Navigation
Not every wall that "absorbs" sell pressure is real. In thin liquidity, a spoofed order book can produce a pattern that looks exactly like institutional accumulation — until it isn't there anymore. Here's how to tell the two apart.
Spoofing is placing large limit orders on the book — usually well past the current price — with no intention of ever letting them fill. The order exists purely to be seen: it signals fake support or resistance, nudges other participants (and algorithms reading order book depth) into trading a certain direction, and gets pulled or reduced right before price would actually reach it.
It's illegal in regulated equities and futures markets and heavily policed there, but crypto's fragmented, largely unregulated spot and perp markets — especially on lower-volume pairs — see it constantly. The tell isn't that a wall exists. It's that a wall exists without executed volume behind it.
A genuine CVD divergence happens when real aggressive sell orders hit the market, price refuses to drop, and cumulative volume delta fails to make a new low — because a passive buyer is actually absorbing that flow with executed trades. That's a real signal: size is trading, and someone's willing to keep buying it.
A spoofed setup can look identical on a plain price chart. Price approaches a level, stalls, and bounces — but underneath, there's no absorption happening at all. The "support" was a resting limit order big enough to scare off market sellers or bait algorithmic buyers, and it gets cancelled the moment it's no longer useful. No executed volume, no real CVD divergence — just a price reaction to a wall that was never meant to fill.
Real: CVD divergence is backed by matched trades at the level. Spoof: resting size on the book with little to no executed volume behind it.
Real: the level holds and absorbs flow repeatedly. Spoof: size shrinks or vanishes the moment price gets close enough to test it.
Real: the order is proportionate to normal book depth for that pair. Spoof: the wall is unusually large relative to typical resting size — cheap to paint in thin books.
Real: absorption tends to recur at a level across multiple tests. Spoof: the "level" moves each time, chasing wherever price currently is.
In a deep, liquid book, spoofing is expensive: to look convincing you need real size, and real size costs money to post and carries fill risk if you're slow to cancel. In a thin book — low-cap alts, off-peak hours, lower-volume perp pairs — a relatively small order can look like a wall simply because there's so little competing depth around it. That's exactly why the same-looking "divergence" means something different depending on liquidity conditions: treat any apparent absorption on a thin pair with more skepticism than the identical pattern on BTC or ETH majors.
Because a spoofed wall isn't backed by executed trades, weighting CVD against matched volume — rather than reading price action or order book depth in isolation — is what keeps a divergence read honest. AEON's absorption alerts require CVD to actually stall or reverse alongside real trade flow, not just a large resting order appearing on the book. A wall with no matching executed volume behind it won't trigger a PASSIVE BUY ABSORPTION DETECTED alert on its own.
The monitor also tracks live bid-ask spread dynamics: a sudden widening with no corresponding volume is flagged separately as an anomaly, since it often marks liquidity pulling back right as a spoofed order gets pulled.
This sits alongside the broader CVD divergence and regime detection AEON runs — spoofing awareness is a filter on top of that read, not a separate tool.
No filter catches every spoof. Sophisticated spoofing can involve partial fills or layered orders designed to look like genuine flow. Treat any single absorption read as one input, size positions accordingly, and use it alongside your own risk management — not as a standalone signal to trade on.