Strategy: Spoofing
A strategy worthy $2.5 million civil monetary penalty for only 51 trading days
Table of content:
Introduction.
What is this strategy about?
The speed of sneakiness, timing and probability.
Guideline of the process step-by-step.
Case study: Igor Oystacher
Before you begin, remember that you have an index with the newsletter content organized by clicking on “Read the newsletter index” in this image.
Introduction
Imagine you’re at a giant candy store where every kid is trading different candies—lollipops, gummy bears, chocolate bars, and more. In our candy market, some kids announce, “I’ll buy 100 lollipops for $1 each!” while others exclaim, “I’ll sell 50 lollipops for $2 each!” This bustling environment is similar to the real-life futures market, where traders buy and sell contracts based on commodities such as copper, crude oil, natural gas, and even financial indices.
Now, picture a mischievous kid named Igor. Igor shouts, “I’ll buy 1,000 lollipops for $1.50!” causing everyone to believe that prices will soon shoot up because of high demand. But—surprise!—Igor quickly cancels his order and instead sells his lollipops, leaving everyone in a sticky mess. This sneaky trick has puzzled markets for years and given rise to the phrase:
There is only one way: transcend the rules by rewriting the game itself, rather than playing within its confines.
In the futures market, this strategy isn’t about trading actual candy; it’s about creating an illusion—a deceptive tactic where a trader places orders with no intention of following through. The goal? To manipulate perceptions of supply and demand, leading others astray.
What is this strategy about?
It’s a bit like pretending to lift the heaviest candy jar to impress your friends—only to drop it before anyone can challenge you. In the trading world, a trader might place an order to make others think there’s significant buying or selling interest, then cancel it almost instantly. They use this moment of confusion to capitalize on the opposite side of the market, leaving their rivals bewildered.
What is this mysterious strategy really about? It’s like hiding something unexpected in plain sight—something that disrupts the natural flow of things, leaving participants questioning what’s real and what’s not.
Equation 1: The sneaky profit:
When a trader like Igor executes his plan, his profit might be modeled by a simple equation:
Here’s the idea: by tricking the market into thinking prices are rising or falling, Igor can buy at a lower price and sell at a higher one—or vice versa. It’s like buying candy at a discount because everyone got fooled by his loud shout!
Equation 2: The order book matrix:
The order book is a dynamic ledger that shows all the buy and sell orders in the market. We can represent a simple order book as a matrix:
When Igor enters a fake sell order (say, adding 100 contracts at $1.50), the matrix updates to:
This sudden jump in the sell orders at $1.50 creates a false impression that there is a huge selling pressure. In our candy store, it’s as if Igor suddenly lined up 100 extra lollipops at the checkout, making everyone believe that the lollipop supply has exploded!
By the way, there's an order engine in the appendix that will help make everything much clearer, along with a detailed 'manual' featuring a very special case."
This reminds me of a joke an elementary school teacher played on me: Why did the math book go to therapy? It had too many problems! ahahah fucking genius 🤣
With our equations in hand, it’s time to see how this trickery works in detail! Look at this:
Before Spoofing:
Price Buy Sell
0 1.0 10 5
1 1.5 20 15
After Spoofing:
Price Buy Sell
0 1.0 10 5
1 1.5 20 115 <-- Woah! Look at that extra mass of sell orders!What just happended!? This is called spoofing!!!
Before spoofing, the order book shows 5 sell orders at $1.00 and 15 at $1.50.
Igor’s spoof order adds 100 extra contracts at $1.50, updating the order book to show 115 sell orders at that price.
The red bars represent the number of sell orders at each price level. It clearly shows the jump in sell orders at $1.50 after Igor’s spoof order. Why this is important? Let’s examine how fast Igor cancels these orders using some fun probability!
The speed of sneakiness, timing and probability
A key ingredient in spoofing is speed. Spoofers like Igor cancel their orders almost as soon as they’re placed. To understand this, we can use probability theory and model the time until an order is canceled using the exponential distribution.
The cancellation probability
In probability theory, the time t until an event—like cancellation—occurs is often modeled by an exponential distribution:
Here, lambda is the cancellation rate. For instance, if λ=10—indicating very fast cancellations—then the probability that an order is canceled within t=0.1 seconds is:
This means there’s a 63% chance that an order will be canceled within just 0.1 seconds—but this is for Igor’s case, the latency is normally lower, we are talking about micros or nanos!
The histogram shows that most orders are canceled in less than 0.2 seconds and the scale 1/λ is the average lifetime of an order.
