Modelling crypto order-flow imbalance as an additive–multiplicative process — or, detecting whale activity (well… sort of)
Oren Tapiero14 min read·Just now--
Why concentrated, self-amplifying flow doesn’t always move prices — and how to tell when it will.
The setup
Most order-flow imbalance (OFI) models in crypto treat imbalance as an explanatory variable for returns. You regress next-bar returns on signed taker-buy share, get a price-impact coefficient, call it a day. The imbalance itself is just an input.
This piece argues for a different lens: OFI should be viewed as a stochastic process that merits its own modeling. When modeled accurately, it naturally yields three insights: heavy-tailed returns, a continuous real-time assessment of whether the market is driven by self-amplifying flow or background noise, and a partial answer to a question every crypto practitioner eventually asks: are the whales doing something right now?
The phrase “well… sort of” in the title really captures the essence here. This framework isn’t about tracking individual whales or pinpointing which wallet is making moves. Instead, it focuses on identifying the distinct microstructural pattern of the flow that whales usually create — think of it as concentrated, directional, and self-amplifying. It does this continuously and in real time using two OLS regressions, without depending on any on-chain data. Whether you see this as a “whale detection” tool really hinges on how you define the term. As an indicator of whale-like flow patterns, it makes sense. However, if you’re searching for a tool to identify specific wallets, this isn’t the one.
The framework is an additive × multiplicative stochastic process. The empirical work covers BTC, ETH, BNB, SOL, and XRP at 4-hour frequency, 2019–2024, on Binance.
The headline result, before any of the math: state-dependent OFI amplification is a persistent structural feature of crypto order flow — not a crisis artifact. Across all five assets and twelve independent six-month sub-periods, the multiplicative variance component is positive and significant, with Fama–MacBeth t-statistics between 3.26 (BTC) and 5.05 (XRP).
But persistence at the process level doesn’t mean persistence at the price level. The transmission from OFI dynamics to return variance is gated by market depth, and that gate has been mostly closed since late 2022. That’s the more interesting story, and we’ll get to it.
Why additive×multiplicative
Take the relative OFI:
A value near +1 means buy-initiated flow dominates; near −1, sell-initiated. This is just normalised signed taker volume, nothing fancy.
Now model its dynamics as:
Two independent Wiener processes. One scales with the current state (the multiplicative term, with diffusion coefficient sigma_m times I_t), one doesn’t (the additive term, sigma_a). The drift is mean-reverting , nu is negative across all five assets and all twelve sub-periods.
The conditional variance of OFI changes is:
This is the whole engine. When the imbalance is small, the additive piece dominates and the process behaves like a vanilla noise-driven system. When the imbalance is large, the multiplicative piece kicks in: extreme states beget more extreme states. State-dependent amplification.
Discretised, this becomes a Kesten recurrence with power-law stationary tails — heavy tails emerge as a structural consequence of the mechanism, not as a distributional assumption.
What the multiplicative noise actually represents. Three participant types, all well-documented:
- Whales — large holders whose position sizes produce flow disproportionate to routine trading noise (Bouchaud et al. 2009; Makarov & Schoar 2020). When a whale moves, the size of their order is set by their book, not by current market state — but the price response to that order scales with where the market already is. That’s multiplicative.
- Trend followers who reinforce the prevailing direction (De Long et al. 1990; Cutler et al. 1990). Their flow is explicitly a function of recent state.
- Leveraged traders who unwind into falling markets, generating self-reinforcing sell-side pressure (Geanakoplos 2010; Brunnermeier & Pedersen 2008). Margin calls are state-triggered by construction.
When any of these dominate, current imbalance state determines future imbalance variance. That’s what a positive multiplicative variance component is measuring. The model can’t tell you which of the three is active at any moment, it just tells you that something state-dependent is driving flow. In crypto, given on-chain ownership concentration, the whale channel is usually a reasonable first guess.
Estimation: a two-step OLS that anyone can run
The estimation is embarrassingly simple. First, the conditional mean:
Then the conditional variance:
Two OLS regressions. The intercept of the second one is the additive variance; the slope on the squared imbalance is the multiplicative variance. Clip negatives at zero (variances must be non-negative) and you’re done.
In about twenty lines of NumPy:
import numpy as np
def estimate_am_ofi(I, clip_negative=True):
"""
Two-step OLS estimator for the additive-multiplicative OFI model.
Parameters
----------
I : array-like
Relative OFI series in [-1, 1], shape (T,).
