# Stop hunts: you never see the stops, here is what the order book shows instead - Source: https://orderflowfutures.com/en/blog/stop-hunt-liquidity-sweep-order-flow - Site: OrderFlowFutures (https://orderflowfutures.com) - Author: Tom, Trader & founder of OrderFlowFutures (https://orderflowfutures.com/a-propos#auteur) - Published: 2026-09-21 - Updated: 2026-09-24 - Reuse: free to quote and cite, with attribution to OrderFlowFutures and a link to the source URL. > A stop order is not in the book: the exchange holds it and it becomes an aggressor when it fires. So no tool can see stops, and nobody needs to. What order-by-order data really shows during a stop hunt, why stops always sit in the same places, and the three questions that separate a stop run from a Morning session on the NQ. The session low has held for forty minutes, sitting two ticks above a round number. At 10:47 price goes through it. Seven ticks below in under half a second, 1,800 contracts sold at market in the burst, a one-minute candle with a wick that seems to come out of nowhere. Sixty seconds later price is back above the low, and it will not see it again all day. Two readings do the rounds for this scene, and they are equally wrong. The first says "manipulation": the big players knew where the stops were and went to get them. The second says "failed breakout": the sellers tried and failed. The truth is simpler, more mechanical, and far more useful for trading. **A stop order is not in the order book. The exchange's matching engine holds it, and it only exists for the market at the moment it triggers, when it becomes an aggressive order like any other. So no tool can see stops, and nobody needs to: they cluster in the same places for everyone, and that has been measured. What the book does show is what surrounds them before and what they turn into after: a burst of forced aggression, on one side only, into a book that is empty beyond the level. The difference between a stop run and a genuine breakout is not read in the burst. It is read in what follows it.** --- ## 1. A stop is not an order in the book Let us start with the fact almost everyone ignores, even though the exchange spells it out in its own documentation. On CME Globex, a stop order, once accepted, does not go into the book. [CME's official education course](https://www.cmegroup.com/education/courses/things-to-know-before-trading-cme-futures/futures-order-types) says it in one sentence: it must be triggered by a trade in the market at the price level submitted. Until that price actually trades, the stop is a pending instruction inside the matching engine. It has no queue, no priority, no visible size. For the other participants it does not exist. CME does not even offer a plain stop "at market". The two forms available are the stop-limit, which enters the book as a limit order at the stated price once triggered, and the stop with protection, which enters as a market order capped by a protection range, so it cannot fill at absurd prices. At Eurex, the [list of order types](https://www.eurex.com/ex-en/trade/order-book-trading/order-types) is of the same kind: stop market and stop limit on futures, described as the automatic issuing of a market or limit order when a given price is reached. Same logic: a stop is a future order, not a present one. The consequence is brutal for a whole strand of retail discourse. Order-by-order data, the [MBO](/deepcharts) feed that powers a [heatmap](/lexique/heatmap) or a [DOM](/lexique/dom), rebuilds the book from resting limit orders. Stops are not in it, because they are nowhere a market data feed could see them. A "stop detector" does not detect stops. It detects their consequences. That is not a weakness of the tool, it is the nature of the object, and knowing it changes what you ask of your screen. What the book does show is two things. Before: the resting liquidity that lines the level, and above all the absence of liquidity beyond it. After: what the stops have become. --- ## 2. A triggered stop becomes an aggressor That is the second half of the mechanism, and it is just as well documented. When price touches the level, the engine triggers the stop and sends it into the book as an order that goes looking for its counterparty. [CME's technical wiki](https://cmegroupclientsite.atlassian.net/wiki/spaces/EPICSANDBOX/pages/457414497/Order+Functionalities) puts it without ambiguity: once triggered, a stop order is treated as an aggressor limit order, and the fill notices reflect that behaviour. A sell stop becomes a sale hitting the bid. A buy stop becomes a purchase lifting the offer. On a [footprint](/lexique/footprint) built from the order-by-order feed, it therefore prints exactly like any other aggression: volume attributed to the aggressor side, as declared by the exchange. Nothing, tick for tick, separates a contract sold at market by decision from a contract sold at market because a stop fired. The engine makes no distinction, and neither does the footprint. What separates the two is the shape of the burst. Chosen aggression has a human or algorithmic rhythm: it spreads out, it tests, it resumes. Forced aggression arrives as a block, because every stop resting at the same spot triggers on the same trade, in a cascade: the first executed stop prints the next price, which triggers the stops resting one tick lower, and so on. Three signatures follow, all of them readable: 1. **One-sided.** Over the burst window, nearly all the volume carries the same aggressor side. No fight, no back and forth: a queue leaving the room. 2. **In a few hundred milliseconds.** The triggering is mechanical, the speed is the engine's, not a trader's. That is why detectors work with a window measured in milliseconds, which we come back to below. 3. **Into a void.** Beyond an obvious low, hardly anyone has a resting buy limit: buyers wait at the level, not below it. The book is thin, and each contract sold moves price a tick or more. A lot of result for the effort committed, exactly the "little effort, big result" case from the article on [effort and result](/blog/effort-vs-result-order-flow), described there as a warning of fragility. Here the fragility has a precise cause: the effort was not decided, it was borrowed from the stops. ![Stops leave as one block, then nobody sells: 1,800 contracts sold at market in 400 ms into the void below the level, and no chosen selling afterwards.](/uploads/blog/sr-01-rafale-forcee-en.png) *Three seconds around the break: a one-sided burst into a book that is empty down to the resting band, then no more selling. The feed shows the burst and what follows it, never the stops.* That last idea deserves a pause, because it contains the whole read that follows. **A stop burst is borrowed effort.** Nobody wanted it at that instant, and nobody will renew it. When the last stop in the zone has been executed, the selling pressure stops dead, not because the sellers changed their minds, but because there were none. The question that decides everything is therefore not "how many contracts came out", it is "what happens once they have finished coming out". --- ## 3. Why stops sit where everyone puts them The usual objection remains: if nobody can see the stops, how would the "big players" know where to go and get them? They do not know. They do not need to, because the location of stops is not a secret, it is a statistic. And that statistic has been measured on real orders, only once publicly as far as I know, by Carol Osler in [Stop-loss orders and price cascades in currency markets](https://www.newyorkfed.org/medialibrary/media/research/staff_reports/sr150.pdf), a piece first circulated as a Federal Reserve Bank of New York staff report, then published in 2005 in the *Journal of International Money and Finance*. Her dataset: 9,655 conditional orders received by a major FX dealing desk between August 1999 and April 2000, with an aggregate face value above 55 billion dollars, across three major pairs. Three results, all of them transferable: - **Almost 10% of all those orders are placed at a rate ending in 00.** The round number attracts, for no market reason at all. - **Stop-loss sell orders cluster just below round numbers and stop-loss buy orders just above them**, while take-profit orders sit exactly on the round number. The asymmetry is the key point: the obvious level is protected by exits, and overrun by stops. - **Crossing a round number extends the move**, and the response to stop-loss orders is larger and longer-lasting than the response to take-profits: the effect stays measurable for about two hours after the crossing. That is the cascade. These are FX data, and they are a quarter of a century old. Nobody has published the equivalent on futures, because nobody but the exchange and the brokers sees the stops. But the mechanism has no reason to have changed, and it does not depend on the instrument: stops are placed where the logic of the chart says to place them, which is to say in the same places for everyone. Below the day's low, above yesterday's high, either side of the round number, outside the opening range. And that is where the "hunt" takes on its real meaning. A participant who has to buy size is looking for a counterparty. The natural counterparty of a large buyer is a forced seller. Where do you find forced sellers in quantity? Below the obvious low, where the sell stops are about to turn into market sells, which is to say into [liquidity](/lexique/liquidity) taken. Price is not pushed there to "hurt retail", it is pushed there because that is where the liquidity the buyer needs is going to appear. A stop hunt is not a conspiracy, it is a search for a counterparty, and once you have understood that you stop resenting the market and start reading it, which is the whole programme of the [order flow guide](/order-flow). --- ## 4. Stop run or genuine breakout: three questions, not an impression A genuine breakout and a stop hunt start exactly the same way. Same level, same burst, same wick for the first second. Any method that claims to tell a [stop run](/lexique/stoprun) from a breakout at the instant of the crossing is wrong half the time, which is the definition of a method that does not exist. The difference is read at three moments, with three questions, each of which has an observable answer. **Before: was the aggression that brought price to the level chosen?** A serious breakout arrives with selling flow that settles in: the [delta](/lexique/delta) deteriorates over several minutes, bounce attempts get sold, the level is attacked several times before it gives. A typical stop run arrives instead on a market drifting towards the level with no conviction, sometimes nudged by a wall that is displayed and then pulled. If the only frank aggression in the whole sequence is the burst itself, the effort is borrowed, not decided. **During: what was waiting beyond?** That is the question only a [liquidity heatmap](/blog/how-to-read-liquidity-heatmap) answers, and it answers it before the event. If there was almost nothing resting below the level, the burst slides into a void and price travels far on little volume: the excursion is spectacular and proves nothing. If instead there was size resting a few ticks lower, the burst is going to hit it, and how that size reacts decides what comes next. If it takes the hit and reloads, that is [absorption](/lexique/absorption), often fed by hidden size of the kind described in the article on [iceberg orders](/blog/how-to-detect-iceberg-orders): the sweep has just found its buyer, and it is a stop run. If it is consumed without reloading, the path is open. **After: what happens when the burst stops?