With this in mind let’s connect the dots with a real-world case study!
Guideline of the process step-by-step
Below is a step‐by‐step explanation of the spoofing process—with detailed order book snapshots just in case you want to develop an algorithm 😈
Step 1-The baseline order book:
Before any spoofing takes place, the market looks like this:
Price|Buy side|Sell side
104 9x6
103 7x4
102 6x2 ← Best ask
101 5x5 ← Best bid
100 7x2
99 10x6Here, the numbers—for example, “9x6” at price 104—represent the volume and number of orders on that side. At price 102, you can see 6 orders totaling 2 contracts on the sell side—this is the best ask.
Step 2-Inserting spoof (cancel-side) orders:
Now, suppose our spoofing trader decides to create a false impression of heavy sell pressure. He places 10 orders of 100 contracts each at price 102—even though he never intends for these orders to execute. These cancel-side orders dramatically alter the visible depth at 102:
Price|Buy side|Sell side
104 9x6
103 7x4
102 16x102 ← New spoof volume here
101 3x3 ← Adjusted best ask
100 7x2 ← Best bid
99 10x6In this snapshot, the “16x102” indicates that, after placing his spoof orders, the sell side at 102 now shows a total of 16 orders—or a volume that suggests 16 orders at 102—each supposedly for 100 contracts. The idea is to make the market believe that there is enormous selling interest at that level.
Step 3-Market reaction & aggressive flip orders:
Once these spoof orders hit the order book, many algorithmic trading systems (which “see” this apparent surge in sell orders) react automatically. They update their view of the best bid and best ask, and—in response—a few aggressive traders (or even the spoofer’s own flip strategy) enter the market. For instance, aggressive flip orders of 2 orders for 50 contracts each are now placed at price 102, which moves them into a more favorable (or “better”) position:
Price|Buy side|Sell side
104 9x6
103 7x4 ← Best ask now determined by incoming orders
102 2x50 ← Aggressive flip orders become the best bid
101 5x5
100 7x2
99 10x6Here the aggressive flip orders appear on the buy side at 102. They are intended to capitalize on the misleading signal created by the spoof orders.
Step 4-Partial cancellation for risk management:
Price | Buy side | Sell side
104 9x6
103 7x4 ← Best ask remains here
102 1x10 ← Residual flip order is now the best bid
101 5x5
100 7x2
99 10x6In this final snapshot, the spoof orders have been canceled before execution, and the aggressive flip orders have mostly been removed to avoid unwanted fills. What you end up with is a manipulated view of the market that misleads other participants—and if you’re watching closely, you see just a small residue of orders at price 102 that never were intended to be executed.
Case study: Igor Oystacher
In a notable legal case, the U.S. Commodity Futures Trading Commission charged Igor B. Oystacher and his company, 3 Red Trading LLC, with a sophisticated spoofing scheme. Over a period spanning from December 2011 to January 2014, these defendants placed thousands of spoof orders across multiple futures markets—copper, crude oil, natural gas, VIX, and E‑Mini S&P 500.
According to the complaint, spoofing is defined as placing orders with the intent to cancel them before execution. Here’s a simplified version of their tactics:
Placing spoof orders:
They would place large, visible orders at or near the best bid or offer price. For example, in the copper futures market, they might place orders that double the visible volume at a price level. This creates a false sense of market depth.Cancelling quickly:
Within milliseconds—sometimes less than 750 milliseconds—the spoof orders would be canceled, ensuring they never executed. This rapid cancellation avoids any risk of having to actually buy or sell the commodity.Flipping the trade:
Almost simultaneously, the defendants would place an aggressive flip order on the opposite side of the market, capturing favorable prices that the spoof orders had helped create.
Let’s add a little more math to this case study. Suppose the defendants placed spoof orders on multiple days. Let N be the total number of spoof orders placed over the relevant period. For example, according to the complaint, they placed approximately 5,207 spoof orders.
If we assume a simple model where the profit from each successful spoof is $10—a rough approximation for our model—then the total profit P can be approximated by:
In reality, the profits were far higher, but our model keeps things simple.
Now, consider the probability model from earlier. If each order is canceled within a time t with probability P(t) and most orders are canceled in less than one second, then the average cancellation time t is roughly 1/λ seconds. With λ=10, we get t≈0.1 seconds. This rapid cancellation is crucial: it ensures that spoof orders never execute while still fooling other traders.
Let’s illustrate with a simplified version of one of the examples from the case. On November 30, 2012, the defendants placed multiple spoof orders in the natural gas market. Before their orders, the visible order book might have looked like this: