Illegal trading strategy that work!
A strategy worthy $2.5 million civil monetary penalty for only 51 trading days
Table of content:
Introduction.
What is this strategy about?
The speed of sneakiness, timing and probability.
Guideline of the process step-by-step.
Case study: Igor Oystacher
Introduction
Imagine you’re at a giant candy store where every kid is trading different candies—lollipops, gummy bears, chocolate bars, and more. In our candy market, some kids announce, “I’ll buy 100 lollipops for $1 each!” while others exclaim, “I’ll sell 50 lollipops for $2 each!” This bustling environment is similar to the real-life futures market, where traders buy and sell contracts based on commodities such as copper, crude oil, natural gas, and even financial indices.
Now, picture a mischievous kid named Igor. Igor shouts, “I’ll buy 1,000 lollipops for $1.50!” causing everyone to believe that prices will soon shoot up because of high demand. But—surprise!—Igor quickly cancels his order and instead sells his lollipops, leaving everyone in a sticky mess. This sneaky trick has puzzled markets for years and given rise to the phrase:
There is only one way: transcend the rules by rewriting the game itself, rather than playing within its confines.
In the futures market, this strategy isn’t about trading actual candy; it’s about creating an illusion—a deceptive tactic where a trader places orders with no intention of following through. The goal? To manipulate perceptions of supply and demand, leading others astray.
What is this strategy about?
It’s a bit like pretending to lift the heaviest candy jar to impress your friends—only to drop it before anyone can challenge you. In the trading world, a trader might place an order to make others think there’s significant buying or selling interest, then cancel it almost instantly. They use this moment of confusion to capitalize on the opposite side of the market, leaving their rivals bewildered.
What is this mysterious strategy really about? It’s like hiding something unexpected in plain sight—something that disrupts the natural flow of things, leaving participants questioning what’s real and what’s not.
Equation 1: The sneaky profit:
When a trader like Igor executes his plan, his profit might be modeled by a simple equation:
Here’s the idea: by tricking the market into thinking prices are rising or falling, Igor can buy at a lower price and sell at a higher one—or vice versa. It’s like buying candy at a discount because everyone got fooled by his loud shout!
Equation 2: The order book matrix:
The order book is a dynamic ledger that shows all the buy and sell orders in the market. We can represent a simple order book as a matrix:
When Igor enters a fake sell order (say, adding 100 contracts at $1.50), the matrix updates to:
This sudden jump in the sell orders at $1.50 creates a false impression that there is a huge selling pressure. In our candy store, it’s as if Igor suddenly lined up 100 extra lollipops at the checkout, making everyone believe that the lollipop supply has exploded!
By the way, there's an order engine in the appendix that will help make everything much clearer, along with a detailed 'manual' featuring a very special case."
This reminds me of a joke an elementary school teacher played on me: Why did the math book go to therapy? It had too many problems! ahahah fucking genius 🤣
With our equations in hand, it’s time to see how this trickery works in detail! Look at this:
Before Spoofing:
Price Buy Sell
0 1.0 10 5
1 1.5 20 15
After Spoofing:
Price Buy Sell
0 1.0 10 5
1 1.5 20 115 <-- Woah! Look at that extra mass of sell orders!What just happended!? This is called spoofing!!!
Before spoofing, the order book shows 5 sell orders at $1.00 and 15 at $1.50.
Igor’s spoof order adds 100 extra contracts at $1.50, updating the order book to show 115 sell orders at that price.
The red bars represent the number of sell orders at each price level. It clearly shows the jump in sell orders at $1.50 after Igor’s spoof order. Why this is important? Let’s examine how fast Igor cancels these orders using some fun probability!
The speed of sneakiness, timing and probability
A key ingredient in spoofing is speed. Spoofers like Igor cancel their orders almost as soon as they’re placed. To understand this, we can use probability theory and model the time until an order is canceled using the exponential distribution.
The cancellation probability
In probability theory, the time t until an event—like cancellation—occurs is often modeled by an exponential distribution:
Here, lambda is the cancellation rate. For instance, if λ=10—indicating very fast cancellations—then the probability that an order is canceled within t=0.1 seconds is:
This means there’s a 63% chance that an order will be canceled within just 0.1 seconds—but this is for Igor’s case, the latency is normally lower, we are talking about micros or nanos!
The histogram shows that most orders are canceled in less than 0.2 seconds and the scale 1/λ is the average lifetime of an order.
With this in mind let’s connect the dots with a real-world case study!