Returns
-------
dict with keys: nu, sigma2_a, sigma2_m, threshold, s_m
"""
I = np.asarray(I, dtype=float)
dI = np.diff(I)
I_lag = I[:-1]
# Step 1: conditional mean — recover the drift parameter
nu = np.cov(dI, I_lag, ddof=1)[0, 1] / np.var(I_lag, ddof=1)
u = dI - nu * I_lag
# Step 2: conditional variance — regress squared residuals on squared OFI
X = np.column_stack([np.ones_like(I_lag), I_lag**2])
coef, *_ = np.linalg.lstsq(X, u**2, rcond=None)
sigma2_a, sigma2_m = coef
if clip_negative:
sigma2_a = max(sigma2_a, 0.0)
sigma2_m = max(sigma2_m, 0.0)
# Dominance threshold and per-bar multiplicative share
threshold = np.sqrt(sigma2_a / sigma2_m) if sigma2_m > 0 else np.nan
s_m = (sigma2_m * I_lag**2) / (sigma2_a + sigma2_m * I_lag**2 + 1e-12)
return {"nu": nu, "sigma2_a": sigma2_a, "sigma2_m": sigma2_m,
"threshold": threshold, "s_m": s_m}That’s the whole estimator. Feed it a relative OFI series and it returns the drift, both variance components, the threshold, and the per-bar multiplicative share.
To check robustness, split the sample into K = 12 six-month sub-periods, run the estimator within each, and compute Fama–MacBeth t-statistics. Across all five assets:
The multiplicative component is significant for every asset across every sub-period. Mean reversion holds everywhere. And the dominance threshold — the imbalance level at which multiplicative variance equals additive variance — is well-identified and economically interpretable.
That threshold is the most useful single number the model produces. It tells you, asset by asset, how much directional concentration the market can absorb before self-amplifying dynamics take over.
The cross-sectional ordering is clean: ETH (0.430) > SOL (0.418) > BTC (0.328) > BNB (0.277) > XRP (0.227). Deeper books require larger imbalances; concentrated-ownership assets like XRP flip into multiplicative dominance with relatively modest flow.
The multiplicative share as a regime indicator
Define the share of conditional OFI variance attributable to the multiplicative channel:
This is bounded in [0, 1]. Smooth it with a 10-bar moving average and you get a continuous regime indicator: how much of right-now’s OFI variance is being driven by state-dependent amplification versus background noise.
Empirically, the multiplicative share is compressed near zero most of the time, punctuated by sharp episodic spikes. The 80th-percentile threshold sits around 0.07 for BTC and 0.05 for ETH. Above the threshold, the regime is active; below it, the additive baseline dominates.
For BTC, four episodes carve up the sample:
- Thin liquidity era (mid-2019 to early 2020). Sustained moderate elevation, peak 0.62. Choppy, no single shock.
- COVID crash (Feb–May 2020). Local peak Feb 3, 37 days before Black Thursday’s ~50% collapse. Pre-crash repositioning produced concentrated directional flow that resolved into the crash later.
- FTX collapse (Oct 2022 — Feb 2023). Peak Jan 10, 2023 — two months after FTX failed. The peak coincides with the recovery rally, not the collapse. The collapse itself was a forced-liquidation event too fast for the OFI channel to build a multiplicative signal beforehand.
- Institutional bull run (2024). 26.9% of bars above threshold over the year, a sustained baseline rather than a sharp spike. ETF-driven concentrated flow without the acute stress of crisis episodes.
Episode 4 is the structural anomaly. The OFI process is in a multiplicative regime almost continuously, yet realised return variance stays muted and the path remains orderly. To understand why, we need the price-impact equation.
From OFI variance to return variance — the structural hinge
This is where the framework earns its keep. Everything up to now has been about the OFI process in isolation. The question that matters for trading is whether any of it transmits to prices, and if so, when.
The bridge is the contemporaneous price-impact equation:
A familiar object, but here it’s doing structural work, not just regression work. It’s the operator that maps an OFI state into a return. Once you have it, you can take the conditional variance of next-period returns given the current imbalance state:
And the inner term, the conditional variance of next-period OFI given the current state, is exactly what the additive multiplicative model gives us. Substitute, and you get the central structural result:
Read this slowly. The conditional variance of returns inherits the additive multiplicative structure of OFI, scaled uniformly by the squared price-impact coefficient. Three terms, doing three different jobs:
The first term is a state-independent baseline. Always there. This is the return variance you’d get if OFI were a pure additive, Gaussian-like process.
The second term is the state-dependent return variance. This is the term that lights up when the imbalance is large, and it’s the entire reason the framework exists. Concentrated flow today produces more variable returns tomorrow, with the magnitude scaling quadratically in the imbalance.
The third term is the residual return variance not attributable to OFI. Information shocks, news, everything else.
The fraction of forecast return variance coming from the multiplicative channel is the thing you can actually compute on live data:
This is the whole risk-management story, compressed into one expression. Three things have to line up for a large return realisation.
First, the multiplicative variance parameter has to be non-trivial. The asset has to have state-dependent dynamics at all. Persistent across all five assets, established structurally.
Second, the imbalance has to be currently sitting in a multiplicative state. Time-varying, observable in real time.
Third, and this is the one that matters: the price-impact coefficient has to be open. Time-varying, regime-dependent, and crucially, not under the trader’s control.
That third condition is where everything interesting happens. Cont, Kukanov & Stoikov (2014) gave us the inverse relationship between price impact and market depth: deep books give a small price-impact coefficient; thin books give a large one. So the same elevated multiplicative state produces wildly different return variance depending on whether the book is thick or thin. A fully loaded multiplicative OFI regime gets quarantined from prices when depth is sufficient. The flow is there. The amplification is there. But the price doesn’t move, because liquidity absorbs it.
This is the equation that makes the 2024 dissociation interpretable rather than mysterious. And it’s the equation that tells you why “concentrated flow detected” is not the same as “trade signal.” You need to verify, separately, that the price-impact channel is awake.
The 2024 dissociation
Estimate the price-impact coefficient as a 250-bar rolling regression of next-period returns on current OFI. For BTC, ETH, BNB, and SOL, the coefficient collapses toward zero after the FTX crisis and stays there throughout 2024.
The post-FTX compression is the most economically significant time-series feature in the data. It produces a striking pattern in 2024: the multiplicative share of OFI variance is persistently elevated, but the multiplicative share of return variance stays compressed near zero. The OFI process is multiplicative; the return variance channel is not.
What’s happening structurally: the spot Bitcoin ETFs approved in January 2024 brought large institutional flows that produced concentrated directional pressure, raising the multiplicative share of OFI variance. But those same institutions also brought deep liquidity provision, collapsing the price-impact coefficient. The flow was multiplicative; the depth absorbed it. Return path: +121% on the year, max drawdown −8.2%.
Compare to FTX. October 2022 to February 2023, both the multiplicative share and the squared price-impact coefficient are simultaneously large. The OFI channel explains 10.6% of realised squared returns in that episode, roughly ten times its explanatory power in any other episode. The multiplicative-to-additive ratio inside the OFI variance term hits 52.1, meaning the channel is almost entirely multiplicative-driven during this window.
This is the practitioner-grade synthesis: multiplicative OFI is necessary but not sufficient for large return realisations. You need concentrated flow and a thin book simultaneously. Either alone won’t do it.
Crash-phase betas: the inversion
Classify each bar by market phase using BTC dynamics: Bull, Bear, Crash, Recovery. The mean rolling price-impact coefficient within each phase reveals something quietly important:
For BTC and ETH, the crash phase beta inverts: buy side OFI predicts negative next bar returns. The mechanism is straightforward. Informed sellers absorb incoming buy initiated liquidity to unwind positions, then push prices down. The usual positive relationship between OFI and returns reverses.
SOL’s crash phase beta is the anomaly. Strongly positive. The microstructural signature of a market in existential stress: during the LUNA and FTX episodes, the sell side effectively disappeared, so any surviving buy side flow had unbounded price impact.
XRP is the other outlier, with a positive price impact coefficient across all phases. Momentum driven microstructure dominated by directional, trend following participants. This is also why XRP has the lowest dominance threshold (0.227). Concentrated ownership and an idiosyncratic regulatory backdrop mean the market flips into multiplicative dominance with very modest flow.
What the model does NOT do
This matters, especially if you’re going to use it for trading purposes.
The multiplicative share has leading indicator properties for specific crisis events. COVID showed a peak lag of −20 bars with peak correlation 0.36; LUNA showed −18 bars and 0.60. Both events featured a gradual buildup of concentrated directional flow that the model identified weeks before the price collapse.
But this does not generalise to an unconditional timing signal. Define a spike onset as the first bar of a contiguous run above the 70th percentile threshold, measure forward distance to the next 2σ price move, compare against a memoryless geometric null using Kolmogorov Smirnov. The geometric null is not rejected for any asset. The forward distance distribution is consistent with a memoryless process at the unconditional level.
Translation: the multiplicative share does not, on average across the full sample, produce statistically robust forward timing. The leading indicator behaviour is episode specific, concentrated in events with gradual flow buildup, and gets diluted by events triggered by discrete exogenous shocks (FTX insolvency, ETF approval, regulatory actions) where the regime activates in response rather than in anticipation.
So treat the multiplicative share as a structural state variable identifying periods of concentrated, self amplifying flow, not as a short horizon trigger. That’s the boundary the KS test draws, and it’s worth respecting.
What you can do with this
A few practical takeaways for someone hunting alpha in crypto microstructure.
The dominance threshold is a meaningful, asset specific calibration constant. It tells you when the linear price impact assumption (Almgren Chriss style) is going to fail you. Above the threshold, expect non linearity, expect tail risk in execution, expect the price impact coefficient to be the wrong functional form.
The two channel decomposition is operationally useful even without a forecast. The OFI multiplicative share and the return variance multiplicative share can agree or diverge. When they agree, you’re in a coherent regime. When they diverge, like 2024, the standard intuition that concentrated flow produces big moves breaks down. That divergence itself is information.
Cross asset synchronisation is a parameter free systemic indicator. When three or more of five majors are simultaneously in their own multiplicative regime, you’re in a systemic episode (COVID and LUNA both showed sustained synchronisation above 0.60). When the spike is confined to one asset, it’s idiosyncratic (XRP’s legal resolution). No tuning required beyond the per asset threshold.
The depth conditioning of price impact is the rate limiting step for any OFI based return forecast. If the price impact coefficient is compressed (which it has been for BTC since FTX), don’t bet on OFI driven return predictions. The channel is closed. Wait for the coefficient to wake up. It will, eventually, when depth thins.
Where this goes next
Three obvious extensions for anyone who wants to push this further:
On-chain ownership concentration. The cross-sectional ordering of dominance thresholds correlates with intuitions about ownership concentration, but it isn’t tested formally. Crypto markets have something traditional asset classes don’t: observable wallet-level wealth distributions. Gini coefficients, Pareto exponents, large-holder activity ratios. Plug those in as cross-sectional explanatory variables for the threshold and you get a direct empirical link between on-chain structure and microstructural amplification.
Better depth proxies. The Amihud (2002) illiquidity ratio is what was available at four-hour frequency for the full 2019–2024 sample. It’s a noisy proxy. Repeating the depth-absorption analysis with order-book-level resting liquidity (aggregate depth within five basis points of the midpoint) would turn the suggestive evidence into a clean test, and probably resolve the BNB anomaly, where the rolling correlation between illiquidity and the absolute price-impact coefficient inverts — likely because Binance-specific flows confound the depth measurement on its own native token.
Multivariate extension. The single-asset framework treats the five coins independently, then aggregates via a synchronisation indicator. A genuinely multivariate additive multiplicative model, with cross-asset multiplicative spillovers, would formalise the systemic-risk channel and probably reveal lead-lag structure across assets that the univariate work misses.
Closing
The additive×multiplicative lens does two things at once. It generates heavy-tailed OFI as a consequence of the participant structure rather than as an assumption, and it gives you a continuous, real-time decomposition of how much of right-now’s market is being driven by self-amplifying dynamics versus background noise.
So, is this whale detection? Sort of. It’s detection of the kind of flow whales produce, which is a strictly weaker claim but a useful one. You don’t get a wallet address out of it; you get a regime indicator that flips on when concentrated, state-dependent flow dominates the imbalance process, regardless of whether that flow comes from one whale, a coordinated group, a forced-liquidation cascade, or a wave of trend followers. For a practitioner trying to size positions or set execution thresholds in real time, that’s often the question that actually matters.
Whether those dynamics matter for prices is a separate question, gated by depth. Most of the time, in 2024, they didn’t. During FTX, they did, a lot.
The bigger lesson, the one I think generalises beyond crypto: when you have a microstructural process that can flip between additive and multiplicative regimes, modelling that flip explicitly is worth more than fitting one more GARCH variant to the returns it produces. The returns are downstream of the process. Model upstream.
Full paper: “Modelling Crypto Asset Order Flow Imbalance as an Additive and Multiplicative Process,” April 2026.
