Pro Iceberg Order Detection — CME Order Flow Guide
Iceberg orders hide the majority of the order in the DOM. Pro guide: iceberg anatomy, refill pattern, cluster detection, spoof distinction, and confirmation checklist. Order flow setups.
Erwin
Founder cofiatrading
When a fund needs to buy 5,000 contracts on the NQ without revealing its urgency, it doesn't drop a 5,000-contract order in the DOM. That would be a red flag visible to all predatory HFTs, who would immediately front-run the price against them.
It uses an iceberg order. A tiny fraction (the tip) is visible — say 50 contracts. The rest, hidden, automatically reloads after each execution. The market always sees 50 contracts. The total 5,000-contract order remains invisible until fully executed.
Detecting these icebergs in real-time = identifying the levels where institutions are truly accumulating. It's a major edge that most retail traders ignore.
This article breaks down iceberg mechanics, detection patterns, and the confirmation checklist I use to validate every iceberg setup.
Free Volume Profile Cheatsheet PDF →
Anatomy of an Iceberg Order: What Lies Beneath the Surface
An iceberg, as the name suggests, shows 5–10% of its true size above the waterline (the DOM). The rest is hidden and reveals itself progressively.
Anatomie d'un iceberg order
Un iceberg cache la majeure partie de la commande. Visible : 50 ctr. Réelle : 5 000 ctr découpés en lots.
Bid affiché : 50 contrats sur 18 510. Ordre "normal".
Total réel : 5 000 ctr. Affiché par tranches de 50.
Schéma — pourquoi iceberg ? Pour ne pas révéler la taille à des HFT prédateurs.
In the example above, the market sees a 50-contract bid at 18,510. To a normal trader, it's just another order. The reality: 5,000 contracts in total, with 4,950 hidden. Every time the 50 visible contracts are executed (hit by aggressive sellers), a new 50-contract slice automatically appears.
Why use an iceberg:
- Discretion: Don't reveal the total size to predatory HFTs.
- No price impact: A massive visible order would scare off sellers. An iceberg attracts them (they think they're facing a retail trader).
- Progressive execution: Give the market time to absorb without triggering a violent move.
For a retail trader learning to detect them, an iceberg is a pure signal: a serious player respects this level, and there are plenty of contracts to absorb. You can position alongside them.
The Refill Pattern: The Iceberg's Unique Signature
The signature that distinguishes an iceberg from any other order type is the automatic refill. After each execution, the visible quantity returns to its starting value. This consistency is unseen with individual retail orders.
Pattern de refill iceberg — visible reste constant, exec accumule
Signature unique : la quantité visible reste à 50 même après chaque hit. Le refill automatique trahit l'iceberg.
Détection : 5 refills consécutifs avec quantité identique = iceberg quasi-certain.
Cumul exécuté : 250 ctr. Reste probable : 1 000–4 000 ctr cachés. Niveau à respecter.
Schéma — un retail individuel ne refill jamais aussi vite. C'est un algo institutionnel.
On the timeline above, observe:
- Visible stays constant at 50 contracts at every tick.
- Cumulative exec builds in 50-contract increments (50, 100, 150, 200, 250...).
- Interval: Near-instantaneous refill, < 100 ms after each hit.
No human trader does this. It's mechanically impossible to re-place an identical order in 100 ms after every execution. It has to be an institutional algo.
Practical detection on ATAS:
- Watch the same price level in Time & Sales for 30–60 seconds.
- Count the hits: 5 hits or more with identical quantities = near-certain iceberg.
- Check the DOM: If the visible quantity never decrements despite executions = refill confirmed.
Iceberg Cluster Detection: Multi-Level Analysis
Beyond a single iceberg, institutions often place multiple icebergs across consecutive levels to build an accumulation zone. This is even more powerful than a standalone iceberg.
Détection cluster iceberg — analyse par niveau
On compte les trades + max single-trade par niveau. Beaucoup de trades + max constant = signature iceberg.
Cluster détecté : 18 510–18 512 (3 niveaux iceberg consécutifs).
C'est une zone d'accumulation institutionnelle. Niveau probable de support fort.
Schéma — beaucoup de trades + max ≈ constant = iceberg. Beaucoup de trades + max très variable = retail mix.
The analysis is done across two dimensions per level:
- Number of trades: How many transactions execute at that price.
- Max single trade: The largest single transaction observed.
An iceberg level is signaled by: lots of trades + a constant max. Transactions are frequent, but none exceed a certain ceiling (the tip size). This is exactly the signature of an automatic refill.
In the example, levels 18,510, 18,511, and 18,512 show this pattern (62, 45, and 28 trades respectively, max ~50 each). Three consecutive iceberg levels = institutional accumulation zone.
Trade plan:
- Long on a retest of the accumulation zone, ideally at the lowest level (18,510).
- Stop below the bottom of the zone (18,508–18,509).
- Target = return to the POC or session VAH.
- Typical R/R: 1.5 to 3:1.
Iceberg vs Spoof: Don't Confuse the Two
Icebergs and spoofs share one trait: they hide true intent. But their nature is radically different — one is honest (real liquidity), the other is manipulation.
