Order Flow 5 / 7
Order Flow · Level 2Lesson 5 of 6

Whales, walls and fake liquidity: what big orders really tell you

Big orders catch the eye: a huge print on the tape, a wall in the book. Some of them matter; most are gone before price gets there. Here is how they behaved in a real recording of the BTC book.

You will learn
  • What counts as a whale trade, and what it does and does not tell you
  • How walls behave when price reaches them, on a real recording
  • What iceberg orders and spoofing are — and why the book cannot show intent

Before you start: The lessons on the order book and on the tape.

Whales on the tape

A whale trade is one far bigger than a market's usual trade. The terminal marks a BTC trade as a whale when it is worth $25,000 or more and at least 20 times the average of recent trades. In the minute from the tape lesson, the largest single row was a taker sell of 51.6 BTC — about $4.4 million — at 86,034.00.

Two things to keep in mind. One large order can be split into many small ones: in the same burst there were 9 sells of exactly 0.64344 BTC within a few milliseconds, which looks like one trader slicing an order. And the tape shows that someone traded big in a hurry, never why — a big sell can be a hedge, a position being closed, or one side of an arbitrage.

Walls in the book

A wall is an unusually large resting order — or a cluster of them — at one price, much bigger than the levels around it and visible to everyone. To see how walls really behave, we recorded the Binance BTC/USDT book live for 75 minutes on 27 October 2026: every second, each price level within 0.6% of the price holding 2 BTC or more, and every trade.

Walls — the recorded BTC/USDT order book of 27 October 2026, 15:11–15:24 UTC: the price line and every wall (5 BTC or more waiting at one price for 20 seconds or longer) as a bar. At 80,600.00, a round number, about 7 BTC waited to be sold for the first ten minutes while price traded between 80,288 and 80,568. At 15:21:33 price reached it; buyers traded into it and the level grew to 10.2 BTC as more sell orders joined. In 8 seconds 7.4 BTC was bought there and at least 3.4 BTC was cancelled; by 15:21:42 the level was gone and price traded at 80,652 within 15 seconds — then fell back to 80,544 within a minute.

Most big orders do not wait

Over the 75 minutes, a price level holding 10 BTC or more — about $800,000 — appeared at the best bid or ask 229 times. 200 of those were gone within 10 seconds, 190 of them with less than a tenth of their size traded. Only one stayed for a full minute.

That is normal. Market makers and other traders quote large sizes near the price and move or cancel them as prices change, many times a minute. A big order near the price tells you what someone is offering this second — not what they will still offer when price arrives.

Icebergs: more than the book shows

An iceberg order shows only part of its size; when the visible part fills, the next part appears at the same price. Binance spot supports them. You spot one on the tape and the book together: more trades at a price than the book ever showed there, while the level keeps coming back.

The recording has one clear case. At 16:12:12 a bid at 80,483.66 became the best bid with 3.3 BTC. At 16:12:18 sellers hit it for 2.8 BTC — and at the end of that same second it showed 3.6 BTC, more than before. At 16:12:22 another 3.4 BTC traded there, and 3.1 BTC still showed. In 13 seconds, 7.1 BTC traded into a level that never showed more than 3.6 BTC. That is what an iceberg looks like — although other buyers joining the queue at the same price would look the same, and the book cannot tell the two apart.

Spoofing: about intent

Spoofing is placing orders you intend to cancel before they fill, to make others believe there is more supply or demand than there is. In US futures markets it is illegal under the Commodity Exchange Act; crypto exchanges are regulated differently from country to country.

From the outside you see behaviour, never intent. An order that vanishes as price comes near may be a spoof — or simply a quote being moved, which happens all the time: 190 large levels vanished within seconds in the 75 minutes above. Calling every pulled order "spoofing" is a guess dressed up as a fact.

BTC/USDT order book, 27 October 2026, 19:08 UTC: the largest level within 1% of the price was 26.3 BTC of asks at 81,250.00, 0.65% above the price; the largest bids were 12.5 BTC at 79,932.33 and at 80,113.22.

Check yourself · 1 of 3The terminal marks a 30 BTC market buy as a whale. What do you know for sure?
Show the answer

The tape records what happened: a large market buy. It may open a position, close a short, or hedge a trade elsewhere. Size tells you urgency, not intention.

Check yourself · 2 of 3A 10 BTC ask waits at 80,600 and price rises to it. What can happen?
Show the answer

All three happen all the time. On 27 October the 80,600 ask was partly filled (7.4 BTC) and partly cancelled (at least 3.4 BTC), and price went through it in 8 seconds.

Check yourself · 3 of 3A large bid vanishes as price falls toward it. Is that spoofing?
Show the answer

Spoofing is defined by the intent to cancel before execution, which the book cannot show. In our recording 190 large levels vanished within seconds with little traded — ordinary market making, as far as anyone can see.

Takeaways
  1. A whale trade shows that someone traded big in a hurry — not why, and one order can be split into many.
  2. A wall is a price where size waits now. It can be eaten, pulled or moved; you see which only when price gets there.
  3. Most large orders near the price are gone within seconds: 200 of 229 in our 75-minute recording.
  4. Icebergs and spoofing exist, but the book shows behaviour, never intent.

Open BTC in the terminal — whale trades are the dots above and below its candles

Further reading

Education only, not financial advice · Updated 27 Oct 2026 · Data: Binance · Report a mistake