Are iceberg orders legal?

Yes. They are a standard exchange-supported order type, distinct from spoofing in the one way that matters: an iceberg is a genuine order that intends to trade, while a spoof is entered with the intention of cancelling it.

How do you detect an iceberg order?

By comparing displayed size with executed volume at the same price. A level that keeps showing a small quantity while absorbing many multiples of it is refreshing. It is the ratio that reveals it, not any indicator.

Do icebergs exist in crypto?

Yes, and hidden liquidity is often a larger share of the book than on regulated futures venues. Detection is harder because data quality and aggressor tagging vary widely from one exchange to another.

Glossary

Iceberg order

Also called: iceberg · hidden order · reserve order

An iceberg order is a limit order that displays only a fraction of its true size and replenishes the visible portion after each fill. It lets a large participant work size without advertising it. It is legal, ordinary, and the mechanism behind most visible absorption.

Why they exist

Showing a very large resting order is expensive. It invites others to trade ahead of it and it moves the price away before the order is filled. Displaying a small slice at a time solves that, at the cost of losing queue priority on each replenishment on most exchanges.

There is nothing devious about this. It is a standard order type offered by the exchange, used constantly, and quite different from spoofing — an iceberg is a real order that genuinely intends to trade.

How to detect one

By the ratio between displayed and executed size. A price level shows sixty lots, absorbs several hundred, and still shows sixty. Nothing about the display changed; the execution record tells the whole story.

This is the practical case for watching the executed columns rather than the displayed ones. Full order-by-order data makes icebergs directly inferable; aggregated depth only lets you infer them from the refresh pattern.

A worked example

On a synthetic ES book snapshot, one bid level displays 60 lots and has executed 1 480 — around twenty-five times its advertised size — while continuing to show sixty.

Two levels above, a conspicuous 840-lot offer sits with zero executed against it. The small order is doing all the work; the large one is doing none. That contrast is the whole lesson of reading a ladder.

The trap

Assuming an iceberg means a reversal is coming. It means someone is filling size at that price. Their motive is unknown — it could be a hedge against something you cannot see, an execution algorithm working a parent order, or a genuine directional bet.

The second trap is inventing them. Any level that absorbs more than expected gets called an iceberg after the fact. Without order-level data you are inferring, and the honest position on an ambiguous case is size unconfirmed, I am not counting on it.

Frequently asked

Are iceberg orders legal?: Yes. They are a standard exchange-supported order type, distinct from spoofing in the one way that matters: an iceberg is a genuine order that intends to trade, while a spoof is entered with the intention of cancelling it.
How do you detect an iceberg order?: By comparing displayed size with executed volume at the same price. A level that keeps showing a small quantity while absorbing many multiples of it is refreshing. It is the ratio that reveals it, not any indicator.
Do icebergs exist in crypto?: Yes, and hidden liquidity is often a larger share of the book than on regulated futures venues. Detection is harder because data quality and aggressor tagging vary widely from one exchange to another.