Liquidity walls: what rests and what gets pulled

A dense order is a limit order, or several orders at one price, noticeably larger than a normal level in this book. When such a dense order is especially large and rests for a long time, it is called a wall. The key word is “normal”: a wall's size is always relative. A $500K order in the bitcoin book is an ordinary level; in the book of a small coin it is a mountain the price may not get past for half a day.

That is why EVA does not use one amount for everything. A dense order for us is an order that is both above a sensible dollar minimum and many times larger than a normal level of the same book. We do not disclose the exact thresholds, but the idea is simple: a wall is what stands out against its neighbours here and now. A multiple is the convenient way to compare. If a normal level in the book is 1.2 BTC and 18 BTC rests at one price, that is 15 times the normal level; if 2 BTC rests there, it is just a slightly thicker level.

The book in which EVA looks for dense orders is combined: up to four venues (Binance, Bybit, OKX, Hyperliquid), and the same price on different exchanges adds up into one level. So a wall in EVA may be the sum of orders from two or three exchanges resting at one price. That is more honest for the question “what stands in the price's way”, but remember: each venue can pull its part on its own.

Why a wall affects the price at all is clear from a calculation. Illustrative example. The sell side of the book has: 60,010 — 1 BTC, 60,020 — 1.5 BTC, 60,030 — 25 BTC (the wall), 60,040 — 1 BTC. A normal level here is 1–1.5 BTC; the wall is about twenty times larger.

A 20 BTC market buy arrives. It takes 1 BTC at 60,010, 1.5 BTC at 60,020 and the remaining 17.5 BTC from the wall at 60,030. It spends 60,010 + 90,030 + 1,050,525 = 1,200,565 dollars; the average fill price is 1,200,565 / 20 = 60,028.25. The price did not get above 60,030: 7.5 BTC are left in the wall.

To take the whole wall, one has to buy 1 + 1.5 + 25 = 27.5 BTC — about 1.65 million dollars (60,010 + 90,030 + 1,500,750 = 1,650,790). Without the wall, reaching 60,030 would have cost about 150 thousand. The wall turns “get past the level” from a small job into one about eleven times more expensive — for as long as it rests there.

Where to see it in EVA. On the “Book · Flow” tab the chart has the “Dense orders” layer: buy orders are tiffany, sell orders terracotta. The “▾” menu sets the view: “At the edge” is a short bar at the right edge showing where the order rests now; “Life bands” is a band from the order's appearance to the present, showing how long it has held and whether it survived the price passing. In the right panel the “Dense orders” block lists up to sixteen of the largest orders: side, price, dollar amount and age. In the “Order book” block itself a level noticeably larger than its neighbours carries the 🧱 mark.

Age is the main number in that list. An order that has rested for three hours and survived a touch of the price, and an order placed a minute ago, are different things even if the amount is the same. An important detail: the age is never older than the last time the price passed through that level. If the price was at the level 10 minutes ago, the count restarted — otherwise “resting 40 minutes” would be untrue: trades have gone through the level during those 40 minutes, and nobody knows whether it is the same order.

We do not know who places walls, and the book does not say. It may be a market maker keeping the price in a narrow range; a large holder selling in pieces without hitting the market; someone defending their entry level; and finally a bait that will be removed before the price gets there. From outside all four look the same.

A wall has three fates. It can hold: the price comes, trades hit it, and it does not run out — it is topped up or is simply larger than anyone is willing to buy (sell). It can be filled: market orders ate it to the end, and the price went on. And it can be pulled: the order was removed without waiting for the price.

EVA tells the last two apart by the distance to the price at the moment the wall vanished. Vanished right at the price — we count it as filled; vanished away from it — pulled. This is a rule, not an observation of a specific trade: an order can also be removed in the last fraction of a second before the touch, and such a wall will be counted as filled. Only noticeable dense orders that rested long enough are counted — small flicker in the book does not become an event.

The result shows in the “Walls · events” block: 🧹 — dense order pulled, ⚡ — filled, both with the amount, price and how many minutes the order rested. On the chart the “Dense orders” layer has the “Pulled ones we managed to see” item, which draws them dashed. The same block has two more event kinds (a large surplus of buying or selling with no price move, and a false breakout) — they are covered in sections 7–8.

Between “holds” and “filled” there is an important middle. A wall can melt: it gets hit, shrinks from 25 BTC to 15, then to 8 — and suddenly is 25 again. That means someone is topping the order up as it fills. Several times more can go through such a level than was ever visible in the book at any one moment. So a wall's size in the book is a lower bound on what is on offer at that price, not an exact figure.