Guideline of the process step-by-step
Below is a step‐by‐step explanation of the spoofing process—with detailed order book snapshots just in case you want to develop an algorithm 😈
Step 1-The baseline order book:
Before any spoofing takes place, the market looks like this:
Price|Buy side|Sell side
104 9x6
103 7x4
102 6x2 ← Best ask
101 5x5 ← Best bid
100 7x2
99 10x6Here, the numbers—for example, “9x6” at price 104—represent the volume and number of orders on that side. At price 102, you can see 6 orders totaling 2 contracts on the sell side—this is the best ask.
Step 2-Inserting spoof (cancel-side) orders:
Now, suppose our spoofing trader decides to create a false impression of heavy sell pressure. He places 10 orders of 100 contracts each at price 102—even though he never intends for these orders to execute. These cancel-side orders dramatically alter the visible depth at 102:
Price|Buy side|Sell side
104 9x6
103 7x4
102 16x102 ← New spoof volume here
101 3x3 ← Adjusted best ask
100 7x2 ← Best bid
99 10x6In this snapshot, the “16x102” indicates that, after placing his spoof orders, the sell side at 102 now shows a total of 16 orders—or a volume that suggests 16 orders at 102—each supposedly for 100 contracts. The idea is to make the market believe that there is enormous selling interest at that level.
Step 3-Market reaction & aggressive flip orders:
Once these spoof orders hit the order book, many algorithmic trading systems (which “see” this apparent surge in sell orders) react automatically. They update their view of the best bid and best ask, and—in response—a few aggressive traders (or even the spoofer’s own flip strategy) enter the market. For instance, aggressive flip orders of 2 orders for 50 contracts each are now placed at price 102, which moves them into a more favorable (or “better”) position:
Price|Buy side|Sell side
104 9x6
103 7x4 ← Best ask now determined by incoming orders
102 2x50 ← Aggressive flip orders become the best bid
101 5x5
100 7x2
99 10x6Here the aggressive flip orders appear on the buy side at 102. They are intended to capitalize on the misleading signal created by the spoof orders.
Step 4-Partial cancellation for risk management:
Price | Buy side | Sell side
104 9x6
103 7x4 ← Best ask remains here
102 1x10 ← Residual flip order is now the best bid
101 5x5
100 7x2
99 10x6In this final snapshot, the spoof orders have been canceled before execution, and the aggressive flip orders have mostly been removed to avoid unwanted fills. What you end up with is a manipulated view of the market that misleads other participants—and if you’re watching closely, you see just a small residue of orders at price 102 that never were intended to be executed.
Case study: Igor Oystacher
In a notable legal case, the U.S. Commodity Futures Trading Commission charged Igor B. Oystacher and his company, 3 Red Trading LLC, with a sophisticated spoofing scheme. Over a period spanning from December 2011 to January 2014, these defendants placed thousands of spoof orders across multiple futures markets—copper, crude oil, natural gas, VIX, and E‑Mini S&P 500.
According to the complaint, spoofing is defined as placing orders with the intent to cancel them before execution. Here’s a simplified version of their tactics:
Placing spoof orders:
They would place large, visible orders at or near the best bid or offer price. For example, in the copper futures market, they might place orders that double the visible volume at a price level. This creates a false sense of market depth.Cancelling quickly:
Within milliseconds—sometimes less than 750 milliseconds—the spoof orders would be canceled, ensuring they never executed. This rapid cancellation avoids any risk of having to actually buy or sell the commodity.Flipping the trade:
Almost simultaneously, the defendants would place an aggressive flip order on the opposite side of the market, capturing favorable prices that the spoof orders had helped create.
Let’s add a little more math to this case study. Suppose the defendants placed spoof orders on multiple days. Let N be the total number of spoof orders placed over the relevant period. For example, according to the complaint, they placed approximately 5,207 spoof orders.
If we assume a simple model where the profit from each successful spoof is $10—a rough approximation for our model—then the total profit P can be approximated by:
In reality, the profits were far higher, but our model keeps things simple.
Now, consider the probability model from earlier. If each order is canceled within a time t with probability P(t) and most orders are canceled in less than one second, then the average cancellation time t is roughly 1/λ seconds. With λ=10, we get t≈0.1 seconds. This rapid cancellation is crucial: it ensures that spoof orders never execute while still fooling other traders.
Let’s illustrate with a simplified version of one of the examples from the case. On November 30, 2012, the defendants placed multiple spoof orders in the natural gas market. Before their orders, the visible order book might have looked like this:
At a price of $3.67, there were 35 contracts on the sell side.
After placing spoof orders, the sell volume jumped to 103 contracts.