** That is the decisive question, and it is the one everyone skips because it requires waiting. The stops are out, the borrowed effort is spent. Only two outcomes. Either chosen aggression takes over, fresh market sells arrive at a human rhythm, price accepts below the level and the book rebuilds underneath: that is a breakout, and the burst was only its first floor. Or nothing sells any more, delta flips the other way over the following seconds, and price climbs back into the range: that was a stop run, and the buyer who collected the liquidity is now in position. ![The same break read twice: the burst is identical, what follows is not.](/uploads/blog/sr-02-stop-run-vs-cassure-en.png) *Left, no more selling after the burst and price returns inside the range. Right, chosen sells take over and the resting band is consumed. During the first second the two cannot be told apart.* The table to keep next to the screen: | What you are looking at | Stop run | Genuine breakout | |---|---|---| | Aggression before the level | drift with no conviction, flat delta | repeated attacks, deteriorating delta | | Resting liquidity beyond | thin, or large and absorbing | consumed, with no reload | | The burst itself | identical in both cases | identical in both cases | | The seconds after the burst | no more aggression, delta flips | chosen aggression takes over | | Price one minute later | back inside the range | accepted beyond, book rebuilt underneath | The middle row is the most important one in the table. It says that the moment everyone acts is precisely the only moment when the information does not exist yet. From that follows a rule with an invalidation condition, which means a rule you can count. **A stop run is traded on price's return inside the level, never on the wick, with a stop on the far side of the excursion.** If chosen aggression resumes and price accepts beyond, the read was wrong, you get out, and the cost was known in advance. If you do not feel like waiting for that return, you do not have a read, you have a bet on a wick. --- ## 5. When the exchange itself halts the cascade There is institutional proof that none of the above is a trader's theory: the exchange built a mechanism specifically against stop cascades, and it described it to the US Congress. CME calls it the Stop Logic Functionality. Its principle, in the words of [Terrence Duffy's testimony before Congress](https://www.cmegroup.com/media-room/speeches-and-comment-letters/2007-2016/Duffy052010Testimony051910.pdf) as executive chairman of CME Group in May 2010: if elected stop orders would result in execution prices beyond pre-defined thresholds, the market automatically enters a brief reserved state, between 5 and 10 seconds, during which no orders are matched but limit orders can be entered, modified and cancelled. For the E-mini S&P, the parameters quoted at the time were 6 index points and 5 seconds. On 6 May 2010, the day of the flash crash, that mechanism fired at 1:45:28 pm Chicago time, when a stop cascade took the ES from 1062 to 1056. Five seconds of pause. The market came out of the reserved state at 1056.75 and, in the testimony's words, rallied sharply afterwards. CME concluded the functionality had done its job: giving participants the opportunity to provide liquidity, and letting the market regain its equilibrium. ![On 6 May 2010, CME's Stop Logic paused the E-mini S&P for five seconds after a cascade from 1062 to 1056.](/uploads/blog/sr-03-stop-logic-2010-en.png) *Timeline from CME's testimony: stop cascade down to 1:45:28 pm, five-second reserved state, reopen at 1056.75 and rally. Price path schematic between those points.* Read that sequence with the grid from the previous section. A burst of forced aggression, into a book that had gone empty, until something interrupts it. Then, as soon as the mechanical pressure stops, the absence of chosen sellers and the return of price. The biggest stop run in the history of index futures has exactly the structure of the one on your NQ at 10:47, with the exchange playing the passive buyer who takes the end of the burst. CME has since complemented the mechanism with [Velocity Logic](https://cmegroupclientsite.atlassian.net/wiki/spaces/EPICSANDBOX/pages/457218368/Velocity+Logic), which reacts to the number of ticks travelled within a given time, whatever the cause. The thresholds may have moved since 2010; the logic has not. Above all, remember this: a gap of a few seconds in the tape, on a vertical move, is not a feed glitch. It is the exchange telling you a stop cascade was under way. --- ## 6. What DeepCharts does with it The ecosystem handles the three moments separately, which is consistent with the method. For the "during" moment, the dedicated tool is [DeepDom's Stop Run](/deepcharts/stop-run-detection). According to the vendor's documentation, it marks on the chart the instant when a large number of stop orders have been triggered, as text, a diamond or a square, with the number of contracts involved and one colour per side. Its four settings are exactly the signatures from section 2: *Minimum Tick*, the number of ticks price must move as a result of the triggers for the event to count; *Max MS*, how fast the stops must trigger to form a single event; *Min. Stop Run Vol*, the minimum volume; and *Maximum Ord Num*, the maximum number of orders examined during the burst. In other words, the tool counts a fast, one-sided burst of aggression that moves price. It does not see the stops, it sees what they become, and that is what you should ask of it. For the "before" moment, the [heatmap](/deepcharts/heatmap-liquidite) shows what is waiting beyond the level, and [Deep Wall](/deepcharts/deep-wall) isolates the resting sizes that matter. For the "after" moment, the [Iceberg Detector](/deepcharts/iceberg-detector) tells you whether the burst found a hidden buyer, [Deep Delta](/deepcharts/deep-delta) shows the balance flipping over the following seconds, and [Deep V-Tracker](/deepcharts/deep-v-tracker) explicitly marks the exhaustion points where aggressors empty their orders, which is the very definition of the end of a stop burst. Two things to know before you click. Stop Run is a module of DeepDom, DeepCharts' MBO order book, which is sold on its own with its own licence: you do not need the full platform to read sweeps. And there is no native macOS version: on a Mac it runs inside Parallels Desktop, which is the setup our community uses. Current prices are on [the pricing page](/deepcharts-code-promo), checked against the vendor's site and dated. **[Activate DeepDom →](/go/deepcharts?p=deepdom&from=blog-stop-run)**: our partner link applies the best discount currently running at DeepCharts, automatically, with no code to enter. --- ## 7. The concrete case, back from the introduction Let us take the NQ at 10:47 through the three questions. **Before.** Over the preceding twenty minutes, price walks down to the low in small candles, cumulative delta is flat, no selling burst ahead of the level. A 400-contract sell limit appears three ticks above the low at 10:44 and vanishes at 10:46 without being hit. The aggression that brings price to the level is not chosen. First box ticked for the stop run. **During.** The heatmap was showing, below the low, four nearly empty levels and then a band of 600 resting contracts, seven ticks lower, sitting there since the open. The burst goes: 1,800 contracts sold at market in 400 milliseconds, all bid-aggressor, and price runs exactly to that band. There, the resting size takes the hit. It is hit for 350 contracts, drops to 250 displayed, climbs back to 600. Reload at the same price. The burst has found its buyer. **After.** Over the next ten seconds, almost no market selling. One-minute delta goes from minus 1,800 to minus 900: market buys are arriving, at a human rhythm, from the participants who collected the liquidity and are now completing their position. Price crosses back above the low at 10:48. The level was not broken, it was used. **The rule.** Buy entry on price's return above the low, stop two ticks below the bottom of the wick, explicit invalidation: if chosen selling resumes and price accepts below the level again, the read was wrong. Reward to risk is good because the stop is short, and the stop is short because the excursion has already happened. That is the only reason you trade the return and never the wick. In that scene, no tool saw a stop. We saw an empty book, a forced burst, a passive buyer reloading, and the absence of a relay. That is all there is to see, and it is enough. --- ## Frequently asked questions **Can you see stop orders in the order book?** No. On CME Globex as on Eurex, a stop order is held by the exchange's matching engine and only enters the book once triggered by a trade at the stop price. Order-by-order data (MBO) rebuilds resting limit orders, never stops. A stop-run detection tool therefore does not see stops, it sees their consequences: a fast, one-sided burst of aggression that moves price. **What happens to a stop order once it is triggered?** It becomes an aggressor. CME specifies that once triggered, a stop order is treated as an aggressor limit order, and its fill notices reflect that. A sell stop hits the bid like any other market sell; on a footprint, nothing separates it from a decided sale. The difference is read in the shape of the burst: one-sided, within a few hundred milliseconds, into a book that is empty beyond the level. **Why do stop orders cluster around round numbers?** Because everyone places them in the same logical spots. The only published study on real orders, Carol Osler's on 9,655 orders from an FX dealing desk between 1999 and 2000, finds that almost 10% of conditional orders are placed at a rate ending in 00, that stop-loss sells cluster just below round numbers and stop-loss buys just above them, and that crossing a round number extends the move for about two hours. **Is a liquidity sweep the same thing as a stop run?** It is the same phenomenon under two vocabularies. "Liquidity sweep" or "liquidity grab" describes the path of price: an excursion beyond an obvious level followed by a return. "Stop run" names the mechanism: the stops resting beyond the level trigger and become market orders. In order flow, what gets measured is the mechanism: a burst of forced, one-sided aggression into a thin book, then the absence of a relay. **What does CME do when stops cascade?** It pauses the market. CME Globex's Stop Logic Functionality places the instrument in a reserved state of 5 to 10 seconds if elected stops would produce executions beyond pre-defined thresholds; during the pause no orders are matched, but limit orders can be entered, modified and cancelled. On 6 May 2010 the mechanism fired at 1:45:28 pm on the E-mini S&P, after a cascade from 1062 to 1056, for five seconds. **How do you avoid getting stopped out by a stop run?** By not putting your stop where everyone else puts theirs. The stop goes beyond the obvious zone, not right at it, with enough room that an excursion of a few ticks does not trigger it. And if the scenario is precisely the stop run, you do not enter on the break but on price's return inside the level, with a stop on the far side of the excursion: the risk is short because the excursion has already happened.