The opposite picture is common too: a wall rests for an hour, the price slowly moves towards it, and a couple of percent before the touch the wall disappears. A pulled wall defended nothing: the whole time it rested, not one trade went through it. It showed an intention that was then changed.

Spoofing is placing large orders with no intention of filling them: to give others the impression of strong demand or supply and to remove the order before the price reaches it. The classic scheme: put a big buy wall below the price, wait for others to start buying “in front of the wall”, sell to them at a higher price — and pull the wall. On regulated markets this is prohibited: in the US, spoofing on futures markets is explicitly banned by the 2010 Dodd–Frank Act. On crypto exchanges oversight is weaker and differs from venue to venue.

But spoofing cannot be proven from the book. A pulled wall is spoofing, and a person who changed their mind, and a market maker who re-placed orders after a move, and a bot that pulls everything when volatility rises. The difference is in the intention, and the book has no intentions. That is why EVA does not put a “spoofing” label on anything: it says “pulled” and shows how long the order rested. The conclusion “that was a trick” is your hypothesis, not a fact from the screen.

A single wall is one point of the book. To see the book as a whole, EVA has three bands under the chart: “Book imbalance 0–1%”, “1–3%” and “3–5%”. Each is the sum of buy orders minus the sum of sell orders in dollars (price × order size) within its ring around the price: closer than 1%, from 1 to 3%, from 3 to 5%. The book is the same combined one, up to four venues.

A bar pointing up, tiffany, is a buy surplus: within this ring more buy orders rest below the price than sell orders above it. A bar pointing down, terracotta, is a sell surplus. The height is the surplus itself in dollars, not a share of the book. A gap instead of a bar means “we cannot see there”: the depth the exchanges sent did not reach this ring. That is not the same as a flat zero.

Illustrative example. In the 0–1% ring there are buy orders for $4.2M and sell orders for $3.1M: the 0–1% band shows +1.1M. In the 1–3% ring — buys of $6.0M and sells of $9.5M: the 1–3% band shows −3.5M. Right at the price buyers dominate, a little further out sellers do, and it is the same book in the same minute.

Hence the first reading rule: “the book leans to buyers” without naming the ring is an empty phrase. The near band answers “what is right at the price”, the far ones “how far the price is allowed to go”. And the second rule: the surplus is a difference, not a size. A +1.1M band happens both in a thin book (2.1 vs 1.0) and in a thick one (40.6 vs 39.5) — for the price these are very different books.

Why the near band is so jumpy. Right at the price market makers work: they place and pull orders hundreds of times a minute, moving quotes after the price. Their orders are not an opinion on the market, they are a job. Besides, the near ring “travels” with the price: the price moves 0.5% — and half the orders that were in the 0–1% ring are now in the 1–3% ring or already filled. The far ring does not twitch like that, and the same spike in 3–5% is usually more informative than in 0–1%.

One last thing about the bands: a book is easy to paint and easy to erase. A buy surplus of several million can vanish in a second — sometimes it is created precisely to nudge others. So an imbalance band is useful paired with executions: do the orders hold when trades arrive into them (that is the topic of section 5).

The order book is a “now” snapshot. To tell a wall that is being held from one that will be removed you need history: on a snapshot both look the same. The order-book heatmap shows it: time horizontally, price vertically, brightness — how many dollars rest in limit orders at that level. Buys are cooler (tiffany, below the price), sells warmer (terracotta, above it), the line is the price itself. EVA has it twice: the “Heatmap” layer on the chart and the “Order-book heatmap” block in the right panel; under the block is a depth-history strip, sells on top, buys below.

Read the map horizontally. A long bright band at one price means the order rested all that time rather than flashing once. A band that ends while the price is still far away is a pulled wall. A band that ends the moment the price reaches it is a filled one (or pulled at the last moment: the map alone cannot tell, you need the trades). A band that moves after the price in steps is an order being re-placed behind the market.

Via the “?” button the block speaks in numbers: the largest wall, its price, amount, side and how many minutes it has rested. Dense orders show “now”, the heatmap shows “how it was”.

The map has a resolution, and it must be kept in mind. In time it is built from book snapshots taken every few minutes: an order placed and pulled between two snapshots is invisible to it. In price, levels are grouped into buckets a fraction of a percent wide: the map cannot see fine structure inside a bucket. And in reach it shows only a few percent around the price — anything further is not on the map.

Another limitation is the sources. The map combines books from several venues, but not always all of them: Hyperliquid, for example, does not list every coin, and the tooltip says how many books went into the snapshot. The strips under the map and the “book balance” in the “?” window are computed over different rings around the price — they cannot be compared directly.