Capture
Raw L2/L3 book events and trades from our HFT servers, exchange and local timestamps. Snapshots lie, event streams do not.
a marketmaker.cc project
Every manipulator is a bot. Every bot is code. Code leaves a fingerprint. We store them all.
When a manipulator arrives, volume jumps and one actor owns most of the tape. A bot cannot hide its rhythm.
01 / decompose
Raw trades on a thin pair look like noise. Scroll: we pull the flow apart by size, timing and side until each actor sits in its own lane.
02 / pipeline
Raw L2/L3 book events and trades from our HFT servers, exchange and local timestamps. Snapshots lie, event streams do not.
Change-point on volume marks "the bot arrived". Cluster trades by size, inter-arrival, side and aggressor flag. One tight dominant cluster is the suspect.
Heartbeat spectrum, lot-size grid, price offset from mid, add-to-cancel latency. Plus where it likes to live: exchanges, pairs, hours.
One script per manipulator: a trigger on tape or book, an action for the Rust bot, hard risk limits. Often a one-line rule. Sometimes a pattern from the DB.
# wash trading trigger if vol_1m > k * median_24h and abs(ret_1m) < eps: flag("wash", pair, venue)
03 / catalog
Each shelf is a family of behaviors. Each entry inside is a concrete bot with its own fingerprint and its own counter-script.
Volume far above median, price goes nowhere. Buy and sell at the same price, equal size, alternating.
key: volume ≫ median ∧ |Δp| ≈ 0Symmetric quotes around mid, fixed refresh period, skew follows inventory. A metronome with a wallet.
key: refresh period T, offset dBig wall appears, price approaches, wall vanishes. Short add-to-cancel life, near-zero fill ratio.
key: wall cancels on approachQuiet pair, sudden one-sided aggression, then a distribution tail into the crowd that arrives late.
key: one-sided flow + low floatBursts of orders and cancels far above need. Not to trade: to slow others and hide intent.
key: msgs/s ≫ fills/sA burst of aggressive orders to trigger stops and trend followers, then reverse into their flow.
key: burst, then mirror fade04 / live rule
Synthetic pair. A washer starts mid-session. Drag the thresholds and watch the flag fire.
05 / infrastructure
Cheap features and trigger rules in the hot path: volume ratio, efficiency, heartbeat detector.
Heavy clustering, matching against the DB, backtests with purged CV. Pushes new scripts down to the servers.
We observe and trade against bots. We never spoof, wash or manipulate. Hard risk limits and a kill switch per script.
06 / research
Open gap: no paper found that detects CEX wash trading directly from order-book events. That is the niche.