Mathematically, we can express the percentage increase in the visible market depth as:
Plugging in our numbers:
This dramatic increase misled other market participants into believing there was overwhelming selling pressure, prompting them to adjust their trading strategies.
The very same mathematical tools that help spoofers like Igor profit can be turned against them. Market regulators and exchanges now use advanced algorithms and statistical models to detect abnormal order patterns that indicate spoofing.
One approach is to calculate a spoof score that measures the abnormality of order cancellations. We can define the spoof score Sscore as:
Similarly, machine learning models are trained on historical order data to recognize the fingerprint of spoofing. Features such as the ratio of order cancellations, order size, and time duration are fed into the model. If the model predicts spoofing with high confidence, then alerts are raised—but this is something really complicated to prove.
Here’s an example from the toy spoofing engine, built to grasp this concept. Go ahead—feel free to torture the code as you wish:
Order added: ID:8 [TraderD] BUY 282 contracts @ 98 [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order added: ID:9 [TraderA] BUY 535 contracts @ 94 [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order added: ID:10 [TraderB] SELL 448 contracts @ 107 [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order added: ID:11 [TraderD] BUY 739 contracts @ 96 [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order added: ID:12 [TraderD] SELL 953 contracts @ 103 [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order added: ID:13 [TraderA] SELL 136 contracts @ 98 [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order added: ID:14 [Spoofer] BUY 897 contracts @ 97 (SPOOF) [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order canceled: ID:14 [Spoofer] BUY 897 contracts @ 97 (SPOOF) [CANCELED]
***** SPOOF ALERT *****
Spoof order detected in real time!
Order ID : 14
Trader : Spoofer
Side : BUY
Price : 97
Contracts : 897
Time on book: 0.50 seconds
Current Quotes: Best Bid = 100, Best Ask = 95
************************
Order added: ID:15 [Spoofer] BUY 469 contracts @ 95 (SPOOF) [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order added: ID:16 [TraderD] SELL 566 contracts @ 99 [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order added: ID:17 [Spoofer] BUY 835 contracts @ 94 (SPOOF) [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order canceled: ID:17 [Spoofer] BUY 835 contracts @ 94 (SPOOF) [CANCELED]
***** SPOOF ALERT *****
Spoof order detected in real time!
Order ID : 17
Trader : Spoofer
Side : BUY
Price : 94
Contracts : 835
Time on book: 0.50 seconds
Current Quotes: Best Bid = 100, Best Ask = 95
************************
Order added: ID:18 [TraderA] SELL 221 contracts @ 99 [ACTIVE]
Current Quotes: Best Bid = 100, Best Ask = 95
Order added: ID:19 [TraderC] BUY 763 contracts @ 101 [ACTIVE]
Current Quotes: Best Bid = 101, Best Ask = 95
Order added: ID:20 [Spoofer] SELL 236 contracts @ 90 (SPOOF) [ACTIVE]
Current Quotes: Best Bid = 101, Best Ask = 90
Order added: ID:21 [TraderC] SELL 209 contracts @ 99 [ACTIVE]
Current Quotes: Best Bid = 101, Best Ask = 90
Order added: ID:22 [TraderB] SELL 857 contracts @ 94 [ACTIVE]
Current Quotes: Best Bid = 101, Best Ask = 90
Order added: ID:23 [TraderC] SELL 843 contracts @ 105 [ACTIVE]
Current Quotes: Best Bid = 101, Best Ask = 90So next time you see a seemingly mysterious spike in orders on your favorite trading platform—or even a sudden rush for lollipops—remember: there’s a hidden story written in equations, waiting to be uncovered.
Until we meet again—may your code run bug-free, your GPUs stay cool, and your predictions hit the mark every time!
P.S. What would you like me to talk about in future posts? Let me know which ones you prefer!
👍 Did you gain valuable insights and now want to empower others in the field?
Appendix
Court ruling: [or manual for trading that works]
Spoofing engine:
import time
import random
class Order:
def __init__(self, order_id, trader, side, price, quantity, spoof=False):
"""
side: 'buy' or 'sell'
spoof: Boolean flag to indicate if this order is intended as a spoof.
