ACADEMY · ORDER FLOW

What a Cluster of Large Trades Tells You

· 5 min read ORDER FLOW ETFs

Scope: measured on SPY and GLD (with IBIT and ETHA as a contrast case) on one-minute closes, against controls matched on time of day and prior volatility. Volatility only — the note makes no directional claim.

It tells you how much price is about to move, and nothing about which way. When several index ETFs print unusually large trades within the same short window, the following hour's realized volatility runs about 1.2 times a matched quiet minute's — 1.3 times in the first fifteen minutes — while the direction of the move stays a coin flip. The clustering matters: a single large print with no company predicts almost nothing.

All 26 research notes

What is being measured#

Our charts mark unusually large trades on each fund. Sometimes several funds mark one within minutes of each other, and that is the event tested here: three or more of SPY, QQQ, IWM and DIA inside a thirty-minute window (the index group), or both of GLD and SLV inside ten minutes (the metals group). The event time is the moment the condition is first met — nothing about what happened afterward is allowed to define it.

The outcome is realized volatility: the average size of a one-minute move, over the following hour, on SPY for the index group and GLD for the metals group. Volatility rather than return, because return has a direction and this measures size.

Why a control group decides everything here#

Clusters do not arrive at random moments. They land in minutes that are already busy — a fact worth putting a number on, because it is the entire trap. In the half hour before an index cluster, SPY was moving about 0.034% per minute against 0.017% for an ordinary minute. Twice as fast, before the event.

So "volatility was high after a cluster" is not a finding. Every cluster is compared against minutes from the same half hour of the trading day and the same prior-thirty-minute volatility band, at least an hour away from any cluster and half an hour from any large-trade mark. Confidence intervals come from a bootstrap clustered by trading day. Without that matching, the numbers below roughly double, and all of the extra is time-of-day and momentum that was already there.

The answer#

Realized volatility after a cluster, divided by the matched control's. 1.00 would mean no effect:

Window after the cluster Index group (SPY) Metals group (GLD)
First 15 minutes 1.31x [1.21, 1.42] 1.50x [1.39, 1.63]
15–30 minutes 1.22x [1.13, 1.33] 1.33x [1.22, 1.47]
30–60 minutes 1.17x [1.08, 1.27] 1.26x [1.15, 1.41]
60–120 minutes 1.14x [1.05, 1.23] 1.18x [1.05, 1.36]
Full hour 1.21x [1.13, 1.32] 1.34x [1.22, 1.47]

Two things stand out. The effect is largest immediately and decays, which is what a real reaction to a real event looks like. And it is still there in the second hour, in both groups — the window a cluster opens is wider than the mark on the chart.

Does the clustering actually matter?#

This is the question that decides whether a cluster is worth drawing at all, and it has a clean test. Take the large prints that fired alone — one fund marked, the others quiet, no cluster forming within half an hour — and run them through the same machinery.

Cluster Single print, no cluster
Index group, first 15 min 1.31x 1.07x [1.04, 1.11]
Index group, full hour 1.21x 1.05x [1.01, 1.09]
Metals group, first 15 min 1.50x 1.18x [1.12, 1.26]
Metals group, full hour 1.34x 1.10x [1.05, 1.17]

A lone large print is worth a few percent. A cluster is worth twenty to fifty. Whatever the clustering represents, it is not a repackaging of "a big trade happened".

More funds, more movement#

The effect scales with how much of the group participates — which is harder to fake than the headline, because a matching artifact has no reason to produce an ordered response:

Volatility ratio, next hour
Three of four index funds 1.16x [1.07, 1.27]
Four of four 1.27x [1.16, 1.39]
Index cluster, ~4 marks total 1.13x
~6 marks 1.22x
~9 marks 1.36x
Metals, ~2 marks 1.24x [1.14, 1.36]
Metals, ~4 marks 1.61x [1.43, 1.84]

Every ladder runs the same way. A bigger cluster is a bigger statement about the next hour.

Where it does not hold#

The crypto funds. Running the identical test on IBIT and ETHA — eleven months of data, 260 clusters — the effect appears in the first fifteen minutes (1.14x and 1.21x) and is gone by the next fifteen (1.01x and 1.06x). Across the full hour IBIT lands at 1.06x with an interval that includes 1.00.

That is not simply a smaller sample failing to reach significance. The interval's upper bound is 1.16x, and both other groups sit above it, so the data can rule out an effect of the size they show. The single-print gap nearly vanishes too. One plausible reason, offered as a guess rather than a finding: Bitcoin and Ether trade continuously and globally, so a US fund's regular session is a window onto a price being set elsewhere, and large prints on that tape are more likely to be following a move than making one.

And the direction?#

Nothing, in any group. We spent considerable effort on this question before concluding it had no answer: at the moment a cluster forms, whether the underlying prints skew toward buying or selling carries no information about which way price goes next. Hit rates land between 45.7% and 56.6% across three groups and several horizons, with every interval containing a coin flip.

That result is the reason our own bands no longer carry a direction. The honest reading is the one this note is built on: a cluster is a statement about energy, not about sign. Where price goes from there is a question for levels, structure and context — the things a trader brings to the chart, not something the cluster answers on its own.

What changes tomorrow#

Treat a cluster of large prints as a volatility forecast with a one-hour horizon, and size positions accordingly rather than reading a bias into it. Expect roughly 20–35% more movement than the clock and the recent tape would otherwise suggest, more when more of the group joins in, and expect it to persist past the point where the mark leaves your screen. If you catch yourself inferring direction from the composition of the cluster, that inference has been measured, and it is not there.

Scope: measured on SPY (index group) and GLD (metals group) on one-minute closes, with the crypto check on IBIT and ETHA; other funds are not separately tested. Volatility is the mean absolute one-minute return; comparisons are against controls matched on time of day and prior-thirty-minute volatility. The index control set is small — 6,932 minutes — because marks are frequent enough that genuinely quiet minutes are scarce, so treat single-threshold cuts from that group with more caution than the volatility ratios. Windows: index and metals from 2025-02-10, crypto from 2025-09-22, both through 2026-09-01. Descriptive statistics, not a trading rule, and not investment advice.

See these levels on a live chart

Option-derived levels and futures tape on one timeline.