Crypto Order Book Heatmap: Liquidity and Spoofing
Lesson 5 of 9 · Advanced
The order book: resting vs executed liquidity
The order book is the list of limit orders that have not yet been executed: buys (bids) below price and sells (asks) above it. These orders are resting liquidity: a declared intention that can be cancelled at any moment. By contrast, executed liquidity is trades that actually happened, recorded in volume, delta and footprint.
This simple distinction is the most important point of the whole lesson: trades are settled history, resting orders are only promises. A 500 BTC wall in the order book is not a trade until it is filled, and it can vanish in a fraction of a second.
Exchange data comes at two common levels of detail:
- Level 2 data (L2): the total size of orders at each price level. Most exchanges publish this.
- Order-level data (L3 or MBO): individual orders with identifiers. Some exchanges, such as Coinbase, have an order-by-order channel, and CME offers MBO data. With this data you can see whether a level is made of one large order or dozens of small ones.
What does a liquidity heatmap show?
A liquidity heatmap draws the history of the order book over time: the horizontal axis is time, the vertical axis is price, and colour intensity is the size of resting orders at each level. Bookmap-style tools overlay executed trades as bubbles on the same picture. As a result you can see:
- where and for how long large orders sat;
- when price reached them, whether they were filled (a trade occurred and price paused) or pulled (cancelled before price arrived);
- whether a level refills after being consumed; a pattern that can indicate an iceberg order or a slicing execution algorithm.
The strength of the heatmap lies in this combination: it puts intention (resting orders) next to action (trades). A wall that was filled and held price is a completely different story from a wall that faded just before price arrived.
Icebergs and hidden orders
Not all liquidity is visible in the book. An iceberg order displays only a small part of its total size and replaces each slice with the next after it fills. At CME, an order with a limited display quantity is a feature of the exchange itself, and with MBO data its behaviour can be followed fairly accurately; this is the same work we do in gold order flow. Some crypto exchanges also offer iceberg or hidden orders, and many large traders use slicing execution algorithms.
In the Level 2 data that most crypto exchanges publish, an iceberg can only be inferred: executed volume at a level repeatedly exceeds the displayed size and the level keeps refilling. Because the data is aggregated and many market makers quote at the same level, this inference is less reliable in crypto than at CME. Treat it as a hint, not a definitive discovery.
Spoofing and pulled walls
Spoofing means placing large orders with no intention of executing them, to create a false impression of supply or demand, and cancelling them before they fill. The layered form (layering) uses several orders at several levels. In regulated US futures markets such as CME, spoofing is prohibited by law and prosecuted. On many crypto exchanges oversight is weaker and fake walls are more common.
Signs visible on a heatmap:
- A big wall retreats as price approaches and reappears at a more distant level.
- A large order disappears the moment price arrives and almost no volume is recorded at that level.
- A wall exists on one exchange but has no equivalent on others.
Caution: not every cancelled order is spoofing. Market makers legitimately and constantly update their quotes as risk changes. Spoofing is a legal accusation that requires proof of intent; all we can say is "this level proved unreliable".
Multi-venue books and the difference from a liquidation heatmap
Because Bitcoin trades on many exchanges, one exchange's wall is only part of the market's total liquidity. If price is being discovered on another exchange, your wall may never be tested; arbitrageurs move price through other venues. Some tools aggregate books from several exchanges, which completes the picture but also brings latency and clock differences between feeds.
Set aside one common conceptual mix-up: a liquidity heatmap is different from a liquidation heatmap.
| Liquidity heatmap | Liquidation heatmap |
| Real orders resting in an exchange's book | A modelled estimate of liquidation prices |
| Built from order book data | Built from OI and assumptions about leverage |
| Can be cancelled, but really exists | Not exchange liquidation engine data; hedged positions may be counted twice |
Presenting the liquidation heatmap as a "price magnet" is a common mistake in educational content; that map is an estimate, not a forecast.
Common mistakes
- Treating an order book wall as firm support or resistance, when it can be cancelled at any moment.
- Confusing a liquidity heatmap (real orders) with a liquidation heatmap (a model's estimate).
- Labelling every cancelled order "spoofing" without allowing for normal market maker behaviour.
- Reading a small exchange's book and ignoring that price may be discovered on another venue.
- Focusing on resting orders and neglecting the executed trades that actually occurred at that level.
What do volume and data say here?
The value of a heatmap becomes clear when you test it against real trades:
- Orders plus trades: when price reaches a wall, check the footprint or trade bubbles to see what volume executed at that level. Heavy volume with a pause in price means the order was real.
- Delta at the level: heavy negative delta on a buy wall that does not break is an absorption pattern; low delta with the wall disappearing is a pulled-wall pattern.
- Comparing exchanges: if a wall exists on only one exchange, give it less weight.
No heatmap shows the future; it shows only today's declared intention, which may change tomorrow.
📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map
Frequently asked questions
What is a liquidity heatmap?
A chart that shows resting limit orders in the order book over time and at each price level, using colour intensity. It helps you see where large orders were and whether they were filled or cancelled when price arrived.
Are big order book walls reliable?
Not by themselves. A resting order can be cancelled, and fake walls are common in crypto. A wall gains credibility only when real trades are recorded at that level.
Is spoofing illegal in crypto?
It is prohibited in regulated US futures markets such as CME. The legal position and the level of oversight on crypto exchanges vary by country and exchange, and enforcement is usually weaker.
Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.