Iceberg vs Spoof — distinction critique
Les deux cachent l'intention réelle. Mais l'iceberg est honnête (vraie liquidité), le spoof est de la manipulation.
Trade l'iceberg
Long sur support iceberg. Stop sous le niveau.
Évite le spoof
Ne suis pas la direction du faux ordre.
Schéma — règle simple : si l'ordre absorbe (exec ≥ 60% visible), c'est de l'iceberg.
The 6 distinguishing criteria:
| Criterion | Iceberg | Spoof |
|---|---|---|
| DOM Visibility | Small (50 ctr) | Huge (1,800 ctr) |
| Execution Rate | 100% | 0–20% |
| Automatic Refill | Yes, after each hit | No, disappears abruptly |
| Lifespan | Minutes to hours | 1–10 seconds |
| Legality | ✓ Legal | ✗ Illegal (manip) |
| Intent | Accumulate discreetly | Deceive the market |
Practical rule: If the order absorbs (exec/visible ratio ≥ 60%), it's an iceberg. If the order disappears before majority execution (ratio < 30%), it's a spoof.
Strategy by type:
- Iceberg detected → Trade with it, go long on iceberg support (or short on resistance).
- Spoof detected → NEVER follow the direction of the fake order. It's a trap.
The Iceberg Confirmation Checklist
I use a 6-criteria scoring system to validate an iceberg's quality before trading it. No validated criteria = no edge. Many validated criteria = A+ setup.
Confirmation iceberg — checklist score
5/6 critères validés = score 90%. Tu peux trader avec confiance le niveau identifié.
≥ 70 = setup A · 50–69 = setup B · < 50 = pas d'edge, skip.
Schéma — la rigueur du scoring sépare le trader pro du retail intuitif.
The 6 criteria with their weights:
- Automatic refill observed (30 pts) — The primary criterion. Without a refill, it's not an iceberg.
- 5+ trades at the same price (20 pts) — Enough executions to confirm the structure.
- Max single trade ≈ constant (15 pts) — The tip size is consistent.
- VAL/HVN confluence (15 pts) — The iceberg must align with the volume profile.
- High speed of tape (10 pts) — The market is actively trading the level.
- Volume cluster vs neighbors ≥ 2× (10 pts) — The iceberg level is abnormally active vs. its surroundings.
Score interpretation:
- ≥ 70 points = A setup. Trade with full size.
- 50–69 points = B setup. Half size or skip.
- < 50 points = No edge. Systematic skip.
The advantage of scoring: it forces you to be rigorous. No intuition, no "I feel like it's an iceberg." Either the criteria are validated, or they're not. Binary discipline is what separates the pro from the intuitive retail trader.
How to Configure ATAS for Iceberg Detection
A few specific ATAS tools to make detection easier:
- Volume By Time: Lets you visualize cumulative volume per price level. Iceberg levels appear as abnormal spikes.
- Cluster filter: Filter cells with volume ≥ 100 contracts. Icebergs create dense cells.
- Time & Sales filter: Filter by "same price + same quantity" to spot repetition patterns.
- DOM Recorder: Essential to reconstruct DOM history and confirm the refill.
To get started with ATAS and test these settings:
Footprint & volume profile
How We Integrate Icebergs at cofiatrading
Manual iceberg detection is slow and cognitively expensive. So we have agents continuously parsing:
- Time & Sales to identify repetition patterns (same price + same qty + < 200 ms intervals).
- DOM Recorder to confirm the refill in real-time.
- Volume profile to validate confluence with VAL, VAH, HVN.
When an iceberg is detected with a score ≥ 70, the signal goes up in the VIP channel with:
- Exact iceberg level.
- Estimated total absorbed size.
- Nearest VP confluence.
- Trade plan (entry, stop, target, R/R).
Key Takeaways
- Iceberg order = An order where only a fraction (tip) is visible in the DOM. Automatic refill after execution.
- Refill pattern = Unique signature. Visible stays constant, exec accumulates. No human trader does this.
- Iceberg cluster = 3+ consecutive levels with an iceberg pattern = institutional accumulation zone.
- Iceberg vs Spoof = Real orders vs. manipulation. Exec/visible ratio ≥ 60% = iceberg, < 30% = spoof.
- 6-criteria checklist = Score ≥ 70 = A setup, 50–69 = B setup, < 50 = skip.
- Trade plan = Long on iceberg level retest (or short on resistance). Stop below (above) the zone.
Going Further
- Pro Tape Reading and Time & Sales, the foundation for detecting iceberg patterns on the tape.
- Pro DOM Depth of Market Guide, using the DOM to confirm refills.
- Liquidity Pools and Stop Hunts, understanding the other side of institutional play.
- Order Flow Confluence A+ Setup, integrating icebergs into a multi-layered setup.
- See the 8 Proprietary Strategies or Join the VIP Club to receive confirmed iceberg signals.
Disclaimer: cofiatrading publishes educational and analytical content. Nothing written here constitutes investment advice as defined by the Spain/EU CNMV/ESMA canon. Trading leveraged instruments carries a risk of capital loss. Retail loss rate on CFDs in Europe: 74-89% depending on the broker. Past performance does not guarantee future results.