"""
self.order_id = order_id
self.trader = trader
self.side = side
self.price = price
self.quantity = quantity
self.spoof = spoof
self.timestamp = time.time() # Order placement time
self.canceled = False
self.cancel_timestamp = None
def cancel(self):
self.canceled = True
self.cancel_timestamp = time.time()
def __repr__(self):
flag = " (SPOOF)" if self.spoof else ""
status = "CANCELED" if self.canceled else "ACTIVE"
return (f"ID:{self.order_id} [{self.trader}] {self.side.upper()} "
f"{self.quantity} contracts @ {self.price}{flag} [{status}]")
class OrderBook:
def __init__(self):
# Use a dictionary to store orders keyed by order_id.
self.orders = {}
def add_order(self, order):
self.orders[order.order_id] = order
print(f"Order added: {order}")
def cancel_order(self, order_id):
order = self.orders.get(order_id)
if order and not order.canceled:
order.cancel()
print(f"Order canceled: {order}")
return order
return None
def get_active_orders(self):
return [order for order in self.orders.values() if not order.canceled]
def get_quotes(self):
# Determine best bid (highest price among active buy orders)
# and best ask (lowest price among active sell orders).
active_buy_orders = [
order for order in self.orders.values()
if order.side == 'buy' and not order.canceled
]
active_sell_orders = [
order for order in self.orders.values()
if order.side == 'sell' and not order.canceled
]
best_bid = max(active_buy_orders, key=lambda o: o.price).price if active_buy_orders else None
best_ask = min(active_sell_orders, key=lambda o: o.price).price if active_sell_orders else None
return best_bid, best_ask
def print_quotes(self):
best_bid, best_ask = self.get_quotes()
print(f"Current Quotes: Best Bid = {best_bid}, Best Ask = {best_ask}")
def print_order_book(self):
print("\n=== Full Order Book ===")
for order in sorted(self.orders.values(), key=lambda o: o.order_id):
print(order)
print("=======================\n")
def detect_spoofing(order_book, cancellation_threshold=1.0, quantity_threshold=500):
"""
Identify potential spoof orders based on:
- Large order size (quantity >= quantity_threshold)
- Quick cancellation (canceled within cancellation_threshold seconds)
"""
suspected_spoofs = []
for order in order_book.orders.values():
if order.spoof and order.canceled:
if order.cancel_timestamp and (order.cancel_timestamp - order.timestamp) < cancellation_threshold:
if order.quantity >= quantity_threshold:
suspected_spoofs.append(order)
return suspected_spoofs
def simulate_market():
order_book = OrderBook()
order_id_counter = 1
simulation_duration = 100 # seconds
start_time = time.time()
# Detection parameters:
cancellation_threshold = 1.0 # seconds
quantity_threshold = 500 # contracts
print("Starting market simulation...\n")
while time.time() - start_time < simulation_duration:
# Randomly decide if the next order is a spoof order or a normal order.
is_spoof = random.choice([True, False, False]) # Less chance for a spoof order.
side = random.choice(["buy", "sell"])
price = random.randint(90, 110)
quantity = random.randint(50, 1000)
trader = "Trader" + random.choice(["A", "B", "C", "D"])
# Spoof orders come from a designated spoofer.
if is_spoof:
trader = "Spoofer"
order = Order(order_id_counter, trader, side, price, quantity, spoof=is_spoof)
order_book.add_order(order)
order_book.print_quotes()
# If it's a spoof order and of large size, simulate a quick cancellation.
if is_spoof and quantity >= quantity_threshold:
# Wait briefly to simulate the order being on the book.
time.sleep(0.5)
canceled_order = order_book.cancel_order(order_id_counter)
if canceled_order:
time_diff = canceled_order.cancel_timestamp - canceled_order.timestamp
if time_diff < cancellation_threshold:
# Immediate spoof alert with detailed information.
print("\n***** SPOOF ALERT *****")
print("Spoof order detected in real time!")
print(f"Order ID : {canceled_order.order_id}")
print(f"Trader : {canceled_order.trader}")
print(f"Side : {canceled_order.side.upper()}")
print(f"Price : {canceled_order.price}")
print(f"Contracts : {canceled_order.quantity}")
print(f"Time on book: {time_diff:.2f} seconds")
order_book.print_quotes()
print("************************\n")
order_id_counter += 1
time.sleep(random.uniform(0.1, 0.5))
print("\nSimulation ended. Running final spoof detection...\n")
suspected_orders = detect_spoofing(order_book, cancellation_threshold, quantity_threshold)
if suspected_orders:
print("Potential spoof orders detected post-simulation:")
for order in suspected_orders:
time_diff = order.cancel_timestamp - order.timestamp if order.cancel_timestamp else None
print(f"Order ID {order.order_id} from {order.trader}: {order.side.upper()} "
f"{order.quantity} contracts @ {order.price}, canceled in {time_diff:.2f} seconds")
else:
print("No spoof orders detected in final analysis.")
order_book.print_order_book()
order_book.print_quotes()
if __name__ == "__main__":
simulate_market()