Anatomy of a Flash Pump
It starts with a thin orderbook. SOL/USDT on Binance futures, overnight session, Asian markets winding down, European markets not yet open. The ask side has $2M of liquidity within 0.5% of the current price. That's thin for SOL.
A market buy comes in. Not huge, just $800K. But it eats through the first three levels of the ask. Price jumps from $148.00 to $149.20. Now the short sellers' stop losses start triggering. Each stop loss is a market buy. The cascading stop losses consume the remaining asks. Price hits $153.00 in under 5 minutes. That's a +3.4% move.
The whole sequence: initial order, stop cascade, peak, and the beginning of the reversion, took 5 minutes and 12 seconds. Most traders saw it on their next candle close. By then, the price was already retracing.
Why Fixed Candle Analysis Fails
Standard charting tools like TradingView, exchange charts, and even most alert services analyze fixed-interval candles. A 5-minute candle opens at :00 and closes at :05. A 15-minute candle opens at :00 and closes at :15.
Problem: price spikes don't respect candle boundaries. A spike that starts at 2:30 and peaks at 7:30 gets split across two 5-minute candles. The first candle (0:00-5:00) shows half the move. The second candle (5:00-10:00) shows the other half. Neither candle individually triggers a 7% threshold alert, even though the actual move was 7% from start to peak.
This isn't a minor edge case. It's a common engineering observation across major-exchange spike samples that a meaningful share of multi-minute spikes get split across candle boundaries — the exact distribution depends on the dataset, the threshold and the methodology used to label a spike. The practical takeaway is the same either way: a non-trivial chunk of significant moves is invisible to standard candle-based alerting.
Sliding Window Detection
The solution is simple in concept, hard in implementation: sliding time windows. Instead of fixed intervals, you maintain a rolling window that slides with every new price update. At any given moment, the system knows the percentage change over the last 1 minute, 5 minutes, 15 minutes, and 60 minutes, starting from right now, not from the last candle open.
A spike that starts at 2:30 and peaks at 7:30? The 5-minute sliding window catches the full move the instant the peak is reached. No split candles. No missed alerts.
The engineering challenge is maintaining these sliding windows for every pair on every exchange simultaneously. For 5,000 pairs across 7 exchanges with 4 time windows each, that's 14,000 concurrent sliding windows, each updated on every price tick. This is why most alert services don't do it because it's computationally expensive. CryptoGrind uses ring buffers with O(1) insertion and lookup to make it work at scale.
Multi-Timeframe Approach
Different time windows catch different types of moves. Each serves a distinct purpose:
1-minute window catches flash crashes and liquidation cascades. These are the most violent moves, often a single large market order blowing through a thin orderbook. Multi-percent moves of major perp pairs over a span of seconds on a single venue have been observed repeatedly during stress events — they appear too fast for fixed-candle charts to render meaningfully and are exactly the regime where sub-second alerting earns its keep.
5-minute window catches stop-loss cascades and momentum ignition. The SOL example above, +3.4% in 5 minutes, falls squarely here. These are the most common actionable spike signals.
15-minute window catches sustained moves driven by news or whale accumulation. A token gets listed on a major exchange: the price ramp takes 10-20 minutes as the news propagates. Fixed 5-minute candles might show three modest green candles. The 15-minute sliding window shows the full cumulative +12% move.
60-minute window catches slow grinds and distribution patterns. A market maker accumulating BTC over an hour pushes the price +2.5% through a series of small buys. No single 5-minute window triggers. But the 60-minute aggregate catches the full pattern.
What Causes Spikes
Whale accumulation. A single wallet buys $5M of a mid-cap token over 30 minutes. Each buy pushes the price slightly. Other traders see the orderflow and front-run the next tranche. The compounding effect creates a spike that looks organic but has a single source.
Exchange listings. A Binance listing announcement moves price 30-80% on the day. But the initial spike, the first 60 seconds after the announcement, captures 60-70% of the total move. Being alerted to that first spike is worth more than reading the announcement 5 minutes later.
Delistings. The inverse of a listing, and usually more violent. Binance announces delisting of a token, and price drops 40-60% in minutes. The dump detection catches this the instant it starts.
Social media coordination. A crypto influencer with 2M followers tweets about a micro-cap token. The buy pressure hits within seconds. The spike is real, even if the thesis isn't. Catching it fast enough to ride the momentum, and more importantly, recognizing the dump that follows, is what spike detection enables.
Detecting Dumps
Dumps are the inverse of pumps, but they're not mirror images. Dumps are faster, more violent, and more predictable. Fear moves markets faster than greed. A pump might take 10 minutes to reach its peak. The dump that follows can retrace 50% of the move in under 2 minutes.
Dump detection uses the same sliding window architecture but with inverted thresholds. A -7% move in 5 minutes triggers a dump alert. The alert includes the start price, current price, percentage change, and the exchange/pair where the dump occurred.
Volume Confirmation vs. Noise Filtering
Not every price spike is actionable. A +10% move on a micro-cap token with $50K daily volume on MEXC might just be a single retail trade hitting a thin orderbook. Volume context separates signal from noise.
CryptoGrind's Splash service includes volume filters: minimum 24-hour volume thresholds per exchange ensure that spike alerts only fire on pairs with enough liquidity to actually trade. A +8% spike on SOL with $500M daily volume? That's a signal. The same spike on an unknown token with $30K volume? That's noise. The filter kills it before it reaches your Telegram.
Mean Reversion After Spikes
Mean reversion is a well-documented behavior of liquid markets: violent short-term moves are often followed by partial retraces as opportunistic counter-flow returns and stop-driven momentum exhausts itself. Market microstructure research has long observed this pattern across large samples in equities, FX and crypto.
Averages, however, mask wide variance. Any individual spike may extend further, retrace fully, or fail to retrace at all. Whether a 5-minute +3-5% spike on a given pair fades back, holds, or breaks higher depends on order flow, broader market context, exchange-specific liquidity and any news that may have triggered the move in the first place. Past behavior in similar conditions does not predict any specific future move.
CryptoGrind's role here is upstream of any trade decision: the alert tells you that an abnormal move is happening on a specific pair, exchange and timeframe, the moment it crosses your threshold. What to do with that information — fade it, follow it, ignore it, or simply note it for later study — is a decision for you, made under your own risk framework. This article is educational content about market microstructure, not investment advice or a trading recommendation.
Spike detection isn't about catching the top or the bottom. It's about being aware that an abnormal move is happening while it's still happening, not 5 minutes later when the candle closes.