when certain events occur. Spoofing orders are placed with the intent to cancel them from the start.
So two orders can be the same size, sit at the same price and disappear just as fast, and only one of them is a crime.
A cancelled order is the normal case. What is criminal is the intent behind it.
How have courts proven that intent?
Coscia was convicted by a ratio, not by a wall
Michael Coscia was the first trader a jury convicted under this statute, on 3 November 2015 in Chicago. He was sentenced to 36 months in prison. The Court of Appeals upheld the verdict in 2017, and the Supreme Court declined the case on 14 May 2018.
The appellate opinion lists what established intent. Much of it is trading data, and specifically comparisons:
| Coscia | Comparison | |
|---|---|---|
| share of his small orders filled (CME) | 35.61 % | |
| share of his large orders filled (CME) | 0.08 % | |
| order-to-trade ratio | 1,592 % | 91 to 264 % for other traders |
| large orders in the market longer than one second | 0.57 % | 65 % for other high-frequency traders |
The court wrote that the contrast between Coscia's trading patterns and those of legitimate traders was "striking" and supported the conclusion of fraudulent intent.
A witness explained the numbers. Jeremiah Park had written Coscia's trading programs and testified that the large orders were designed to be cancelled if they ever risked being filled. Coscia wanted them to work "like a decoy".
What convicted Coscia was not a wall but a ratio: almost none of his large orders were ever filled.
The other known cases look similar. In Navinder Sarao's case, the 2015 criminal complaint quoted emails in which he asked the vendor of his trading software for a function that cancels orders "if the market gets close". The regulator, the CFTC, found that on the day of the 2010 Flash Crash his orders were modified more than 81,000 times and only 81 contracts were executed. Sarao pleaded guilty in 2016 and admitted at least $12.8 million in gains. For two former precious-metals traders at Merrill Lynch there were chats such as "I just put in 500 lots to spoof the gold". In the JPMorgan case, the Court of Appeals cited "substantial data evidence" in 2025, along with testimony from former colleagues.
In none of these cases was market data enough on its own. Each time something came in that is not in the order book: a programmer, emails, chats, cooperating witnesses. And the data that helped were fill ratios over months, compared with others.
How much of that does a heatmap show?
A heatmap shows where size sits, not what happens to it
A heatmap like Woo's shows the total size of orders at each price, over time. It does not show who placed the orders, whether they were filled or cancelled, or any comparison with other traders.
An example makes the difference visible. Whether a single 50 bitcoin order was cancelled at $86,000, or fifty 1 bitcoin orders of which ten traded and forty were pulled: in the aggregated book both look the same. They are completely different events.
Research works with more detailed data and still only arrives at probabilities. A study using Korea Exchange data in which every order was tied to an account (Lee, Eom and Park, 2013) found traders who deliberately placed orders with little chance of execution in order to fake an imbalance in the book. Only exchanges and regulators hold that kind of account data.
A study using public Coinbase data at the level of individual orders (Li, Polukarov and Ventre, 2023) found widespread spoofing in the LUNA book during its collapse in May 2022, and hardly any in the Bitcoin book. The authors explain this with liquidity: in a deep market like Bitcoin, spoof orders are expensive. The data, however, covers a window of a few hours per market, one hour in April 2022 for Bitcoin. Whether Bitcoin is cleaner or the method picks up less there cannot be decided from that.
A heatmap shows where size sits. It does not show whether that size would have traded.
So what could be measured instead?
The number the label would need
Three quantities can be calculated from public order book and trade data:
- Fill ratio: when the price reached a level with large visible size, what share of that size actually traded?
- Withdrawal on approach: how does the size shrink as the price comes closer?
- Replenishment: does the size come back after it has been consumed?
These numbers only mean something as a comparison, as in Coscia's case: across many levels, sell side against buy side, large orders against small. Even then, the result is a probability. A large order that disappears can be spoofing. It can also be a market maker adjusting risk, a fund aborting an execution, or an algorithm reacting to volatility.
Woo's picture contains none of these numbers. Above and below sits the same thing: resting size. Above it is called "fake", below it "organic", and both labels lead to the same conclusion, "Bullish". One measurement would back the claim: the share of the upper walls that traded when the price arrived, next to the same share for the bids below.
Anyone who calls a wall fake should be able to say how often such walls get filled.
The obvious objection
"If you watch the order book long enough, you can see when a wall disappears every time just before the price gets there."
That is the second measure, withdrawal on approach, and watching for it is a start. But seeing it once is not a ratio. After his conviction, Coscia argued that dozens and even hundreds of other traders had larger gaps between their fill ratios. In 2021 the court called that an "apples-to-oranges comparison". Without a comparison with what is normal, a disappearing wall remains an impression.
What to do with a labelled heatmap
One question works for any labelled chart: is the property the label claims in the data, or was it added?
For "fake" and "organic" it was added. The heatmap shows size per price over time. It does not show who placed the order, whether it will be filled, or what anyone was thinking.
Before you buy or sell on such a label, ask for the fill ratio. If there is none, you are trading on an opinion about the order book, not on the order book.
A label on a chart is a claim, not a measurement.
What remains open is how high the fill ratio of large walls in the Bitcoin book actually is, above and below the price. That is the number every "fake wall" would have to be measured against.
FAQ
Does US law apply to Bitcoin on Binance? The statute cited applies to markets under CFTC oversight, including regulated Bitcoin futures. Whether and how it applies to a spot market on an exchange outside the United States is a legal question this text does not answer. The legal information describes US law and is not legal advice.
What are Level 2 and Level 3? Level 2 adds up all orders at each price into a single total; most heatmaps are built on it. Level 3 carries every individual order with its identifier, timestamp, modification and cancellation. Coinbase publishes Level 3 data, but without accounts. Only exchanges and regulators can link orders to accounts.
Is a cancelled large order a sign of spoofing? Not on its own. Cancelling is the normal case, and large orders are withdrawn for many reasons. A sign only emerges from a pattern across many orders compared with other traders, and even that only worked in court together with a witness.
Not investment advice, not a recommendation, not a forecast — historical patterns are no guarantee.
Sources: Willy Woo, X, 28 Sep 2026 · 7 U.S.C. §6c(a)(5)(C), added by Dodd-Frank Act §747 (2010), effective 16 July 2011 · CFTC, Antidisruptive Practices Authority, 78 Fed. Reg. 31890 (28 May 2013) · SEC, Data Highlight 2013-01, Trade to Order Volume Ratios · United States v. Coscia, 866 F.3d 782 (7th Cir. 2017); cert. denied, No. 17-1099 (14 May 2018); 7th Cir. Nos. 19-2010/20-1032 (12 July 2021) · United States v. Sarao, Criminal Complaint (N.D. Ill., 11 Feb 2015), plea (9 Nov 2016); CFTC Release 7486-16 · DOJ, Bases/Pacilio (5 Aug 2021) · United States v. Smith et al., 7th Cir. No. 23-2840 (20 Aug 2025) · Lee, Eom & Park, Journal of Financial Markets 16(2), 2013 · Li, Polukarov & Ventre, arXiv:2308.08683 (2023)
Study the Past — Improve your Future 🥋