MSTR Cat

Crypto Law/Level VI · Market conduct/6.1 Manipulation/Lesson 3

Spoofing and layering

Orders placed to be cancelled: the US anti-spoofing statute, the cases that defined it, how far it reaches into crypto, and how the EU’s MiCA covers order-book abuse.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Zero-cost rule: place only orders you are willing to have filled. 7 U.S.C. §6c(a)(5)(C) defines spoofing as bidding or offering with intent to cancel before execution; cancelling itself is lawful, but intent is proved from cancellation ratios and timing.
  2. Bot builders: record the business reason for each cancel rule and keep cancellation ratios explainable; Coscia traded only 0.5% of his large orders on one exchange, and that pattern convicted him. Catch: logs are discoverable, so the design itself must be honest.
  3. On spot venues that are not CFTC-registered entities, §6c(a)(5) does not apply by its terms, but wire fraud and general manipulation law still do. No cheaper lawful regime exists there; the same rule holds: no orders placed to mislead.
  4. On EU crypto trading platforms, MiCA Article 91(3)(b) covers placing, modifying or cancelling orders that send false signals, and Article 92 obliges professional arrangers to detect abuse. Genuine liquidity provision needs no filing, but expect the platform to query unusual patterns.

Materials7 U.S.C. §6c(a)(5), the Commodity Exchange Act’s ‘disruptive practices’ provision, on law.cornell.eduUnited States v. Coscia, No. 16-3017 (7th Cir., decided 7 August 2017)Article 91(3)(b) of Regulation (EU) 2023/1114 (MiCA)An exchange order book view with depth shown at several price levels

Wonder

  1. Traders cancel orders all the time, so when does cancelling become a crime?
  2. Does the US spoofing ban apply to crypto exchanges?
  3. How can anyone prove what a trader intended when the order was placed?

Explore

  1. An order book shows resting bids to buy and offers to sell. Spoofing exploits it: a trader places a large order they never mean to fill, so others see false demand or supply and move their prices, then the trader fills a real order on the other side and cancels the large one. The Justice Department, in a June 2026 release, called it placing a non-bona fide order with intent to cancel it before execution, to give the false appearance of supply or demand. Layering is a common variant: several large orders stacked at successive price levels to make the false pressure look deeper.
  2. The 2010 Dodd-Frank Act added a specific ban to the Commodity Exchange Act. 7 U.S.C. §6c(a)(5)(C) makes it unlawful to engage in trading ‘commonly known to the trade as, “spoofing” (bidding or offering with the intent to cancel the bid or offer before execution)’. The provision applies to trading on or subject to the rules of a registered entity, such as a CFTC-registered futures exchange. So it reaches bitcoin and ether futures on such exchanges, but not, by its own terms, spot trading on an unregistered platform; there, the general fraud and manipulation provisions and wire fraud are the available tools (lesson 6.1.1).
  3. The first federal criminal prosecution under the new provision was against Michael Coscia, a high-frequency trader. A Chicago jury convicted him on 3 November 2015 of six counts of commodities fraud and six of spoofing, in a $1.4 million scheme run through algorithms on CME Group and ICE Futures Europe; he was sentenced to three years in prison. On 7 August 2017 the Seventh Circuit affirmed, holding that the anti-spoofing provision gives clear notice and is not unconstitutionally vague. Trial evidence showed each cycle took about two-thirds of a second and was repeated tens of thousands of times, with over 450,000 large orders.
  4. Other cases show the scale. Navinder Sarao, a British futures trader, pleaded guilty on 9 November 2016 to wire fraud and spoofing, including conduct connected with the 6 May 2010 ‘Flash Crash’, when the Dow fell 600 points in five minutes. On 29 September 2020 JPMorgan entered a deferred prosecution agreement and agreed to pay over $920 million after traders placed tens of thousands of orders in precious metals and Treasury futures with the intent to cancel them before execution. Spoofing in securities is charged as securities fraud: in June 2026 a California trader pleaded guilty over more than 3,000 instances of spoofing in thinly traded securities and agreed to forfeit over $1.3 million.
  5. In the EU the rule is written with trading platforms for crypto-assets in mind. MiCA Article 91(3)(b) treats as market manipulation placing orders on a crypto trading platform, ‘including any cancellation or modification thereof’, that disrupt the platform, make genuine orders harder to identify, or create a false or misleading signal about supply, demand or price, for example by entering orders to start or exaggerate a trend. Article 92 requires anyone professionally arranging or executing crypto-asset transactions to have arrangements to prevent and detect market abuse. These rules have applied since 30 December 2024 (lesson 3.3.1).
  6. Intent is the dividing line, and it is proved from patterns. In Coscia, evidence showed his large orders were designed to avoid being filled and to be cancelled after milliseconds or when his small orders filled; on one exchange he traded on only 0.5% of his large orders. For builders writing trading bots, logs, cancellation ratios and the timing of fills against opposite-side orders are exactly what investigators read. A practical check when watching a thin token’s order book: note large orders that appear near the best price, then vanish as soon as a trade executes on the opposite side, again and again.

Key facts

  • 7 U.S.C. §6c(a)(5)(C) defines spoofing as bidding or offering with the intent to cancel the bid or offer before execution.
  • The US anti-spoofing provision was added to the Commodity Exchange Act by the 2010 Dodd-Frank Act and applies to trading on or subject to the rules of a registered entity.
  • Michael Coscia was convicted on 3 November 2015 in the first federal prosecution under the anti-spoofing provision and was sentenced to three years in prison.
  • On 7 August 2017 the Seventh Circuit affirmed Coscia’s conviction and held that the anti-spoofing provision is not unconstitutionally vague.
  • JPMorgan agreed on 29 September 2020 to pay over $920 million to resolve criminal charges over unlawful trading in precious metals and Treasury markets.
  • MiCA Article 91(3)(b) treats placing, modifying or cancelling orders on a crypto-asset trading platform to create a false or misleading signal as market manipulation.

Exercise nine, six, three, one

9CollectList up to 9 order-book behaviours you have seen or can imagine on a crypto exchange, such as large orders that vanish, orders stacked at several prices, or rapid cancellations after a fill.
6ClusterSort them into 6 categories: order size, order placement, timing of cancellation, link to trades on the other side, frequency of repetition, and ordinary liquidity provision.
3DistillReduce the 6 categories to 3 groups: behaviour consistent with honest market-making, behaviour suggesting orders not meant to be filled, and behaviour you cannot judge without the trader’s records.
1CrystallizeWrite 1 sentence explaining, in your own words, why cancelling an order is lawful but placing it in order to cancel it may not be.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS